Freepik

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:31 PM UTC
• Version: 1.0.5

Overview

The skill appears to do what it claims, but its broad curl permission could expose the Freepik API key if command matching is not strict.

Review this before installing if the Freepik API key is valuable or billed. Prefer the ClawHub package or a pinned reviewed commit, avoid sending sensitive prompts or private media URLs, periodically clean ~/.freepik/sessions, and consider using a restricted or low-quota Freepik API key until the curl allowlist is tightened.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:5

Finding

Bypassable curl Host Allowlist May Expose the Freepik API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable code:

yaml

allowed-tools: Bash(curl *api.freepik.com*), Bash(curl **.freepik.com*), Bash(jq *), Bash(mkdir -p ~/.freepik/*)

Technical Analysis

The curl permissions use substring-style wildcard patterns rather than enforcing an exact parsed origin. In particular, *api.freepik.com* may match a command containing an attacker-controlled lookalike hostname such as api.freepik.com.attacker.example, depending on the OpenClaw command-matching implementation.

The skill's documented requests attach the secret FREEPIK_API_KEY to curl requests through the x-freepik-api-key header. If the command matcher only checks whether the command text contains api.freepik.com, an attacker could construct a URL that satisfies the allowlist while resolving to infrastructure outside Freepik's control.

The second pattern, **.freepik.com*, also ends in an unrestricted wildcard and does not explicitly constrain the URL scheme, port, redirects, or parsed destination. Textual command matching is not equivalent to validating the effective network destination.

Attack Path

1. An attacker supplies a crafted URL or endpoint through user-controlled skill arguments, indirect prompt injection, or content processed by the agent.
2. The URL contains the permitted text while using an attacker-controlled hostname, such as https://api.freepik.com.attacker.example/collect.
3. The resulting curl command may pass the substring-based allowed-tools rule.
4. The agent follows the documented authentication pattern and adds x-freepik-api-key: $FREEPIK_API_KEY.
5. Curl connects to the attacker-controlled server and transmits the API key.
6. The attacker uses the stolen key to make Freepik API requests under the victim's account.

Exploitability depends on the exact semantics of the O ...[truncated 656 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace substring-based Bash patterns with a structured network policy that permits only:
   • Scheme: https
   • Host: exactly api.freepik.com
   • Port: 443
2. Validate the parsed destination rather than searching the raw command text for an allowed substring.
3. Reject URL user-info, unexpected ports, encoded host components, and hostnames that merely contain the trusted hostname.
4. Disable redirects for authenticated requests where possible, for example with --max-redirs 0. If redirects are required, independently validate every redirect destination before forwarding sensitive headers.
5. Restrict protocols with curl options such as:

   bash

   --proto '=https' --proto-redir '=https'
   

6. Use a fixed wrapper or API client that constructs the Freepik origin internally and accepts only validated relative endpoint paths.
7. Do not attach x-freepik-api-key until the final parsed destination has been confirmed as exactly api.freepik.com.
8. Add negative tests for lookalike destinations, including api.freepik.com.attacker.example, alternate ports, URL user-info, encoded hostnames, and redirect-based attempts.

T08 · Insecure Dependencies

Warning

• Location: README.md:19

Finding

Manual Installation Trusts an Unpinned Mutable Repository

Content

View full analysis

Vulnerability Details

File Location: README.md:19-23
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

