Rednote Images

• Outcome: Review
• Latest audit: May 28, 2026 · 7:17 AM UTC
• Version: 1.0.6

Overview

The skill mostly does what it claims, but it under-discloses that local reference-image paths can be read from disk and uploaded to WeryAI despite saying local paths are rejected.

Review before installing if your workspace may contain sensitive files. Use reference images only from intended image files, do not let prompts or batch files point at arbitrary local paths, and keep .image-skills/rednote-images/.env out of version control.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This script directly runs `npm install` in discovered subdirectories via `spawnSync`, which executes package manager lifecycle hooks and fetches code from dependency sources. In an agent-skill context, that creates an unnecessary code-execution and supply-chain surface that is not inherent to generating images, so a compromised or unexpected `package.json` under the scanned tree could trigger arbitrary install-time behavior.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script recursively walks the suite, finds every `package.json` outside a small skiplist, and installs dependencies for each target with nonzero dependency counts. That broad discovery/installation behavior exceeds the stated image-generation purpose and increases risk because any added nested package manifest can cause network access and install-time script execution, expanding the trusted computing base unnecessarily.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The CLI exposes a `--use-web-search` capability that expands the tool from image generation into arbitrary outbound information retrieval. In the context of a RedNote image-card skill, this broadens the attack surface and can cause unintended external data disclosure or network access that the user did not request.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The `--webhook-url` option allows arbitrary outbound callbacks to attacker-controlled endpoints, which is unrelated to producing RedNote image cards. This can be abused for SSRF-style network access, data exfiltration via callback payloads, or using the skill as a blind network beacon.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: When no local registry exists, the script automatically falls back to `discoverImageModels()`, described as discovering models from external WeryAI docs. This introduces an untrusted remote dependency into model selection, so a compromised, tampered, or unexpected external source could influence recommendations and cause the skill to use weaker, inappropriate, or attacker-preferred models without explicit user approval.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: rednote-images
description: Generate RedNote image series with structured style and layout choices and bundled generation tooling. Use when the user asks to create RedNote image cards, RedNote cover cards, or social infographic series.
metadata: { "pattern": ["generator", "pipeline"], "openclaw": { "emoji": "📱", "primaryEnv": "IMAGE_GEN_API_KEY", "requires": { "env": ["IMAGE_GEN_API_KEY"], "anyBins": ["bun", "npx"], "bins": ["node", "npm"] } } }
---

• Confidence: 78% confidence
• Finding: The skill instructs the runtime to persist `IMAGE_GEN_API_KEY` under project-local or home-directory `.env` files and to continue setup on the user's behalf. Persisting API credentials to disk increases the risk of accidental disclosure through repository commits, workspace sharing, backups, or overly broad filesystem access by other tools.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/setup.mjs:21

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/discover-models.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/doctor.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/main.ts:15

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/recommend-model.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/run-generate.mjs:39

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/setup.mjs:9

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:51

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:6