Security audit

IMA AI Creative Content Generator — Image, Video, Music, Ad, Marketing, Social Media Content Creation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent IMA content generator, but it needs Review because its executable can expose API keys, prompts, URLs, and local files beyond the clearly bounded generation flow.

Review before installing. Use a scoped or test IMA API key, avoid passing sensitive local paths as image inputs, and check or clear ~/.openclaw/memory/ima_prefs.json and ~/.openclaw/logs/ima_skills/ after use. Treat --base-url as unsafe unless you fully control the destination, because it can receive the API key and prompts.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/ima_create.py:1610
Finding: Arbitrary API Base URL Allows Credential and Prompt Exfiltration
Content: View full analysis
list: url = f"{base_url}/open/v1/product/list" params = {"app": app, "platform": platform, "category": category} headers = make_headers(api_key, language) resp = requests.get(url, params=params, headers=headers, timeout=30) ``` ```python def make_headers(api_key: str, language: str = "en") -> dict: return { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "x-app-source": "ima_skills", "x_app_language": language, } ``` ### Technical Analysis The caller can set `--base-url` to any URL. The implementation does not enforce HTTPS, compare the hostname against `api.imastudio.com`, or require explicit authorization before sending the IMA bearer credential. The first product-list request immediately sends `Authorization: Bearer ` to the supplied destination. If the malicious server returns a sufficiently plausible product response, later requests can additionally disclose prompts, input media URLs, generation parameters, model selections, and task metadata. This behavior e ...[truncated 1452 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ima_create.py:132
Finding: IMA API Key Is Placed in Upload-Token Query Parameters
Content: View full analysis
dict: """Step 1: Get presigned upload URL from IMA upload service.""" sign, ts, nonce = _gen_sign() r = requests.get( f"{IMA_IM_BASE}/api/rest/oss/getuploadtoken", params={ "appUid": api_key, "appId": APP_ID, "appKey": APP_KEY, "cmimToken": api_key, "sign": sign, "timestamp": ts, "nonce": nonce, "fService": "privite", "fType": "picture", "fSuffix": suffix, "fContentType": content_type, }, timeout=15, ) r.raise_for_status() return r.json()["data"] ``` ### Technical Analysis The complete IMA API key is included twice in the URL query string as `appUid` and `cmimToken`. HTTPS protects the URL in transit from passive network observers, but it does not prevent the query string from being retained by infrastructure that terminates or processes the request. URLs may be captured in reverse-proxy access logs, web-server logs, observability platforms, tracing systems, security appliances, exception reports, browser-like histories, or debugging tools. Query parameters are consequently unsuitable for reusable bearer credentials. The operation is disclosed in the documentation and appears to support local image upload. Nevertheless, duplicating a reusable account credential in a GET query exceeds sound minimum-exposure practice. A scoped, short-lived upload credential should be used instead. ### Attack Path 1. A user supplies a local image, causing `prepare_image_url()` to call `_get_upload_token()`. 2. The script constructs a GET reque ...[truncated 699 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/ima_create.py:156
Finding: Local File Upload Accepts Arbitrary Readable Files Without Media Validation
Content: View full analysis
str: """Upload a local image file to IMA CDN and return its public URL. If `source` is already an HTTPS URL it is returned as-is. Otherwise the file is uploaded via the two-step presigned URL flow and the resulting CDN URL (fdl) is returned. """ if source.startswith("https://") or source.startswith("http://"): return source if not os.path.isfile(source): raise FileNotFoundError(f"Input image not found: {source}") content_type = mimetypes.guess_type(source)[0] or "image/jpeg" suffix = source.rsplit(".", 1)[-1].lower() if "." in source else "jpeg" logger.info(f"Uploading local image: {source} ({content_type})") token_data = _get_upload_token(api_key, suffix, content_type) ful = token_data["ful"] fdl = token_data["fdl"] with open(source, "rb") as f: image_bytes = f.read() resp = requests.put(ful, data=image_bytes, headers={"Content-Type": content_type}, timeout=60) resp.raise_for_status() logger.info(f"Upload complete: {fdl}") return fdl ``` The CLI forwards every non-URL input to this function: ```python for src in raw_inputs: if src.startswith("https://") or src.startswith("http://"): resolved_inputs.append(src) else: print(f"📤 Uploading local image: {os.path.basename(src)}", flush=True) try: cdn_url = prepare_image_url(src, apikey) resolved_inputs.append(cdn_url) ``` ### Technical Analysis The only local validation is `os.path.isfile(source)`. The code does not verify that the file is an image, decode it with an image parser, enforce allowed extensions, constrain its path to user-authorized directories, limit its size, or reject symbolic-li ...[truncated 1745 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ima_create.py:1584
Finding: API Key Passed Through Command-Line Arguments Is Exposed to Local Process Inspection
Content: View full analysis
/cmdline` on applicable systems, process telemetry, audit systems, shell tracing, wrapper logs, orchestration metadata, or diagnostic crash reports. The program already declares `IMA_API_KEY` as a required environment credential in `SKILL.md`, so copying it into `argv` is unnecessary and increases exposure. Masking the key in application logs does not mitigate operating-system or process-monitor exposure. ### Attack Path 1. The Skill starts a long-running generation request with `--api-key `. 2. While the process polls for task completion, another local process or user with sufficient process-inspection access reads its command line. 3. The observer extracts the complete API key. 4. The key is replayed against IMA APIs. ### Impact Assessment A local attacker or monitoring component may obtain the reusable API credential. The resulting account impact includes unauthorized requests and consumption of paid credits, subject to the key's server-side privileges. The polling period can last up to 40 minutes for video tasks, providing a substantial observation window. ]]>
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/ima_create.py:1516
Finding: Model Preferences Are Persisted Automatically Without Explicit User Consent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ima_logger.py:45
Finding: Operational Logs Retain Sensitive Paths, URLs, Identifiers, and Partial Credential Material
Content: View full analysis
10 else "***" logger.info(f"Script started: task_type={args.task_type}, model_id={args.model_id or 'auto'}, " f"api_key={masked_key}") ``` ### Technical Analysis The logger persistently records local input paths, uploaded CDN URLs, result URLs, task identifiers, backend error information, model metadata, and the first ten characters of the API key. The log directory and files are created without explicit restrictive modes, leaving confidentiality dependent on the process umask and surrounding environment. Result or upload URLs may function as bearer-like access links when the underlying CDN does not require separate authentication. Retaining ten characters of an API key is unnecessary. Even where insufficient for direct authentication, it provides account correlation and reduces secret uncertainty. ...[truncated 1157 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependency Is Not Upper-Bounded or Reproducibly Pinned
Content: View full analysis
=2.25.0 ``` ### Technical Analysis The dependency specification accepts every future `requests` release greater than or equal to 2.25.0. Installation behavior can therefore change after the Skill has been reviewed, and different users may execute different dependency versions. This is not evidence that the current `requests` package is malicious. It is a supply-chain hardening weakness: an accidentally incompatible or compromised future release satisfying the range would be installed automatically. No hashes are supplied, so package artifacts are not reproducibly verified against an audited lock file. ### Attack Path 1. A user installs the Skill dependencies at a later date. 2. Package resolution selects a newer release allowed by `requests>=2.25.0`. 3. If that release or its dependency chain is compromised, the malicious package executes during installation or import. 4. Imported code runs in the Skill process, which has access to the IMA key, local image files, prompts, and network connectivity. ### Impact Assessment A compromised dependency could obtain all privileges of the Skill process, including access to credentials, readable local files, generated content, and outbound network access. The likelihood is lower than the directly exploitable issues above because exploitation depends on a future compromised or unsafe package release. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (26)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL-DETAIL.md (reported line 390)May include surrounding context.
md
**Data control:** - ✅ **View stored data**: `cat ~/.openclaw/memory/ima_prefs.json` - ✅ **Delete preferences**: `rm ~/.openclaw/memory/ima_prefs.json` (resets to defaults) - ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/` (auto-cleanup after 7 days anyway) ### ⚠️ Advanced Users: Fork & Modify