markdown

### Manual

```bash
git clone https://github.com/SqaaSSL/freepik-openclaw-skill ~/.openclaw/skills/freepik

text

### Technical Analysis

The manual installation procedure clones the repository's mutable default branch without pinning a release tag or commit and without verifying a signature, checksum, or provenance attestation. Consequently, the content installed by this command can change after the audited version has been reviewed.

The repository is hosted under an individual GitHub namespace rather than a Freepik-controlled namespace. This does not itself establish malicious behavior, but it increases the importance of explicit provenance and integrity verification. A compromise of the maintainer account, repository, or upstream ownership could replace `SKILL.md` with instructions that request broader tools, disclose credentials, or execute unsafe commands.

Because this project is a prompt-based skill, changes to its Markdown instructions are operational changes: OpenClaw loads those instructions into the agent's context and may execute commands authorized by the skill configuration. A mutable skill source therefore creates a supply-chain risk even though the audited snapshot contains no embedded executable scripts.

### Attack Path

1. An attacker compromises the GitHub maintainer account, repository, release process, or repository ownership.
2. The attacker modifies the default branch to include hostile skill instructions or broader `allowed-tools` permissions.
3. A user follows the documented `git clone` command.
4. Git retrieves the current attacker-modified default branch because no audited commit or immutable release is specified.
5. OpenClaw loads the modified `SKILL.md`.
6. The malicious instructions operate with any tools and environme
...[truncated 817 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin manual installation instructions to an immutable, reviewed commit:

   bash

   git clone https://github.com/SqaaSSL/freepik-openclaw-skill ~/.openclaw/skills/freepik
   git -C ~/.openclaw/skills/freepik checkout --detach <verified-commit-sha>
   

2. Publish signed release tags and instruct users to verify the signature before installation.
3. Provide SHA-256 checksums or a signed provenance attestation for each published skill artifact.
4. Protect the repository with mandatory multi-factor authentication, branch protection, reviewed changes, and restricted release permissions.
5. Prefer installation through a registry that verifies package integrity and binds the package to a specific immutable version.
6. Clearly state that the repository is community-maintained unless official Freepik ownership can be verified.
7. Document a reproducible process for comparing the installed files against the reviewed release artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (75)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation guidance says the skill is used when a user asks about image or video generation, which is broad enough to auto-trigger on common creative requests. In a prompt-injection style skill system, overly broad routing increases the chance the agent loads this skill unnecessarily, exposing API-use instructions and expanding the action surface to external network calls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CLAUDE.md (reported line 26)May include surrounding context.

md

**Security constraints** (defined in `SKILL.md` frontmatter `allowed-tools`):
- Only `curl *api.freepik.com*` is permitted — no downloads from arbitrary domains
- Only `jq` for JSON parsing and `mkdir -p ~/.freepik/*` for session directories
- No `base64` encoding, no `curl` to non-Freepik domains

## How to Make Changes

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

**Security constraints** (defined in `SKILL.md` frontmatter `allowed-tools`):
- Only `curl *api.freepik.com*` is permitted — no downloads from arbitrary domains
- Only `jq` for JSON parsing and `mkdir -p ~/.freepik/*` for session directories
- No `base64` encoding, no `curl` to non-Freepik domains

## How to Make Changes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README states that generated results are downloaded and saved locally to a session folder, but it does not clearly warn users that using the skill performs local file writes. In an agent setting, implicit writes to disk can surprise users, consume storage, and create privacy or data-handling issues if generated or downloaded content is retained without explicit consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README encourages broad natural-language requests like 'Generate a 4K image...' or 'Create a 10 second video...', which can overlap with ordinary user conversation and increase the chance an agent auto-invokes the skill without an explicit command boundary. In an agent ecosystem, this can trigger unintended external API usage, billing, and downstream file creation from casual prompts that were not meant as tool invocations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill's allowed tools and design enable creation of a persistent ~/.freepik directory, which means generated or downloaded artifacts can remain on disk beyond the immediate interaction. Persistent local storage increases exposure if the host is shared, backed up, or later inspected by other processes or users.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: freepik
version: 1.0.5
description: Generate images, videos, icons, audio, and more using Freepik's AI API. Supports Mystic, Flux, Kling, Hailuo, Seedream, RunWay, Magnific upscaling, stock content, and 50+ models. Use when user wants to generate or edit images, create videos, generate icons, produce audio, or search stock content.
allowed-tools: Bash(curl *api.freepik.com*), Bash(curl **.freepik.com*), Bash(jq *), Bash(mkdir -p ~/.freepik/*)
argument-hint: "<command> [model] [--param value]"
metadata: {"openclaw":{"emoji":"🎨","primaryEnv":"FREEPIK_API_KEY","requires":{"env":["FREEPIK_API_KEY"]},"homepage":"https://github.com/SqaaSSL/freepik-openclaw-skill"}}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill extensively transmits user prompts, media URLs, and sometimes media content to Freepik's API and downstream model providers, yet this data-sharing behavior is not clearly disclosed in the top-level description. That omission can cause users to unknowingly send sensitive prompts or private media to third-party services, which is a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill saves generated and downloaded media into a persistent session directory under ~/.freepik, but this storage behavior is not prominently disclosed up front. Users may unintentionally cause sensitive generated assets or downloaded media to be retained locally longer than expected, increasing privacy and data-handling risk in shared or multi-user environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This section explicitly stores downloaded images, videos, and audio in a session directory under the user's home folder. That can retain sensitive or copyrighted content locally without strong disclosure, increasing privacy, legal, and post-session exposure risks.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Save generated files to session folder:

bash

mkdir -p ~/.freepik/sessions/${CLAUDE_SESSION_ID}

Downloaded images/videos/audio go to: ~/.freepik/sessions/${CLAUDE_SESSION_ID}/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This skill is explicitly designed to send user-supplied prompts and parameters to an external API endpoint, which constitutes real external data transmission. In context this is expected functionality, but it remains security-relevant because sensitive text, URLs, and optional media references may be disclosed outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Step 1: Submit task

bash

RESPONSE=$(curl -s -X POST "https://api.freepik.com/v1/ai/<endpoint>" \
  -H "x-freepik-api-key: $FREEPIK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '<JSON_PAYLOAD>')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This skill is explicitly designed to send user-supplied prompts and parameters to an external API endpoint, which constitutes real external data transmission. In context this is expected functionality, but it remains security-relevant because sensitive text, URLs, and optional media references may be disclosed outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Step 1: Submit task

bash

RESPONSE=$(curl -s -X POST "https://api.freepik.com/v1/ai/<endpoint>" \
  -H "x-freepik-api-key: $FREEPIK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '<JSON_PAYLOAD>')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 388)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 454)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 516)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 578)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 631)May include surrounding context.

Step 2: Poll for completion

bash

while true; do
  RESULT=$(curl -s "https://api.freepik.com/v1/ai/<endpoint>/$TASK_ID" \
    -H "x-freepik-api-key: $FREEPIK_API_KEY")
  STATUS=$(echo "$RESULT" | jq -r '.data.status // .status')
  echo "Status: $STATUS"

Static analysis

No suspicious patterns detected.