ClawHub
Back to skill

Security audit

Piccc AI Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with Piccc AI media generation, but it needs review because its credential and network scoping leave real account-token exposure risks.

Install only if you are comfortable linking a Piccc AI account and storing an API key locally. Prefer a pinned or reviewed installation source, avoid setting PICCC_API_BASE_URL or PICCC_AUTH_BASE_URL outside testing, review downloaded output locations, and use auth logout when finished on shared machines.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/piccc.mjs:496
Finding

Bearer Credential Disclosure Through an Unrestricted API Base URL Override

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/piccc.mjs:458
Finding

Unvalidated Task Output URLs Permit SSRF and Unbounded File Downloads

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:16
Finding

Documentation Recommends an Unpinned Third-Party Installer

Content
View full analysis
Remediation
View remediation
`. 2. Where supported, use a package-manager lockfile or integrity hash to verify the installer package. 3. Pin the Skill source to a signed release tag or full commit hash rather than the repository’s mutable default branch. 4. Publish checksums or cryptographic signatures for release artifacts. 5. Document how users can verify the expected commit, checksum, and publisher identity before installation. 6. Prefer an installation mechanism that displays the exact source revision and requests confirmation before executing downloaded code. 7. Periodically review pinned versions and update them through an auditable release process. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 2)May include surrounding context.

text
node_modules/
.env
output/
coverage/

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/piccc.mjs (reported line 673)May include surrounding context.

js
test('device authorization saves credentials and uses them automatically', async () => {
  const directory = await mkdtemp(join(tmpdir(), 'piccc-skills-auth-'))
  const credentialsFile = join(directory, 'credentials.json')
  const env = {
    PICCC_API_KEY: '',
    PICCC_API_BASE_URL: baseUrl,

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/skills.test.mjs (reported line 215)May include surrounding context.

js
test('device authorization saves credentials and uses them automatically', async () => {
  const directory = await mkdtemp(join(tmpdir(), 'piccc-skills-auth-'))
  const credentialsFile = join(directory, 'credentials.json')
  const env = {
    PICCC_API_KEY: '',
    PICCC_API_BASE_URL: baseUrl,

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/skills.test.mjs (reported line 264)May include surrounding context.

js
test('device authorization saves credentials and uses them automatically', async () => {
  const directory = await mkdtemp(join(tmpdir(), 'piccc-skills-auth-'))
  const credentialsFile = join(directory, 'credentials.json')
  const env = {
    PICCC_API_KEY: '',
    PICCC_API_BASE_URL: baseUrl,

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/skills.test.mjs (reported line 285)May include surrounding context.

js
function runRaw(args, env = {}) {
  return new Promise((resolveRun, rejectRun) => {
    const child = spawn(process.execPath, [resolve(root, script), ...args], {
      env: { ...process.env, PICCC_API_KEY: 'test-key', PICCC_API_BASE_URL: baseUrl, ...env },
      stdio: ['ignore', 'pipe', 'pipe'],
    })
    let stdout = ''

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README states that an API key will be created and stored locally, but does not clearly warn users where it is stored, how it is protected, or how to remove it beyond a logout command. This can lead to credential persistence on disk without informed consent, increasing the risk of accidental exposure through backups, shared machines, weak file permissions, or workspace leakage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes shell commands, performs networked API actions, and manages credentials, but it does not declare any explicit tool scope or allowed-tools boundary. That omission weakens least-privilege controls and makes it easier for an agent runtime to grant broader capabilities than are actually required, increasing the blast radius if the skill is misused or the backing script is compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
Before the first request, run `node {baseDir}/scripts/piccc.mjs auth status`. If it reports `authenticated: false`:

1. Explain that the user must sign in and approve access in the browser.
2. Run `node {baseDir}/scripts/piccc.mjs auth login` and wait for it to finish. The command opens the authorization page, receives the local callback, saves the API key, and queries the available balance. Do not ask the user to report completion.
3. If the browser cannot be opened, share the displayed link and verification code while the command keeps waiting. Never ask the user to create, copy, or paste an API key.
4. After authorization, read `available_credits` from the result and report the balance in the user's current language.
5. If `available_credits` is unavailable, run `node {baseDir}/scripts/piccc.mjs credits` and then report the returned balance.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
1. Explain that the user must sign in and approve access in the browser.
2. Run `node {baseDir}/scripts/piccc.mjs auth login` and wait for it to finish. The command opens the authorization page, receives the local callback, saves the API key, and queries the available balance. Do not ask the user to report completion.
3. If the browser cannot be opened, share the displayed link and verification code while the command keeps waiting. Never ask the user to create, copy, or paste an API key.
4. After authorization, read `available_credits` from the result and report the balance in the user's current language.
5. If `available_credits` is unavailable, run `node {baseDir}/scripts/piccc.mjs credits` and then report the returned balance.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The default prompt automatically instructs the agent to use the external skill to authorize the user's account and disclose available credits, even without a narrowly scoped user request. This can cause unintended skill activation and unnecessary account-linking or data access, especially in systems where default prompts influence agent behavior before explicit consent is obtained.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The callback fetch explicitly sets the Accept-Language header to 'zh-CN', which hard-codes a locale preference in natural-language behavior. This matches the policy category for language/locale violations because no user choice, opt-in, or documented region-specific justification is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

All user-facing instructions in this file are written in Chinese, with no indication that other languages are supported or that Chinese is required for a region-specific reason. Under the stated policy, forcing a specific language without user choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The authorization callback page chooses English or Chinese text based on the browser's Accept-Language header, but the HTML document is always declared as lang="zh-CN". This creates a locale policy mismatch because the skill effectively forces a Chinese locale marker without user opt-in, even for English users.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/piccc.mjs:640

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
test/skills.test.mjs:284

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/piccc.mjs:165

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
test/skills.test.mjs:285

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
test/skills.test.mjs:69

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
scripts/piccc.mjs:678

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
test/skills.test.mjs:238