T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ima_runtime/shared/client.py:78- Finding
Primary API Credential Exposed in Upload-Token Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
IMA AI Video Generator — Short & Promo Video, Text to Video, Image to Video Generation
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real video-generation skill, but its API-key handling creates credible leakage risks that users should review before installing.
Before installing, use a scoped or test IMA key, ensure IMA_BASE_URL, IMA_IM_BASE_URL, and --base-url point only to trusted IMA HTTPS endpoints, do not run troubleshooting commands that print the full API key, and inspect or delete ~/.openclaw/logs/ima_skills/ after failures because logs may contain sensitive request details.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ima_runtime/shared/client.py:111- Finding
Upload-Token Failures May Persist API Credentials in Logs and Error Output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ima_runtime/shared/config.py:5- Finding
Configurable API Origins Allow Bearer Credentials to Be Sent to Arbitrary Hosts
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/operations/troubleshooting.md:17- Finding
Troubleshooting Instructions Print the Complete API Key
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:4- Finding
Open-Ended Dependency Constraints Prevent Reproducible, Integrity-Verified Installation
- Content
View full analysis
=2.25.0 Pillow>=10.0.0 ``` The documented installation command is: ```text pip install -r requirements.txt ``` ### Technical Analysis The dependency declarations specify only minimum versions. Any future version of `requests` or `Pillow` satisfying the lower bound can therefore be installed without repository review. The project does not provide a lock file or package hashes to verify that the installed artifacts match reviewed builds. No evidence of typosquatting, dependency confusion, or a currently malicious package was found; both package names are established projects. The risk is reduced reproducibility and exposure to compromised, incompatible, or unexpectedly changed future releases. ### Attack Path 1. An operator runs the documented `pip install -r requirements.txt` command. 2. The package resolver selects the newest available versions satisfying the minimum constraints. 3. A future compromised or unsafe release, compromised package index response, or incompatible transitive dependency is selected. 4. The dependency executes during installation or when the Skill processes network data or media files. 5. The dependency runs with the privileges of the user invoking the Skill. ### Impact Assessment A compromised dependency would execute with the local privileges of the installing or running user. That could expose the API key, prompts, local media selected for upload, preference files, logs, and other files accessible to that user. The current repository does not establish that such a compromised package exists, so this is a preventive supply-chain finding rather than evidence of active malicious behavior. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a user-facing AI video generator with support for multiple models and generation modes. However, the supplied code does not implement any video generation, model invocation, media processing, or API-key-based external service access. Instead, it manages logging: creating directories in the user's home folder, writing rotating log files, optionally emitting console logs, and deleting old log files. While logging can be a supporting detail in a larger skill, this code chunk by itself has a materially different purpose from the declared functionality and introduces filesystem behavior not mentioned in the description. Therefore this chunk does not accurately represent the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a fully featured AI video generation capability with support for numerous models and workflows. However, the supplied code chunk contains only an empty package initializer with a docstring. Based on the provided code alone, there is no implemented behavior matching the declared functionality. This is a material description-behavior mismatch because the actual code does not demonstrate the primary purpose or capabilities described.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a feature-rich AI video generation skill, but the provided code chunk is only a minimal package initializer that exposes
print_model_summary. Based on this code alone, the implemented behavior is limited to module export setup and possibly CLI presentation support. There is no evidence of any of the core claimed capabilities, no model integration, and no use of the declared API dependency. This is a material mismatch between declared purpose and actual code behavior.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description centers on producing AI videos across several generation modes and models. In contrast, this code only validates setup and connectivity: it checks IMA_API_KEY, queries available products/models, handles errors, and prints recommendations. It explicitly says 'No paid generation task was created,' which directly indicates it does not generate videos. While this could be a supporting utility within a larger video-generation skill, the supplied code chunk itself does not match the declared primary behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a full-featured AI video generation capability with multiple named models, input modes, and use cases. The provided code chunk contains only module initialization logic that imports and exports
route_request. This is materially insufficient to substantiate the declared purpose. While this file could be part of a larger implementation, the supplied chunk itself does not match the claimed behavior and instead serves as a generic routing/package interface component.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents the skill as an operational AI video generator with multiple generation modes and model options. However, the supplied code chunk only implements setup flow behavior: collecting or reading IMA_API_KEY, prompting for a task type, retrieving available models from an API, selecting a model, saving preferences, and printing CLI next steps. While these actions are related to supporting a video generation system, they do not match the declared primary purpose of generating videos. This is a material description-to-behavior mismatch because the code shown is configuration logic, not generation functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents the skill as an AI video generator with various generation modes and model support. However, the supplied code only contains shared error-handling utilities: model-name normalization, extraction of HTTP/API/timeout errors, diagnosis of likely failure causes, parameter degradation suggestions, and formatting of user-facing error messages. While these behaviors are related to a video generation system, they do not implement the advertised primary capability of generating videos. There is no code here that submits generation jobs, processes prompts/images into video, or interfaces with the named models directly. This is therefore a material description-versus-behavior mismatch for the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description promises a comprehensive multi-model AI video generation skill with several generation modes. This code chunk does not implement generation behavior and does not cover most of the advertised models or features. Instead, it is a narrow support module for Seedance-related model capability lookup and compliance requirements for a few task types. While image-to-video, first-last-frame, and reference-image-to-video are partially reflected, the primary behavior in this chunk is metadata validation for two specific models, not the broad functionality claimed in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a full-featured AI video generator with multiple generation modes and model integrations. The actual code shown is only a minimal package initializer that imports and exports
