ClawAudit verdict
aicraft-skill
Reads local files AND makes external network calls
An e-commerce AI content generation platform integration that reads user images and uploads them to the stated 51aic.com/fzputi.com CDN using a user-supplied session token; all data flows match the declared purpose and the security note explicitly warns users not to share tokens.
Automated static analysis β not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but ClawAudit detects co-occurrence β it does not verify that one flows into another. Read the code to confirm a live chain.
Reads local files AND makes external network calls β the capabilities for data exfiltration co-occur (data-flow not verified)
LLM02 Β· LLM06 Β· ASI03
Reads files, encodes data, AND makes external network calls β the obfuscated-exfiltration pattern (data-flow not verified)
LLM02 Β· ASI03
Permission integrity
network_out
file_read
Findings (3)
Possible hardcoded credential
SKILL.md Β· code Β· TOKEN = "<η¨ζ·token>
Python urllib.request β network access
SKILL.md Β· code Β· urllib.request
Python http.client β stdlib network access
SKILL.md Β· code Β· http.client.HTTPSConnection
Permissions & capabilities
No declared permissions β minimal attack surface.
network_outdata_encodingfile_read Thanks β recorded.