IMA Studio Sevio AI Generation - Sevio 1.0 ,Sevio 1.0-Fast

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:47 AM UTC
• Version: 1.0.2

Overview

This appears to be a real IMA video-generation skill, but it needs review because API keys and media can be sent through unsafe or overly configurable network paths.

Install only if you trust the publisher and are comfortable sending prompts, task data, and local images to IMA services. Use a limited-scope IMA API key if available, avoid running with untrusted command arguments or environment variables, do not set --base-url or IMA_IM_BASE_URL outside trusted IMA endpoints, and review local logs/preferences on shared machines.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ima_video_create.py:174

Finding

API Credential Exposed in URL Query Parameters

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ima_video_create.py:1688

Finding

Configurable Endpoints Permit Credential and Media Redirection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ima_logger.py:35

Finding

Sensitive Operational Files Lack Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:4

Finding

Dependency Version Is Open-Ended and Lacks Integrity Pinning

Content

View full analysis

=2.25.0 ``` ### Technical Analysis The Skill accepts any `requests` release equal to or newer than version 2.25.0. It does not provide: - An exact audited version - Package hashes - A lock file - A bounded compatible version range - An explicitly trusted package index This is not evidence that the current `requests` package is malicious. The issue is that future installations may resolve a version that was not included in the audit. The resulting environment is therefore non-reproducible and may unexpectedly inherit a compromised, incompatible, or behaviorally changed dependency. Because `requests` processes API credentials, prompts, media, and generated result metadata in this Skill, compromise of the imported package would occur in a security-sensitive execution context. ### Attack Path Exploitation requires an upstream or installation-channel compromise: 1. The Skill is installed at a later date. 2. The installer resolves the newest version satisfying `requests>=2.25.0`. 3. A compromised upstream release, package index, mirror, or dependency resolution environment supplies malicious or altered code. 4. Python imports that package when the Skill starts. 5. The dependency executes in the Skill process and can access network requests, API credentials, prompts, and media. There is no evidence in the audited repository that dependency confusion or typosquatting is currently being attempted. ### Impact Assessment If the dependency supply chain were compromised, malicious code would execute with the same operating-system privileges as the Skill. It could potentially access: - The `IMA_API_KEY` environment variable or CLI value - Prompt and model parameters - Local images loaded for upload - Task identifiers and result URLs - Files accessible to the ...[truncated 218 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tainted flow: 'task_id' from os.getenv (line 1850, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ima_video_create.py (reported line 879)May include surrounding context.

python

f"Please check your creation record at {VIDEO_RECORDS_URL}."
            )

        resp = requests.post(url, json={"task_id": task_id},
                             headers=headers, timeout=30)
        resp.raise_for_status()
        data = resp.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk does not implement the declared media-generation behavior. Instead, it provides infrastructure for logging: creating and rotating log files, emitting console/file logs, and deleting old logs from a local directory. Logging can be a supporting component of a generation skill, but this chunk by itself is materially different from the declared purpose and shows none of the core capabilities described. Therefore, the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The core purpose matches closely: this is an IMA video creation client with the four declared workflows, two exposed Sevio models via aliasing, the same general flow (product list → param resolution → task create → polling), and a reflection-based retry mechanism. The mismatch arises because the description and declared permissions omit materially relevant behaviors: the script persists user preference memory locally, creates local log files, and interacts with an additional upload service domain for local image workflows, explicitly sending the API key to that service and uploading image content. Those are resource/access behaviors not represented in the declaration, so this should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ima_video_create.py (reported line 1716)May include surrounding context.

python

sys.exit(1)
        args.model_id = normalized_model_id

    # Get API key from args or environment variable
    apikey = args.api_key or os.getenv("IMA_API_KEY")
    if not apikey:
        logger.error("API key is required. Use --api-key or set IMA_API_KEY environment variable")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill declares environment access, persistent file writes, and network use in behavior, but does not define an explicit tool scope such as allowed-tools/permissions. That creates an authorization ambiguity where a host may grant broader capabilities than reviewers or users expect, especially given the skill can exfiltrate prompts, media, and API keys to external services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file contains substantial user-facing capability descriptions in Chinese, while other sections are in English, and it does not state that the user can choose their preferred language. That creates a language/locale policy concern because the skill appears to default part of its interaction content to a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill sends user prompts, model parameters, task metadata, and an Authorization bearer token to an external service to create generation tasks. External transmission is expected for a cloud generation skill, but it remains security-relevant because sensitive user content and credentials leave the local trust boundary and could be exposed if endpoints, transport, logging, or consent are mishandled.

Content

Scanner excerpt · SKILL.md (reported line 562)May include surrounding context.

md

}],
    }

    r = requests.post(f"{BASE_URL}/open/v1/tasks/create", headers=HEADERS, json=payload)
    r.raise_for_status()
    return r.json()["data"]["id"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 570)May include surrounding context.

md

def poll(task_id: str, interval: int = 8, timeout: int = 600) -> dict:
    deadline = time.time() + timeout
    while time.time() < deadline:
        r = requests.post(f"{BASE_URL}/open/v1/tasks/detail", headers=HEADERS, json={"task_id": task_id})
        r.raise_for_status()
        task = r.json().get("data", {})
        medias = task.get("medias", [])

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The script sends prompts, model parameters, image URLs, and potentially uploaded local-image-derived CDN URLs to external services. This is inherent to the skill’s purpose, but it is still a real data-transmission risk because users may provide sensitive prompts or local files, and the code also forwards the API key to a separate upload domain during related workflows.

Content

Scanner excerpt · scripts/ima_video_create.py (reported line 816)May include surrounding context.

python

f"credit={credit}, attribute_id={attribute_id}")

    try:
        resp = requests.post(url, json=payload, headers=headers, timeout=30)
        resp.raise_for_status()
        data = resp.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ima_video_create.py (reported line 879)May include surrounding context.

python

f"Please check your creation record at {VIDEO_RECORDS_URL}."
            )

        resp = requests.post(url, json={"task_id": task_id},
                             headers=headers, timeout=30)
        resp.raise_for_status()
        data = resp.json()

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The metadata description states the skill’s capabilities but does not define clear invocation boundaries, allowed contexts, or trigger constraints. This can cause the agent to invoke a powerful media-generation skill too broadly or in unintended situations, increasing the chance of misuse, cost exposure, or unsafe handling of user-supplied generation requests.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.25.0, which allows installation of many different versions over time and prevents reproducible builds. This increases supply-chain risk and makes it harder to ensure that a known-safe version is used, especially because some allowed versions may contain disclosed vulnerabilities.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Python dependencies for ima-video-ai skill
# Install with: pip install -r requirements.txt

requests>=2.25.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Because the manifest does not pin requests to a specific version, there is no way to verify whether deployments will use a release affected by one of the package's known advisories. In a skill that likely performs outbound API calls using requests, this uncertainty is more relevant because vulnerable HTTP client behavior could affect authentication, redirects, or credential handling depending on runtime usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs file deletion via cleanup_old_logs by unlinking matching log files older than the retention window. Although the module docstrings describe retention behavior, there is no runtime disclosure, logging, or confirmation around the destructive deletion step itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The header builder hard-codes language="en" and sends x_app_language on requests by default. This imposes a specific language/locale choice unless the caller explicitly overrides it, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script stores per-user model preferences in ~/.openclaw/memory/ima_prefs.json without any mention in the stated skill purpose. While the stored data is limited, persistent local storage can create privacy and multi-user data separation issues, especially on shared systems or agent hosts where different users may access the same filesystem.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.