Back to skill
Skillv1.0.0
VirusTotal security
SiliconFlow 多模态服务，支持图片生成(FLUX/Qwen)、视频生成(Wan)、TTS语音合成、ASR语音识别。使用代金券支付。 · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 4:52 AM
- Hash
- abb5cf3a23b7f039257a18bd4dce851480c49fd167ded4ceb8a02e856a5097a6
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: siliconflow-media Version: 1.0.0 The skill bundle exhibits several vulnerabilities related to file path handling. The `scripts/asr.py` and `scripts/video_gen.py` scripts read user-specified input files (`--audio`, `--image`) and send their content to an external API (`api.siliconflow.cn`). This creates an arbitrary file read vulnerability, potentially leading to data exfiltration if an attacker can prompt the agent to read sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). Additionally, `scripts/image_gen.py`, `scripts/tts.py`, and `scripts/video_gen.py` write to user-specified output files (`--filename`). This creates an arbitrary file write vulnerability, potentially leading to persistence or privilege escalation (e.g., writing to `/etc/cron.d/malicious_job`) if the agent is prompted to write to sensitive system paths. These vulnerabilities stem from a lack of input sanitization for file paths, making the skill susceptible to prompt injection attacks against the agent, despite the scripts themselves not exhibiting malicious intent.
- External report
- View on VirusTotal