ClawHub
Back to skill

Security audit

微信小店 电商图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI image-generation helper that uploads user-selected media to AI Hive and downloads generated results, with no evidence of hidden execution or destructive behavior.

Before installing, confirm you are comfortable sending selected product or reference images to AI Hive and storing an AI Hive API key locally. Avoid passing private customer data, chats, credentials, or unrelated local files as reference media.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no permissions, yet the documented commands clearly require shell execution, network access, package installation, local file reads, and likely file writes/downloads. This creates an undeclared capability gap that can mislead users and automated policy systems about what the skill is actually able to do.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as an image-generation/editing helper, but the referenced behavior includes unrelated high-risk capabilities such as chat calls, video generation, user/wallet queries, model enumeration, media upload, and browser/API-key setup. That mismatch materially increases attack surface and enables data access or side effects far beyond what a user would reasonably expect from the description.

Static analysis

No suspicious patterns detected.