ClawHub
Back to skill

Security audit

通用文生图

Security checks for vulnerabilities and agentic risk

Overview

This is a simple text-to-image skill that names external image providers and API keys but contains no executable code or hidden access.

Install only if you are comfortable using external image-generation providers. Configure only the API keys you intend to use, avoid secrets or confidential details in prompts, and monitor provider usage and billing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill description is broad enough to trigger on many generic image-related requests without clearly scoping when it should or should not be used. Overbroad activation can cause unintended routing of user requests to this skill, increasing the chance that prompts or sensitive context are sent to external image providers unnecessarily.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation tells users to configure third-party API keys and send image prompts, but it does not warn that prompts and possibly related metadata will be transmitted to external providers. This creates a privacy and data-governance risk because users may unknowingly include sensitive, personal, or proprietary information in prompts that leave the local environment.

Static analysis

No suspicious patterns detected.