ClawHub
Back to skill

Security audit

Animated Sticker Maker

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward local animated-sticker maker, with dependency hygiene risks but no evidence of hidden data access or malicious behavior.

Before installing, use an isolated environment and ensure dependency resolution installs a current patched Pillow release rather than an old 10.0.x version. Treat generated packages as containing user-derived image material, and use --include-reference only when you intentionally want the original image copied into the output package.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Unpinned Dependencies

Low
Category
Supply Chain
Content
Pillow>=10.0,<13
numpy>=1.24
Confidence
83% confidence
Finding
The numpy dependency is only lower-bounded and not fully pinned, which harms build reproducibility and can allow unexpected or later-vulnerable versions to be installed. This is generally a supply-chain hygiene issue rather than an immediate exploit, but it can increase risk over time.

Known Vulnerable Dependency: Pillow==10.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2023-4863 (libwebp: OOB write in BuildHuffmanTable) +7 more

Critical
Category
Supply Chain
Confidence
95% confidence
Finding
The requirement allows Pillow 10.0.x because of the range '>=10.0,<13', and static analysis flags Pillow 10.0 as having multiple known critical advisories. In an image-processing skill, this is especially relevant because Pillow will likely parse untrusted user-supplied images, increasing the chance that malformed inputs could trigger memory corruption, denial of service, or potentially code execution depending on the vulnerable code path.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.