ClawHub
Back to skill

Security audit

Rendshot

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Rendshot integration for image rendering and screenshots, but users should avoid sending sensitive pages, HTML, prompts, or secrets to the external service.

Install only if you are comfortable using Rendshot or a self-hosted Rendshot endpoint for rendering. Do not submit secrets, private customer data, authenticated account pages, internal URLs, or proprietary HTML unless you intentionally want that content processed by the service. Prefer pinned package versions for CLI/SDK use, and use a private or self-hosted deployment for sensitive rendering workloads.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/api-endpoints.md:60
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: references/api-endpoints.md, lines 60, 87, and 111
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippets:

markdown
## CLI

Install: `npm install -g rendshot`
markdown
## SDK (Node.js)

Install: `npm install @rendshot/sdk`
markdown
## Python SDK

Install: `pip install rendshot`

Technical Analysis

The documented installation commands retrieve third-party packages without pinning reviewed versions, validating integrity hashes, or using lockfiles. Consequently, the installed code is determined by the package registry at installation time and may differ from the version assessed during this audit.

The global npm command is particularly sensitive because npm packages can run lifecycle scripts during installation in the invoking user's environment. The Node.js SDK and Python SDK also execute imported package code at runtime. Although no evidence establishes that the referenced packages are currently malicious, these installation practices create supply-chain exposure if a package release, maintainer account, package registry, or transitive dependency is compromised.

Attack Path

  1. An attacker compromises a referenced package, its maintainer account, or one of its transitive dependencies and publishes a malicious release.
  2. A user follows one of the documented unpinned installation commands.
  3. The package manager resolves and downloads the current package release rather than a previously reviewed version.
  4. Malicious npm lifecycle scripts may execute during installation, or malicious Node.js/Python code may execute when the SDK is imported or invoked.
  5. The payload runs with the privileges of the user performing the installation or using the SDK.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the installing user's account. Depending on t ...[truncated 534 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every package to a specific, reviewed version, for example:
    • npm install -g rendshot@<reviewed-version>
    • npm install @rendshot/sdk@<reviewed-version>
    • pip install rendshot==<reviewed-version>
  2. Provide lockfiles for Node.js integrations and require reproducible installation commands such as npm ci.
  3. Use package integrity verification, including npm lockfile integrity metadata and Python hash checking with pip install --require-hashes.
  4. Identify and link the official package registry entries and source repositories so users can verify package ownership and avoid typosquatting.
  5. Avoid global npm installation where practical. Prefer a project-local dependency or an explicitly pinned npx invocation.
  6. Disable npm lifecycle scripts during installation with --ignore-scripts unless the reviewed package explicitly requires them.
  7. Audit direct and transitive dependencies, monitor advisories, and update pinned versions only after review and testing.
  8. Run package installation and rendering operations in a least-privileged, isolated environment without unrelated credentials or sensitive files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description includes broad phrases like 'generate thumbnail' and 'screenshot this page', which can cause the skill to activate in contexts where the user did not specifically intend to use this external rendering/screenshot capability. Unintended invocation matters here because the skill can transmit URLs, HTML, prompts, and remote asset references to external tooling or services, increasing the chance of accidental data exposure or unsafe actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages screenshotting URLs and rendering templates with remote images, but does not warn that page contents, URLs, HTML, and referenced assets may be sent to an external service. In this context, missing privacy and data-transmission warnings can lead users or agents to process internal URLs, authenticated pages, personal data, or proprietary designs without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation provides direct API and CLI examples that send HTML, prompts, and screenshot URLs to Rendshot’s external service, but it does not warn users that their content will be transmitted off-system. In a skill specifically designed for rendering and screenshots, this omission can lead to unintentional disclosure of sensitive page content, internal URLs, or proprietary HTML/templates.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The /v1/image example transmits user-supplied HTML and related rendering data to an external API endpoint. If operators reuse this example with sensitive markup, embedded tokens, customer content, or internal assets, the skill can facilitate unintended data exposure to a third-party service.

Content

Scanner excerpt · references/api-endpoints.md (reported line 14)May include surrounding context.

POST /v1/image — Render image

bash
curl -X POST https://api.rendshot.com/v1/image \
  -H "Authorization: Bearer $RENDSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The /v1/image example transmits user-supplied HTML and related rendering data to an external API endpoint. If operators reuse this example with sensitive markup, embedded tokens, customer content, or internal assets, the skill can facilitate unintended data exposure to a third-party service.

Content

Scanner excerpt · references/api-endpoints.md (reported line 14)May include surrounding context.

POST /v1/image — Render image

bash
curl -X POST https://api.rendshot.com/v1/image \
  -H "Authorization: Bearer $RENDSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The screenshot example sends a target URL to a remote rendering service, which may cause the service to access and capture content from that location. In this skill’s context, that is especially sensitive because users may attempt screenshots of private, internal, pre-authenticated, or otherwise confidential pages without realizing a third party is involved.

Content

Scanner excerpt · references/api-endpoints.md (reported line 30)May include surrounding context.

POST /v1/screenshot — Screenshot URL

bash
curl -X POST https://api.rendshot.com/v1/screenshot \
  -H "Authorization: Bearer $RENDSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://example.com", "fullPage": true }'

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The AI render example transmits prompts and platform parameters to an external service, and the note about streaming tool calls increases the chance that users misunderstand the amount of data and processing happening remotely. While normal for this product category, undocumented outbound transmission can expose proprietary campaign content, sensitive prompts, or internal business context.

Content

Scanner excerpt · references/api-endpoints.md (reported line 39)May include surrounding context.

POST /v1/ai-render — AI generate (streaming)

bash
curl -X POST https://api.rendshot.com/v1/ai-render \
  -H "Authorization: Bearer $RENDSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "prompt": "Coffee shop card", "platform": "xiaohongshu" }'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-endpoints.md (reported line 50)May include surrounding context.

GET /v1/templates — List templates

bash
curl "https://api.rendshot.com/v1/templates?platform=xiaohongshu&limit=10" \
  -H "Authorization: Bearer $RENDSHOT_API_KEY"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The screenshot_url tool captures arbitrary webpages as images, which can include private account pages, internal dashboards, or other sensitive on-screen data. This markdown section documents the capability but provides no caution about capturing sensitive or authenticated content, despite the category requiring warnings for behaviors that could affect privacy or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The example sets locale: "zh" with a comment indicating it controls response language, which suggests the skill may force Chinese output by default rather than letting the user choose. This conflicts with the policy requirement to avoid imposing a language or locale without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The locale parameter defaults to "zh", which imposes a specific language choice when the user does not explicitly opt in. The policy allows locale constraints only when users are offered a choice or when the constraint is clearly documented and justified; neither is present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.