Kie Audio Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:23 AM UTC
• Version: 1.0.0

Overview

This skill does what it advertises, but it reads more local OpenClaw environment secrets than it needs for music generation.

Install only if you are comfortable with the skill using Kie.ai credits and writing generated files under the chosen output directory. Before installing, consider isolating KIE_API_KEY from unrelated secrets in OpenClaw globalEnv, or ask the publisher to narrow the loader to KIE_API_KEY and KIE_WEBHOOK_HMAC_KEY.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/kie_client.py:50

Finding

Overbroad Loading of Sensitive Global Environment Configuration

Content

View full analysis

Vulnerability Details

File Location: scripts/kie_client.py, lines 50–64
Vulnerability Type: Violation of least privilege through unnecessary credential access
Risk Level: Medium

python

try:
    cfg_path = Path.home() / ".openclaw" / "openclaw.json"
    if not cfg_path.is_file():
        return
    with open(cfg_path, encoding="utf-8") as f:
        cfg = json.load(f)
    global_env = cfg.get("globalEnv") or {}
    if not isinstance(global_env, dict):
        return
    for key, value in global_env.items():
        if key not in os.environ and value is not None:
            os.environ[key] = str(value)
except (OSError, ValueError):
    # Silently ignore — skill will fail later with a clear KIE_API_KEY error
    # if the key really is missing.
    pass

Technical Analysis

Importing scripts/kie_client.py invokes _load_openclaw_global_env(), which reads the user's ~/.openclaw/openclaw.json file and copies every entry under globalEnv into the process environment.

The Skill's declared functionality requires only KIE_API_KEY and, when webhook verification is used, KIE_WEBHOOK_HMAC_KEY. Loading all other environment entries gives the process access to credentials and configuration unrelated to music generation, violating least-privilege principles.

No reviewed code transmits these unrelated values, so this is not confirmed data exfiltration. Nevertheless, exposing them through os.environ expands the sensitive-data scope available to any other imported module, future code modification, diagnostic routine, or compromised component running in the same process.

Attack Path

1. A user stores KIE_API_KEY together with unrelated service credentials in OpenClaw's globalEnv.
2. The user invokes the Skill, causing scripts/generate.py to import scripts/kie_client.py.
3. Module initialization reads the complete globalEnv object from ~/.openclaw/openclaw.json. 4 ...[truncated 903 chars]

Remediation

View remediation

Remediation Suggestions

Replace unrestricted iteration over globalEnv with an explicit allowlist containing only the values required by this Skill:

python

allowed_keys = ("KIE_API_KEY", "KIE_WEBHOOK_HMAC_KEY")
for key in allowed_keys:
    value = global_env.get(key)
    if key not in os.environ and value is not None:
        os.environ[key] = str(value)

For stronger isolation:

1. Avoid copying configuration into the global process environment.
2. Return only requested Kie values from a narrowly scoped configuration loader.
3. Pass the API key directly to KieClient and the HMAC key directly to webhook verification.
4. Keep unrelated OpenClaw credentials inaccessible to this process wherever runtime isolation permits.
5. Add tests verifying that unrelated globalEnv entries are neither loaded nor exposed through os.environ.
6. Document precisely which configuration keys the Skill reads and under which features they are required.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly requires an API key and invokes a Python script that performs network operations, but it does not declare any explicit tool scope such as allowed tools or permissions. That weakens containment and reviewability: an agent may grant broader execution/network capability than necessary, increasing the chance of unintended external requests or misuse of sensitive environment data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger list includes broad phrases like 'background track', 'generate music', and 'song with vocals', which are common in normal conversation and could cause the skill to activate when the user did not specifically intend to use this external service. In this context, unintended invocation matters because activation can lead to code execution, network calls to a third-party API, and consumption of paid credits tied to KIE_API_KEY.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code creates an output directory and downloads generated assets into local files, which is a safety-relevant file write operation. While the script logs download paths, there is no prior disclosure in comments/docstrings or explicit warning that running the skill will create files on disk under the chosen output directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.