build_confirmable_plan. There is no evidence in this chunk of video generation, media processing, model invocation, API-key usage, or any of the advertised capabilities. This is a material mismatch in primary purpose based on the supplied code.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a feature-rich AI video generation capability using multiple named models and generation modes. The actual code chunk does not implement any video generation behavior, external API access, model orchestration, media handling, or related workflow logic. It merely returns the input plan unchanged. This is a materially different primary purpose from the declared description, so the description does not accurately represent the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description promises a full-featured AI video generation capability with specific generation modes and model support. The actual code chunk is a thin orchestration wrapper for workflow planning: it builds a workflow plan from a request and converts it to a confirmable plan. There is no evidence in this code of generating videos, handling images, invoking any of the listed models, or using IMA_API_KEY. While this could be an internal supporting component of a larger system, based on the supplied chunk alone the behavior does not match the declared primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description promises a full AI video generator with specific models, generation modes, and media capabilities. However, the supplied code chunk only initializes logging, constructs a parser, and calls external CLI runtime functions. On its own, this code does not demonstrate the described video-generation behavior, model access, or API-key use. Because the actual chunk’s observable behavior is a generic command-line launcher rather than an AI video generation implementation, the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents the skill as a full AI video generator with multiple generation modes and model options. The supplied code does not implement video generation; it builds a CLI parser for a 'video doctor' tool and calls a doctor/check flow intended to verify environment and connectivity cheaply without creating a paid task. That is a materially different primary purpose from generating videos. While it references the same IMA video ecosystem and API key, this chunk's behavior is diagnostic/support functionality that is not represented in the declared description, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description presents a full-featured AI video generator skill with multiple generation modes and model support. However, this code chunk does not implement video generation. It defines a command-line setup utility for onboarding and configuration, specifically to choose a model preference and pass runtime settings such as API key, base URL, language, and user ID. While this may be related support code for the broader skill, the supplied chunk’s actual purpose is materially different from the declared primary purpose, so this should be flagged as a mismatch.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md - create-time API errors: bad auth, credit issues, attribute/rule mismatch, invalid params - transport errors: request failures from `requests` - poll-time task failures: explicit media error, delete state, backend-reported failure - timeout: no terminal success before `VIDEO_MAX_WAIT_SECONDS` ## User-Facing Boundary
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The keyword list is extremely broad and repetitive, covering many generic phrases like 'AI video generator,' 'video generator,' 'short video generator,' and 'image to video' without clear activation boundaries. This can cause the skill to trigger on routine video-related user requests, increasing the chance of over-invocation, unintended routing, and misuse of a skill that requires an API key and can initiate external content generation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares broad capabilities including environment access, filesystem persistence, network access, and shell/runtime execution, but it does not define any explicit tool scope such as permissions or allowed-tools. In an agent environment, this increases risk because the runtime may grant more access than is minimally necessary, making unintended file writes, command execution, or network interactions harder to constrain and audit.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file documents a live clarification message entirely in Chinese, with no indication that the user's preferred language is detected or that alternative locales are supported. That creates a natural-language policy concern because it appears to force a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The troubleshooting guidance explicitly tells users to run
echo "$IMA_API_KEY", which prints a live secret to the terminal and can expose it through shell history capture, terminal logs, screen sharing, CI job logs, or remote support sessions. In the context of an API-backed video generation skill, exposure of the key could allow unauthorized use of the account, consumption of credits, and access under the user's billing identity.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code returns a user-facing clarification question and answer options entirely in Chinese. This forces a specific language for the interaction without any visible opt-in, fallback, or justification that the skill is region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The function makes a remote product-list request and transmits the API key, but the user-facing output only says 'Doctor checks' and 'API key: present' without clearly warning that a network request will be sent to the configured base URL. While errors and progress are printed, there is no explicit disclosure before the outbound call about contacting the service with provided credentials.
- Content
Tainted flow: 'ful' from requests.get (line 104, network input) → requests.put (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python logger.info(f"Uploading {len(image_bytes)} bytes to OSS...") try: resp = requests.put(ful, data=image_bytes, headers={"Content-Type": content_type}, timeout=60) resp.raise_for_status() logger.info("Upload successful")
Tainted flow: 'task_id' from requests.post (line 356, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python f"Please check your creation record at {VIDEO_RECORDS_URL}." ) resp = requests.post(url, json={"task_id": task_id}, headers=headers, timeout=30) resp.raise_for_status() data = resp.json()
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function sends the asset URL and optional asset name to an external verification endpoint and includes an Authorization bearer token in the request headers. In this file there is no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing that user or system data is transmitted to a remote service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python if asset_name: payload["name"] = asset_name[:64] response = requests.post(url, json=payload, headers=headers, timeout=300) try: data = response.json() except ValueError as exc:
Static analysis
No suspicious patterns detected.