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL-DETAIL.md (reported line 391)May include surrounding context.
md
**Data control:** - ✅ **View stored data**: `cat ~/.openclaw/memory/ima_prefs.json` - ✅ **Delete preferences**: `rm ~/.openclaw/memory/ima_prefs.json` (resets to defaults) - ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/` (auto-cleanup after 7 days anyway) ### ⚠️ Advanced Users: Fork & Modify

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL-DETAIL.md (reported line 391)May include surrounding context.
md
**Data control:** - ✅ **View stored data**: `cat ~/.openclaw/memory/ima_prefs.json` - ✅ **Delete preferences**: `rm ~/.openclaw/memory/ima_prefs.json` (resets to defaults) - ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/` (auto-cleanup after 7 days anyway) ### ⚠️ Advanced Users: Fork & Modify

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL-DETAIL.md (reported line 391)May include surrounding context.
md
**Data control:** - ✅ **View stored data**: `cat ~/.openclaw/memory/ima_prefs.json` - ✅ **Delete preferences**: `rm ~/.openclaw/memory/ima_prefs.json` (resets to defaults) - ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/` (auto-cleanup after 7 days anyway) ### ⚠️ Advanced Users: Fork & Modify

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL-DETAIL.md (reported line 395)May include surrounding context.
md
### ⚠️ Advanced Users: Fork & Modify If you need to modify this skill for your use case: 1. **Fork the repository** (don't modify the original) 2. **Update your fork** with your changes 3. **Test thoroughly** with limited API keys

