Security audit
Security checks for vulnerabilities and agentic risk
This cover-image skill is mostly coherent, but it has review-worthy credential and local-file handling risks before installation.
Install only if you are comfortable giving this skill a WeryAI API key and letting it run local Node/Bun tooling. Prefer an environment variable over `--persist-api-key`, avoid shared or source-controlled project config directories, use only intentional reference images, and treat local reference paths as uploadable to WeryAI until the documentation and runtime are reconciled. A safer version would pin Bun/tooling and prevent bearer-token forwarding to untrusted result URLs.
scripts/vendor/shared-image-generation/scripts/main.ts:194Bearer Token Forwarded to an Untrusted Image Result URL
scripts/vendor/shared-image-generation/scripts/setup.mjs:114Persisted API Key Uses Default Filesystem Permissions
package.json:13Routine Commands Execute an Unpinned Registry Package Through npx
scripts/vendor/shared-image-generation/scripts/main.ts:304Local Reference Files Are Uploaded Despite the Declared Public-URL-Only Boundary
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
The skill openly instructs the agent to call an external API and use an API key, but it does not constrain network scope beyond prose mentioning WeryAI. If the underlying runtime supports configurable base URLs or generic client behavior as the finding suggests, that would enable broader outbound requests and possible secret misuse under a cover-image skill.
Referenced artifact was not completely inspected
- `scripts/build-batch.ts`
Referenced artifact was not completely inspected
- `scripts/build-batch.ts`
Referenced artifact was not completely inspected
- `scripts/build-batch.ts`
Referenced artifact was not completely inspected
| `./scripts/vendor/compression-runtime/scripts/main.ts` | Compress output for delivery |
The script invokes npm install as a subprocess, which can execute dependency lifecycle scripts and fetch untrusted code from registries. In a skill whose stated purpose is generating cover images, this capability is not inherently necessary and makes the skill materially more dangerous because setup can lead to code execution on the host.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
--mood <level> Mood level (default: balanced)
--aspect <ratio> Aspect ratio (default: 16:9)
--lang <code> On-canvas text language when needed (default placeholder: en)
--force Overwrite existing files
-h, --help Show help`);
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace);
const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null;
const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");
const projectEnvFile = pathExists(projectEnvPath);
let apiKeyInProjectEnv = false;
if (projectEnvFile) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace);
const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null;
const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");
const projectEnvFile = pathExists(projectEnvPath);
let apiKeyInProjectEnv = false;
if (projectEnvFile) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace);
const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null;
const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");
const projectEnvFile = pathExists(projectEnvPath);
let apiKeyInProjectEnv = false;
if (projectEnvFile) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace);
const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null;
const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");
const projectEnvFile = pathExists(projectEnvPath);
let apiKeyInProjectEnv = false;
if (projectEnvFile) {
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
}
function applyStylePreset(prompt: string, style: StylePreset | null | undefined): string {
if (!style) return prompt;
return `${prompt.trim()}\n\nStyle preset (${style}): ${STYLE_PRESETS[style]}.`;
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
-h, --help Show help
What this does:
1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env
2) Runs doctor (read-only)
3) Ensures a MODELS.json exists (writes the bundled starter if missing)
4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
-h, --help Show help
What this does:
1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env
2) Runs doctor (read-only)
3) Ensures a MODELS.json exists (writes the bundled starter if missing)
4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
-h, --help Show help
What this does:
1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env
2) Runs doctor (read-only)
3) Ensures a MODELS.json exists (writes the bundled starter if missing)
4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet
The skill declares network access and use of an API key in metadata and instructions, but it does not define an explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where an agent may grant broader capabilities than intended, especially for network and secret-bearing operations.
The skill instructs persistence of the IMAGE_GEN_API_KEY to local project or home directories and mentions continuing the workflow after storing it on the user's behalf. Persisting secrets increases exposure through accidental commits, local compromise, overly broad file permissions, or reuse across sessions beyond the user's immediate intent.
---
name: cover-image
description: Generate article cover images with structured dimensions and bundled generation tooling. Use when the user asks to create a cover image, article cover, blog header, newsletter hero image, or banner-style key visual.
metadata: { "pattern": ["generator", "pipeline"], "openclaw": { "emoji": "🖼️", "primaryEnv": "IMAGE_GEN_API_KEY", "requires": { "env": ["IMAGE_GEN_API_KEY"], "anyBins": ["bun", "npx"], "bins": ["node", "npm"] } } }
---