T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/media_gen_client.py:43- Finding
Bearer API Credential May Be Disclosed Through Cross-Origin HTTP Redirects
- Content
View full analysis
- Remediation
View remediation
Security audit
Unified API for powerful image and video generation
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed AIsa image and video generation client that sends prompts and reference image URLs to AIsa and saves generated media locally.
Install only if you intend to use AIsa's external service. Treat prompts, reference image URLs, task IDs, and generated media metadata as data sent to AIsa, use a dedicated/revocable API key, avoid submitting secrets or internal URLs, and choose output paths carefully because generated files may be created or overwritten.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Tainted flow: 'req' from os.environ.get (line 65, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request(url, data=data, headers=all_headers, method=method.upper()) try: with urllib.request.urlopen(req, timeout=timeout_s) as resp: raw = resp.read().decode("utf-8") return json.loads(raw) if raw else {} except urllib.error.HTTPError as e:
Tainted flow: 'req' from os.environ.get (line 65, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The download helper fetches an arbitrary URL returned by the remote task API and writes the response directly to disk without validating scheme, host, content type, or size. If the upstream service is compromised or tricked into returning unexpected URLs, this becomes a server-side request forgery style outbound fetch and arbitrary file download primitive that can reach internal resources or exhaust disk space.
- Content
python os.makedirs(os.path.dirname(out_path) or ".", exist_ok=True) req = urllib.request.Request(url, headers={"User-Agent": "OpenClaw-Media-Gen/1.0"}) try: with urllib.request.urlopen(req, timeout=timeout_s) as resp, open(out_path, "wb") as f: total = 0 while True: chunk = resp.read(1024 * 1024) # 1MB
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares required environment variables and demonstrates network access to external APIs, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a transparency and governance gap: agents or users may not understand that the skill can exfiltrate prompts or referenced media to third-party services using a bearer token.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructions and descriptions are written in Chinese, but the file does not indicate that this language choice is optional or region-specific. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy violation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
文档：
google-gemini-chat（GenerateContent）见https://docs.aisa.one/reference/generatecontent。curl 示例（返回 inline_data 时为图片）
bash curl -X POST "https://api.aisa.one/v1/models/gemini-3-pro-image-preview:generateContent" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python OpenClaw Media Gen - AIsa API Client Image: - Gemini GenerateContent: POST https://api.aisa.one/v1/models/{model}:generateContent Video: - Wan 2.6 async task:
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs users to send prompts and image URLs to third-party AIsa media-generation endpoints but does not explicitly warn that user-provided content will leave the local system. This can lead to unintentional disclosure of sensitive prompts, internal URLs, or proprietary media references, especially when users assume the tool operates locally or do not realize external API processing is involved.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The natural-language instructions throughout the README are presented in Chinese, and there is no indication that other languages are supported or that the language choice is intentional for a region-specific skill. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file explicitly states that the client script will automatically parse and save returned image data to a file, and later shows automatic MP4 download commands. The skill description does not provide any warning that using these commands writes files to the local system, which is a user-impacting behavior covered by the missing-warning rule for markdown files.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code writes generated image bytes to a local path, either user-specified or auto-generated, but provides no confirmation prompt or user-facing disclosure at the point of the write. Although saving output is part of the command's function, the code itself does not warn that running the command will create or overwrite a file path.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
When --download is used, the script automatically downloads the generated video and saves it to a local file, but there is no confirmation prompt or clear disclosure immediately before the write. Users may not realize that waiting on a task can also trigger a file download and local file creation.
- Content
Static analysis
No suspicious patterns detected.