Security audit

Infographic

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real infographic generator, but it needs Review because some sensitive behavior is broader or less clearly scoped than the main description suggests.

Install only if you are comfortable sending infographic prompts and any referenced images to WeryAI. Prefer an environment variable or a proper secret store over persisted .env credentials, confirm .image-skills files are gitignored before sharing or committing a project, and do not use local reference images unless you intentionally want those files uploaded.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly uses sensitive capabilities—network access to an external API and an environment variable API key—yet does not declare explicit permissions beyond metadata requirements. This creates a transparency and policy-enforcement gap: a host may underestimate what the skill can access or transmit, increasing the risk of unintended secret exposure or unauthorized outbound requests.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The setup guidance expands the skill from infographic generation into environment modification and secret management by directing the agent to bootstrap dependencies and configure credentials. Even if framed as convenience, this creates unnecessary authority and increases the chance of unintended local changes or sensitive configuration being written without sufficiently explicit user understanding.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The document instructs the agent to handle and persist API credentials locally, including writing them into a project .env path. Storing bearer tokens on the user's behalf is security-sensitive and exceeds the narrow business purpose of generating infographics, creating risk of secret exposure through filesystem access, accidental commits, or unclear retention.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Directing the agent to auto-bootstrap or install local dependencies on the user's behalf gives the skill mutation capabilities outside its core infographic function. This increases the attack surface because package installation can execute scripts, alter the environment, and introduce supply-chain risk.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: This script directly invokes `npm install` in discovered subdirectories, which executes arbitrary lifecycle scripts from dependencies and modifies the local environment. In the context of an infographic-generation skill, bundled code that performs recursive dependency installation is a real supply-chain and command-execution risk, especially if run automatically in agent environments.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The code recursively scans the suite for every `package.json` outside a few skipped directories and installs dependencies for each target. That broad discovery-and-install behavior exceeds the stated purpose of generating infographics and increases attack surface by enabling unintended package execution anywhere under the skill tree, making malicious or accidental package additions impactful.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The CLI exposes a `use_web_search` capability and merges it from config, allowing prompts to trigger external retrieval unrelated to the declared infographic-only purpose. In an agent skill context, this broadens data flow and can cause unreviewed outbound requests or inclusion of web-derived content, increasing prompt-injection and data-exposure risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: When output resolves to the input path or an existing destination, the code renames files without any explicit confirmation and can overwrite the user's original image in place. In an agent skill context, silent modification of user-supplied files is risky because a mistaken path, unexpected format match, or automation trigger can cause irreversible data loss or confusing state changes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The readiness pass is supposed to run silently while checking dependency state, potentially bootstrapping local scripts, and determining whether an API key is present. Silent security-relevant inspection and environment modification reduce transparency and informed consent, making it easier for a user to miss that sensitive checks or changes occurred.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions tell the agent to persist the API key locally without requiring a clear warning about the security implications of local secret storage. Users may not understand that bearer tokens written to disk can be exposed via backups, local compromise, workspace sharing, or accidental source control inclusion.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: If local dependencies are still missing after the check, the agent should ask the user for approval to install them on the user's behalf. If `IMAGE_GEN_API_KEY` is missing, the agent should tell the user that image generation needs an API key and offer to configure it now. After approval, the agent should persist it to `.image-skills/image-generation/.env` or run `npm run setup -- --project . --workflow <workflow> --persist-api-key` when the key is already available in env. Do not ask the user to debug local setup manually before this readiness pass. Treat the API key as a secret:
Confidence: 88% confidence
Finding: The wording encourages the agent to take over setup decisions and perform secret persistence after approval, rather than keeping the user closely involved in a high-risk configuration flow. In a setup context this is likely convenience-driven, but it still grants the agent unnecessary discretion around sensitive actions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: Treat the API key as a secret: - prefer writing it locally on the user's behalf instead of making the user edit files - do not ask the user to paste the key into normal chat if a local write path is available - if the user does share the key, never echo it back or include it in follow-up messages ## 2. API Key
Confidence: 84% confidence
Finding: Preferring that the agent write the API key locally on the user's behalf reduces friction but also normalizes agent-controlled secret handling. This is dangerous because it can bypass user scrutiny over where sensitive credentials are stored and whether they should be stored at all.

Session Persistence

Medium

Category: Rogue Agent
Content: --- name: infographic description: Generate high-density infographics with structured layout and style choices and bundled generation tooling. Use when the user asks to create an infographic, a visual summary, or a dense single-page information graphic. metadata: { "pattern": ["generator", "pipeline"], "openclaw": { "emoji": "📊", "primaryEnv": "IMAGE_GEN_API_KEY", "requires": { "env": ["IMAGE_GEN_API_KEY"], "anyBins": ["bun", "npx"], "bins": ["node", "npm"] } } } ---
Confidence: 82% confidence
Finding: The skill instructs the agent to persist the IMAGE_GEN_API_KEY into project-local or home-directory configuration files when approved, which introduces session persistence of a secret beyond ephemeral runtime use. Persisted credentials are more likely to be leaked through filesystem exposure, backups, repository inclusion, or later misuse by other processes.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup.mjs:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/compression-runtime/scripts/main.ts:158

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/shared-image-generation/scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/shared-image-generation/scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/shared-image-generation/scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/discover-models.mjs:9

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/doctor.mjs:9

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/main.ts:15

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/recommend-model.mjs:9

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/run-generate.mjs:39

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/setup.mjs:9

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/vendor/shared-image-generation/scripts/main.ts:51

File read combined with network send (possible exfiltration).

Warn

Code: suspicious.potential_exfiltration
Location: scripts/vendor/shared-image-generation/scripts/main.ts:6