ClawHub
Back to skill

Security audit

bing图片批量下载skill

Security checks for vulnerabilities and agentic risk

Overview

This is a real image downloader, but it needs Review because it can write outside its intended folder, fetch unvalidated remote URLs, and includes optional recurring Feishu forwarding.

Install only if you are comfortable with a downloader that performs network requests and writes files locally. Run it as an unprivileged user in a constrained directory, sanitize keywords before using them as paths, set small download limits, and do not install the cron or Feishu forwarding example unless you have reviewed the recipient, schedule, logs, and removal path.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bing_image_downloader.py:127
Finding

User-Controlled Keyword Enables Arbitrary Output Directory Selection

Content
View full analysis
Remediation
View remediation
Path: slug = re.sub(r"[^A-Za-z0-9_-]+", "_", keyword).strip("_") if not slug: raise ValueError("Keyword does not produce a valid directory name") destination = (DOWNLOAD_ROOT / slug).resolve() if destination.parent != DOWNLOAD_ROOT: raise ValueError("Output directory escapes the download root") return destination ``` 5. Consider generating a hash-based directory identifier while retaining the original keyword only in metadata. 6. Run the downloader as an unprivileged account with write access limited to the download root. 7. Add tests for absolute paths, `../` traversal, Windows drive paths, separators, Unicode separator variants, and empty sanitized names. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bing_image_downloader.py:43
Finding

Unvalidated Search-Result URLs Permit Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bing_image_downloader.py:43
Finding

Unbounded Download Size and Workload Allow Resource Exhaustion

Content
View full analysis
Remediation
View remediation
MAX_FILE_BYTES: raise ValueError("Image exceeds the size limit") written = 0 with open(temp_path, "wb") as file_obj: for chunk in response.iter_content(chunk_size=8192): if not chunk: continue written += len(chunk) if written > MAX_FILE_BYTES: raise ValueError("Image exceeds the size limit") file_obj.write(chunk) ``` ]]>

T06 · System Persistence

Warning
Location
README.md:280
Finding

Documentation Encourages Persistent Cron Execution Beyond Core Skill Requirements

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (29)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The scheduled-task section describes automatically sending downloaded images to Feishu, yet it provides no explicit privacy or data-transmission warning. Automated outbound transfer to a messaging platform can expose downloaded content, metadata, or recipient identifiers to third parties, especially when run unattended via cron.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction "提交信息使用中文" imposes a specific language requirement in natural language. This is a locale/language policy constraint, and the file does not offer an alternative language choice or explain a justified region-specific need.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README extends the skill beyond image downloading into automated onward delivery via the OpenClaw CLI to Feishu. That adds a separate data-exfiltration/use-of-messaging capability not reflected in the skill's core description, which is dangerous because an agent or operator may treat the skill as a local downloader while the documented workflow normalizes transmitting downloaded content to an external recipient.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented cron workflow automates downloading images and forwarding them to Feishu, but it does not prominently warn about privacy, compliance, or data-transfer implications. Even if the images are sourced from public search results, automatic reposting to an external chat recipient can leak sensitive search terms, copyrighted material, or unintended content without informed approval.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 291)May include surrounding context.

查看当前定时任务：

bash
crontab -l

添加定时任务：

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

This command appends a recurring cron job, which is persistence by design. In the skill context, persistence is not inherently malicious because it is presented as an explicit daily automation example, but it still increases risk by causing unattended repeated execution and repeated external transmission to Feishu if copied without sufficient review.

Content

Scanner excerpt · README.md (reported line 297)May include surrounding context.

添加定时任务：

bash
crontab -l | { cat; echo '0 9 * * * TZ=Asia/Shanghai /path/to/scripts/image_download_daily.sh'; } | crontab -

