ClawHub
Back to skill

Security audit

Dashscope Imagegen

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is mostly purpose-aligned, but it tells the agent to run an unreviewed local script outside the package and use a DashScope API key, so users should review that setup before installing.

Before installing, confirm that `~/.openclaw/scripts/dashscope-imagegen.py` exists, comes from a source you trust, and only sends the intended prompt data to DashScope. Avoid using confidential prompts unless you are comfortable with Alibaba Cloud processing them, and keep `DASHSCOPE_API_KEY` scoped and revocable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: dashscope-imagegen
description: "Generate images using DashScope wan2.6-t2i model (通义万相). Use when user asks to generate/create images, illustrations, or visual content via DashScope/通义万相. Requires exec tool and DASHSCOPE_API_KEY."
---

# dashscope-imagegen
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger text is very broad and can match many ordinary image-related requests, which increases the chance the skill is invoked when the user did not specifically intend to use DashScope. Because this skill relies on an external service and an exec-capable script, over-broad routing can cause unnecessary prompt disclosure to a third party and unintended external actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill does not clearly warn that user prompts will be sent to Alibaba Cloud DashScope, which is a privacy and data-handling issue. Users may provide sensitive text or proprietary concepts for image generation without understanding that this content leaves the local environment and is processed by an external provider.

Static analysis

No suspicious patterns detected.