ClawHub
Back to skill

Security audit

fashion-lookbook-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed fashion image-generation workflow that fetches or saves images only as part of the requested lookbook creation process.

Before installing, understand that this skill can fetch Pinterest or other linked image content, save reference images under the workspace inputs folder, and generate output images that consume ImageGen credits. Review or override the default model attributes if they do not match your intended audience or subject.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes broad phrases like '种草图', '穿搭图', and 'lookbook' that can activate the skill for many ordinary fashion or image-editing requests beyond the narrow intended workflow. Over-broad activation can cause the agent to route users into a skill that performs external fetching and file writes unexpectedly, increasing the chance of unintended tool use and user confusion.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs the agent to retrieve Pinterest content over the network and save it into local workspace paths without a clear user-facing consent step. This is risky because it can cause silent external requests, local file creation, and processing of third-party content the user may not realize is being fetched or stored.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The skill sets a default model identity of '东亚年轻女性' without user opt-in, which bakes demographic assumptions into output generation. In a content-generation system, this can lead to biased or inappropriate outputs, especially when users did not request a specific gender, age, or ethnicity.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The example prompt hard-codes 'a young East Asian woman', reinforcing the same demographic bias in the template users or downstream systems are likely to reuse. Although this is an example rather than a mandatory parameter, templates strongly shape behavior and can normalize non-consensual demographic targeting.

Static analysis

No suspicious patterns detected.