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented primarily as a content-generation tool, but it also declares local persistence paths for preferences and logs that are not clearly described in the user-facing purpose. This transparency gap can undermine user trust and informed consent, and hidden operational behaviors like log retention can expose prompts, URLs, or generated content metadata to unintended local access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest-style description says the skill should be used for "any AI content creation task," which is an unusually broad invocation description for a skill. Because this file is markdown/manifest content, that wording can overlap with many common creative requests and lacks exclusions or a constrained trigger list.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file defines activation-like conditions for reading the optional ima-knowledge-ai references using broad phrasing such as "when the triggers below match" and examples like "any video generation task." The criteria are only partially bounded and could match many ordinary requests without clear exclusion conditions or negative examples, increasing the chance of unintended cross-skill invocation behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The document states generation logs exist and recommends reviewing them for unexpected API calls, which implies request details may be stored. But L0409 warns against logging sensitive prompts/IDs and L0424-L0428 says prompts are not stored locally, so the documented intent around what logs contain is internally inconsistent in a security-relevant way.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill explicitly persists per-user model preferences and logs under ~/.openclaw, creating cross-session state that can outlive a single task. Persistent state can expose behavioral data, enable unintended cross-session correlation, and become sensitive if file permissions or retention controls are weak.
Content: Scanner excerpt · SKILL-DETAIL.md (reported line 364)May include surrounding context.
md
## Overview Call IMA Open API to create AI-generated content. All endpoints require an `ima_*` API key. The core flow is: **query products → create task → poll until done**. ---

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · SKILL-DETAIL.md (reported line 2112)May include surrounding context.
md
| Single-poll instead of loop | Poll until `resource_status == 1` for ALL medias | | Missing `app` / `platform` in parameters | Required fields — use `ima` / `web` | | `category` mismatch | `parameters[].category` must match top-level `task_type` | | `resource_status == 2` not handled | Check for failure, don't loop forever | | `status == "failed"` ignored | `resource_status=1` + `status="failed"` means actual failure | | `n > 1` and only checking first media | All `n` media items must reach `resource_status == 1` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares broad capabilities through its metadata and documented behavior—environment variable access, persistent file writes, and outbound network use—without an explicit tool permission boundary. That weakens least-privilege controls and makes it harder for a host to constrain what the skill may do, increasing the blast radius if the skill is modified, misused, or combined with prompt-injection from referenced files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The markdown explicitly instructs use of x_app_language: en, which imposes a fixed language/locale choice. The file does not offer the user a language preference option or explain why English is required for a region-specific or compliance reason.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ima_create.py (reported line 712)May include surrounding context.
python
f"credit={credit}, attribute_id={attribute_id}") try: resp = requests.post(url, json=payload, headers=headers, timeout=30) resp.raise_for_status() data = resp.json()

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ima_create.py (reported line 780)May include surrounding context.
python
f"credit={credit}, attribute_id={attribute_id}") try: resp = requests.post(url, json=payload, headers=headers, timeout=30) resp.raise_for_status() data = resp.json()

Tainted flow: 'task_id' from requests.post (line 726, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/ima_create.py (reported line 780)May include surrounding context.
python
"Check the IMA dashboard for status." ) resp = requests.post(url, json={"task_id": task_id}, headers=headers, timeout=30) resp.raise_for_status() data = resp.json()

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation in this file provides integrity-check instructions for a different filename than the current artifact. That is an intent/documentation contradiction that can mislead users trying to verify the correct skill file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: I reviewed the natural-language policy dimension and found the file explicitly says to match the user's language, which is consistent with offering language choice rather than imposing one locale. This is not a violation, so no SQP-3 issue is warranted.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Most of the document consistently identifies imastudio.com and api.imastudio.com as the service and credential source, including L0258 and L0436. The TTS section instead tells users to generate keys and buy credits at imaclaw.ai, which contradicts the surrounding product and support documentation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency is specified as requests>=2.25.0, which allows installation of many different versions over time and does not guarantee a known-safe release. This weakens supply-chain control and reproducibility, and may allow deployment of a vulnerable or incompatible version if the resolver selects one affected by published advisories.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
# Python dependencies for ima-ai-creative-content-generator skill # Install with: pip install -r requirements.txt requests>=2.25.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: Because the manifest does not pin a specific requests version, there is no way to verify whether installed environments will avoid versions affected by known requests CVEs. In a multimodal content-generation skill that likely makes outbound HTTP requests to model and media APIs, use of an affected version could expose credentials, weaken TLS/request verification behavior, or otherwise increase risk depending on runtime usage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The header builder defaults language to "en" and always sends x_app_language with that value unless the caller overrides it. This creates a language/locale default that may not match the user's preference and is not opt-in by default.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script stores per-user model preferences in ~/.openclaw/memory/ima_prefs.json, which creates local persistence not obviously necessary for one-shot content generation. While the data is not highly sensitive on its own, it introduces privacy and multi-user leakage risk on shared systems because user identifiers, usage history, and preferred models are retained without access-control or explicit consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The --language argument defaults to en, so the skill will operate in English unless the user knows to override it. This is a natural-language locale policy concern because the script imposes a language preference rather than asking for or preserving user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language documentation and comments are written entirely in Chinese, and the file does not indicate that the language is optional or that this skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a locale/language policy issue.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SKILL-DETAIL.md:391