已验证的关键经验

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents and encourages use of shell execution, network access, local file writes, and environment-dependent behavior, but declares no explicit tool scope or permissions boundary. In an agent environment, this increases the chance the skill will be invoked with broader capabilities than necessary, enabling unintended filesystem modification, network access, or command execution beyond the user’s expectation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to download and save files into the workspace automatically, but it does not clearly warn that local files will be created and persisted. In agent contexts, silent file creation can surprise users, consume storage, overwrite expectations about workspace state, and make it easier to stage additional content without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill’s stated purpose is image downloading, but the scheduled-task section expands behavior into automated outbound delivery through Feishu via OpenClaw messaging. This is a scope expansion from local collection to external transmission, which creates an unexpected exfiltration path and can cause the agent to send downloaded content to third parties without the tighter controls users would expect from a downloader skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Documenting the ability to send downloaded files to Feishu is not justified by the declared image-downloader purpose and introduces a nonessential outbound data-transfer capability. Such extra capability is dangerous because it normalizes sending locally stored files to an external service, increasing the risk of accidental disclosure, misuse in automation, or repurposing for exfiltration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown plan is largely written in Chinese and later explicitly requires a Chinese commit style and Chinese-language report strings, which imposes a specific language/locale on future skill behavior. The file does not offer a language choice or justify the locale restriction as region-specific, so it conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The plan directs use of a Chinese Conventional Commit message and later hard-codes Chinese-language report/output examples and Chinese skill description text. Because the file provides no user opt-in or alternative locale handling, it creates a language-policy issue rather than a purely stylistic choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The plan drives network fetching, bulk downloads, and local file writes, but does not require any user-facing warning, confirmation, or operational safety note about bandwidth use, disk writes, remote content retrieval, or potential legal/compliance implications. In an agent skill context, that omission increases the chance of silent high-impact actions on a user's machine or workspace without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is in scope for missing user warnings. It explicitly recommends default behaviors including saving metadata, enabling historical indexing, and writing outputs to keyword-based directories, but does not include any user-facing warning that the skill will persist files and retain download history/URLs locally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The eval prompts are intentionally broad and encourage the skill to activate on loosely related user requests without documented guardrails or exclusion conditions. In an agent setting, this can cause over-triggering of a capability that performs network access and local file writes, increasing the chance of unintended downloads, resource consumption, and action on ambiguous requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The prompts, expected outputs, and expectations are written to require Chinese responses and do not offer any language or locale opt-in. This can violate language/locale policy when the skill behavior is effectively constrained to a specific language without documenting that it is region-specific or giving the user a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The report strings are fixed Chinese labels such as "关键词" and "目标下载数", which imposes a specific language on all users. This is a natural-language policy concern because the file provides no user opt-in, language selection, or documentation that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Tainted flow: 'file_path' from requests.get (line 49, network input) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/bing_image_downloader.py (reported line 51)May include surrounding context.

python
filename = f"{start_index + offset:03d}{extension}"
        file_path = os.path.join(output_dir, filename)

        with open(file_path, "wb") as file_obj:
            for chunk in response.iter_content(chunk_size=8192):
                if chunk:
                    file_obj.write(chunk)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI presents itself as downloading from Bing, but the implementation silently adds a second source (demo). That mismatch can cause users or higher-level agents to fetch from an unexpected origin, weakening trust boundaries, provenance expectations, and policy compliance in a skill whose purpose is automated bulk downloading from external sources.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_bing_image_downloader.py (reported line 244)May include surrounding context.

python
]

        with mock.patch.dict(os.environ, {"PYTHONPATH": ""}, clear=False):
            result = subprocess.run(
                command,
                cwd=repo_root,
                capture_output=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This test hard-codes and validates the user-facing report text as Chinese ("运行完成摘要"), which indicates the skill's output is expected to be in a specific language. Forcing a specific locale in user-visible behavior without offering a language choice or documenting a justified locale constraint matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

L0057-L0061 将关键模块边界描述为 sources、storage、reporting 和 CLI，并在 L0058 明确表示不再要求单独落地 pipeline.py。但 L1141 又让 CLI from image_downloader.pipeline import dedupe_candidates，与前面的规划说明直接不一致，属于文档对实现意图的自相矛盾。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document explicitly states a repository rule to use Chinese for git commit messages, which is a natural-language policy constraint. This forces a specific language/locale choice rather than offering flexibility or documenting user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This section adds a commit convention stating that commit messages in this repository must use Chinese. That is a language/locale policy requirement and, as written, does not provide a choice, opt-in, or narrowly justified compliance rationale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The plan instructs the agent to commit changes using a Chinese message and even provides the exact Chinese commit text. This is a natural-language policy violation because it enforces a specific language without indicating user choice or necessity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.