xhs-auto-content-by-hot

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:13 PM UTC
• Version: 1.0.0

Overview

The skill does what it advertises, but it tells the agent to save a user API key directly into source code, which is unsafe and persistent.

Install only if you are comfortable using Baidu and Volcengine services and sending selected topics/prompts to the image API. Do not let the agent write your API key into generate.py; use a temporary environment variable or secret store instead, and rotate any key that has already been saved in the source file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Persistent Plaintext Storage of a User API Key in Source Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-24, scripts/generate.py:9-12, and scripts/generate.py:198-202
Vulnerability Type: Plaintext credential storage and hardcoded secret handling
Risk Level: High

The skill explicitly instructs the agent to request the user's ByteDance image-generation API key and write it directly into the Python source file. The script then reads that persistent source-code value when constructing its authorization header.

Relevant instruction from SKILL.md:21-24:

markdown

## 配置
- 先询问使用者的字节跳动生图模型的 API Key 是什么，得到回复后，把它存入 generate.py 的 API_KEY 里面备用
- 如果没有 API Key 或者 API Key 错误，则提示“生图失败，没有正确的 API Key，无法调用生图模型”

Credential storage location in scripts/generate.py:9-12:

python

# 配置
API_KEY = ""
API_URL = "https://ark.cn-beijing.volces.com/api/v3/images/generations"
MODEL = "doubao-seedream-4-5-251128"
DEFAULT_WORKSPACE = "/root/.openclaw/workspace"

Credential use in scripts/generate.py:198-202:

python

headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer " + API_KEY
}

Technical Analysis

API credentials are secrets and should not be persisted in application source code. Following the documented workflow changes API_KEY = "" into a plaintext credential embedded in scripts/generate.py.

This creates several exposure channels:

• The secret can be read by any user or process with access to the project files.
• It may be included in source-control commits, patches, backups, archives, audit artifacts, or skill redistribution packages.
• Source-code inspection and diagnostic collection can disclose the credential even though the authorization header itself is not printed.
• A copied or republished skill package may unintentionally distribute the user's live credential.
• The key remains on disk after execution and may outlive the session for which it was provided.

The source currently cont ...[truncated 1687 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to edit scripts/generate.py and never persist user credentials in skill source files.

2. Load the key from a dedicated environment variable:

   python

   API_KEY = os.environ.get("VOLCENGINE_API_KEY")
   
   if not API_KEY:
       raise RuntimeError(
           "VOLCENGINE_API_KEY is not configured; image generation cannot continue."
       )
   

3. Update the usage documentation to pass the secret through the execution environment rather than modifying source:

   bash

   read -s VOLCENGINE_API_KEY
   export VOLCENGINE_API_KEY
   python3 scripts/generate.py
   unset VOLCENGINE_API_KEY
   

4. Prefer an operating-system credential store or managed secret service where available. Grant the runtime access only to the specific secret it needs.

5. Ensure environment variables, secret files, request headers, and exception diagnostics are excluded from logs and generated output.

6. Scope the API credential to image-generation operations only, apply spending and rate limits, and use the shortest practical lifetime.

7. If file-based secret input is unavoidable, store it outside the project, restrict permissions to the owning account, and delete it securely after use.

8. Add repository secret scanning and ignore local environment files such as .env.

9. Rotate and revoke any API key that has previously been written into generate.py, committed to source control, archived, or distributed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill directs the agent to solicit the user's API key and store it in source code for later reuse, which is especially dangerous in an agent context where files may be accessible to later runs, other skills, or workspace observers. The surrounding skill context does not justify persistent source-code storage of secrets, so this makes the credential-handling flaw more dangerous rather than less.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/generate.py (reported line 110)May include surrounding context.

python

��的旅行故事！评论区等你！\n点赞收藏，一起看遍世界美景～"
        ],
        "work": [
            "职场人必看！这说的就是我！💼\n\n「{topic}」太有共鸣了！\n每一句都戳中我的心，打工人太难了！\n\n你们有同感吗？评论区聊聊！\n点赞收藏关注，职场路上不孤单～",
            "家人们！这职场真相了！😮‍💨\n\n看到「{topic}」，我疯狂点头！\n这就是我的真实写照啊，太真实了！\n\n快来吐槽你的职场故事！评论区等你！\n点赞收藏，打工人抱团取暖～"
        ],
        "education": [
            "家长们必看！太重要了！📚\n\n「{topic}」这几点说到点子上了！\n为了孩子，这篇一定要好好看看！\n\n你们有什么教育心得？评论区分享！\n点赞收藏关注，育儿路上不迷茫～",
            "救命！这教育方法也太好了吧！🌟\n\n看到「{topic}」，我赶紧记下来！\n科学又有�

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to collect a user's API key and persist it by editing generate.py, which is an unsafe credential-handling pattern. Storing secrets in source code increases the chance of accidental disclosure through logs, version control, file sharing, or later inspection by other tools or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions explicitly tell the agent to ask for a user-provided API key and write it into generate.py for later use, without any warning about secret handling. This creates a direct risk of credential exposure because secrets embedded in code are easy to persist, leak, or be reused beyond the user's intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instructions specify exact Chinese user-facing text and the entire skill is written to operate in Chinese, but there is no indication that users may opt into another language or that the locale restriction is required for compliance or regional use. That creates a natural-language locale policy concern under the language-choice rule.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.py (reported line 205)May include surrounding context.

python

}
            
            print("调用火山引擎Seedream API...")
            response = requests.post(API_URL, json=payload, headers=headers, timeout=60)
            response.raise_for_status()
            result = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code posts prompt content derived from the selected or user-supplied topic to a third-party image-generation endpoint. While it logs that the API is being called, there is no disclosure that user-provided content will be transmitted off-system, which is a relevant privacy warning for code files.

Content

No source excerpt is available for this finding.

Tainted flow: 'image_url' from requests.post (line 210, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script trusts an image URL returned by the external image-generation API and immediately fetches it with requests.get, creating a server-side request forgery style sink. If the upstream service is compromised or returns an unexpected internal or sensitive URL, the skill could be abused to make network requests to unintended destinations and download untrusted content into the workspace.

Content

Scanner excerpt · scripts/generate.py (reported line 214)May include surrounding context.

python

print("API调用成功！")
                print("下载图片...")
                
                img_response = requests.get(image_url, timeout=30)
                img_response.raise_for_status()
                
                with open(image_path, "wb") as f:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-visible strings, prompts, and argument descriptions are written exclusively in Chinese throughout the script. This enforces a specific language/locale without any opt-in or documented region-specific justification, which matches the language-policy violation category.

Content

No source excerpt is available for this finding.