ClawHub
Back to skill

Security audit

Maliang Image

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed image-generation integration, but it gives the agent under-scoped network and shell-command workflows that users should review before installing.

Install only if you are comfortable sending prompts, selected images, and billing/account metadata to nano.djdog.ai. Avoid giving this skill URLs to private, local, intranet, or cloud-metadata resources, and prefer local image attachments. Confirm account provisioning and API-key storage before first use, and use safer request construction than direct shell placeholder substitution.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:88
Finding

Unrestricted User-Controlled URL Retrieval Enables SSRF and Data Exfiltration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:103
Finding

Unsafe User Input Interpolation in Shell and JSON Request Templates

Content
View full analysis
", "aspect_ratio": "" }' ``` ```bash curl -s -X POST "https://nano.djdog.ai/api/v1/edit" \ -H "Authorization: Bearer ${MALIANG_API_KEY}" \ -H "Content-Type: application/json" \ -d '{ "prompt": "", "image": "", "aspect_ratio": "" }' ``` ### Technical Analysis The documented command templates place user-controlled prompts, aspect ratios, and encoded image data directly inside a single-quoted shell argument. The instructions do not require a JSON serializer, shell-safe argument handling, or validation of substituted values. If an implementation follows these templates by textual substitution, a single quote in a prompt can terminate the shell's quoted `-d` argument. Subsequent shell metacharacters can then be interpreted as commands. Independently of shell injection, double quotes, backslashes, control characters, or line breaks in a prompt can corrupt the JSON document or alter its structure. Base64 data normally has a restricted character set, but prompts and editing instructions are arbitrary user input. The aspect-ratio value is also presented as a substitution placeholder without a fixed allowlist. This finding applies to implementations that execute the shown commands through a shell after direct placeholder replacement. The project contains only `SKILL.md`, so no concrete wrapper implementation was available to determine whether a safer structured execution mechanism is used at runtime. ### Attack Path 1. An ...[truncated 1602 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill instructs the agent to automatically create an external account and transmit data to a third-party service without an explicit per-use consent step. Even though this is consistent with the skill’s stated purpose, auto-provisioning can expose user metadata/IP and initiate billing-related state changes on an external service, which is a real security and privacy concern in agent environments.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

On first use (when MALIANG_API_KEY is not set), automatically provision a new account:

bash
curl -s -X POST "https://nano.djdog.ai/api/v1/provision"

Response: