ClawHub
Back to skill

Security audit

Images Sender

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it can automatically send images through Messages and contains an AppleScript injection flaw that could let crafted input run local commands.

Review before installing. This skill should only be used if you are comfortable granting Messages automation and local file-copy behavior. It should be changed to require confirmation before sending, validate phone numbers and image files, avoid retaining copied images indefinitely, and pass AppleScript arguments safely instead of interpolating them into script text.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/send.py:31
Finding

AppleScript Injection Through Unescaped Recipient and File Path

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes shell commands and appears to write files, but it declares no explicit tool scope or permissions. That increases the chance an agent can use file and shell capabilities without clear user-facing constraints, making misuse or overreach more likely.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The phrase 'automatically send' authorizes autonomous action affecting external communication without a mandatory approval step. In context, this can send private content through Messages to a stored recipient based on a broad request, increasing the risk of accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
### Send Image

When user requests to send an image, automatically send via iMessage to the phone.

### Manual Commands

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to trigger whenever a user requests to send an image is overly broad and encourages automatic invocation without adequate disambiguation. This can cause unintended sending to a configured phone number, including accidental exfiltration of sensitive images or misuse from ambiguous user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill states that images are automatically copied into a local storage directory before sending, but it does not present this as a clear warning or consent-relevant behavior. Silent duplication of user files can create privacy and retention risks, especially for sensitive images that the user expected to be sent transiently.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comments and logic assume recipients should use the +86 format and automatically prepend the China country code to 11-digit numbers. This imposes a locale-specific behavior in natural-language guidance and runtime behavior without offering the user a choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

The code builds AppleScript by interpolating untrusted input into a quoted script string, then executes it via osascript. An attacker-controlled recipient or image filename containing quotes or AppleScript syntax could break out of the intended string context and inject arbitrary AppleScript commands, potentially causing command execution through AppleScript's automation features.

Content

Scanner excerpt · scripts/send.py (reported line 60)May include surrounding context.

python
end tell
    '''
    
    result = subprocess.run(
        ['osascript', '-e', script],
        capture_output=True,
        text=True

Static analysis

No suspicious patterns detected.