Openrouter Image Generation

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:32 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it generates or edits images through OpenRouter, with ordinary but real privacy and credential-handling considerations.

Install only if you are comfortable sending prompts and any selected input images to OpenRouter. Prefer setting OPENROUTER_API_KEY instead of passing --api-key on the command line, and save outputs under ~/.openclaw/media/outbound with fresh filenames to avoid accidental overwrites.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:205

Finding

API Key Accepted Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py:205
Vulnerability Type: Exposure of credentials through process arguments
Risk Level: Medium

python

parser.add_argument("--api-key", "-k", help="OpenRouter API key (overrides OPENROUTER_API_KEY)")

The corresponding documentation explicitly encourages this credential-passing mechanism at SKILL.md:44-47:

markdown

The script checks for API key in this order:
1. `--api-key` argument
2. `OPENROUTER_API_KEY` environment variable

Technical Analysis

Passing an API key as a command-line argument can disclose it through shell history, process listings, operating-system audit records, job metadata, terminal logs, and monitoring systems that capture command invocations. The implementation accepts the key in --api-key or -k and subsequently uses it as the OpenRouter bearer credential.

Exploitation requires local or administrative access to process metadata, command history, or logs containing the invocation. The script does not print the API key itself, and the reviewed code does not transmit it to any undeclared destination. Nevertheless, supporting command-line credential input creates an avoidable local disclosure channel.

Attack Path

1. A user follows the documented workflow and invokes the script with --api-key SECRET.
2. The complete invocation is retained in shell history, process metadata, audit logs, task-runner metadata, or monitoring telemetry.
3. A local user or service with access to one of those sources retrieves the API key.
4. The attacker submits requests to OpenRouter using the exposed bearer credential.
5. The attacker consumes the associated quota or exercises any OpenRouter permissions granted to that credential until it is revoked or expires.

Impact Assessment

Successful exploitation exposes the OpenRouter API credential. The resulting privileges are limited to those granted to that key ...[truncated 615 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key and -k arguments so credentials cannot be placed directly in command invocations.
2. Prefer a protected secret manager, operating-system keyring, or credential file with restrictive permissions.
3. If environment-variable support is retained, document OPENROUTER_API_KEY as the fallback and warn that environment variables may also be exposed by some process-management or diagnostic systems.
4. For interactive use, optionally read the key through a non-echoing prompt such as getpass.getpass() when no protected secret source is configured.
5. Update SKILL.md to remove examples or instructions that recommend --api-key.
6. Advise users who previously supplied keys on the command line to clear affected histories and logs where feasible and rotate potentially exposed credentials.
7. Continue restricting credential transmission to the fixed HTTPS OpenRouter endpoint, and avoid including authorization headers or request objects in diagnostic output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents and invokes capabilities that access environment variables, read and write local files, and make outbound network requests, but it declares no explicit tool scope or permissions boundaries. That creates an unnecessary trust gap: an agent may use broader capabilities than a reviewer expects, including handling API keys and writing persistent artifacts to disk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Generate new image:

bash

# Ensure outbound directory exists first
mkdir -p ~/.openclaw/media/outbound

uv run ~/.openclaw/workspace/skills/openrouter-image-generation/scripts/generate_image.py \
  --prompt "your image description" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

- Preflight:
  - `command -v uv`
  - `test -n "$OPENROUTER_API_KEY"` (or pass `--api-key`)
  - `test -d ~/.openclaw/media/outbound || mkdir -p ~/.openclaw/media/outbound`
  - If editing: `test -f "path/to/input.png"`

- Common failures:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

When --input-image is used, the script base64-encodes the local file and embeds it in the API request sent to OpenRouter. That means potentially sensitive local image contents are exfiltrated to a third-party service, and the script does not provide an explicit warning, confirmation, or privacy notice at the point of use. In a skill whose purpose is remote image generation/editing, this is expected behavior, but it still creates a real data-disclosure risk if users do not realize local files are being uploaded.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The code creates parent directories and writes image bytes to the user-supplied filename path, which can overwrite existing files. While saving an image is part of the script's purpose, there is no explicit warning in the docstring or CLI help that the specified output path will be created or overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.