ClawHub
Back to skill

Security audit

Multimodal Image Understanding

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it sends a user-provided image and prompt to a configured multimodal API for analysis.

Install this only if you are comfortable sending the selected image and prompt to the API endpoint you configure. Prefer environment variables for API keys, restrict config file permissions if a key is stored on disk, and do not use it on private or sensitive images unless you intend to share them with that provider.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This script sends the user's prompt and either the image bytes or image URL to a third-party API, but it does not provide a clear user-facing consent or privacy warning at the point of transmission. In this skill's context, the whole purpose is remote multimodal analysis, so data exfiltration is intentional functionality, but the lack of explicit disclosure increases the risk of users unknowingly sending sensitive local files or private image URLs off-host.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.