ClawHub
Back to skill

Security audit

IMA AI Image & Photo Generator — Poster, Thumbnail, Logo, Art, Illustration, Product & Social Media Graphic Design

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but it needs review because confirmed implementation choices can expose API keys, prompts, image references, and local preferences more broadly than users are told.

Install only if you are comfortable sending prompts, selected input images, and an IMA API key to IMA services. Use a scoped or low-quota test key, avoid sensitive prompts or private images, do not set custom base URLs unless you control them, and review or clear ~/.openclaw logs and preferences after use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ima_image_create.py:148
Finding

IMA API Key Exposed Through URL Query Parameters

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ima_image_create.py:1278
Finding

Unrestricted Endpoint Overrides Permit Credential and Image Exfiltration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ima_image_create.py:714
Finding

Sensitive Prompts and Image References Can Be Persisted in Error Logs

Content
View full analysis
= max_attempts: logger.error(f"❌ All {max_attempts} attempts failed") suggestion = error_info.get("suggestion", "") if not suggestion: suggestion = "Unable to create task after automatic recovery attempts." if attempt_log: last_error = attempt_log[-1] code = last_error.get("error", {}).get("code") if code == 500: suggestion += "\n\nPossible causes:" suggestion += " - Model service temporarily unavailable\n" suggestion += " - Parameters exceed model capabilities\n" suggestion += " - Try a different model or lower resolution\n" elif code in [6009, 6010]: suggestion += "\n\nPossible causes:" suggestion += " - Model configuration has changed\n" suggestion += " - Parameter/prici ...[truncated 2981 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/ima_image_create.py:1208
Finding

User Preferences Are Persisted Without the Declared Explicit-Consent Condition

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (30)

Tainted flow: 'task_id' from os.getenv (line 1406, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ima_image_create.py (reported line 776)May include surrounding context.

python
"Check the IMA dashboard for status."
            )

        resp = requests.post(url, json={"task_id": task_id},
                             headers=headers, timeout=30)
        resp.raise_for_status()
        data = resp.json()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 691)May include surrounding context.

md
**Data control:**
- ✅ **View stored data**: `cat ~/.openclaw/memory/ima_prefs.json`
- ✅ **Delete preferences**: `rm ~/.openclaw/memory/ima_prefs.json` (resets to defaults)
- ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/` (auto-cleanup after 7 days anyway)

### ⚠️ Advanced Users: Fork & Modify

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 692)May include surrounding context.

md
**Data control:**
- ✅ **View stored data**: `cat ~/.openclaw/memory/ima_prefs.json`
- ✅ **Delete preferences**: `rm ~/.openclaw/memory/ima_prefs.json` (resets to defaults)
- ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/` (auto-cleanup after 7 days anyway)

### ⚠️ Advanced Users: Fork & Modify

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 692)May include surrounding context.

md
**Data control:**
- ✅ **View stored data**: `cat ~/.openclaw/memory/ima_prefs.json`
- ✅ **Delete preferences**: `rm ~/.openclaw/memory/ima_prefs.json` (resets to defaults)
- ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/` (auto-cleanup after 7 days anyway)

### ⚠️ Advanced Users: Fork & Modify

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 692)May include surrounding context.

md
**Data control:**
- ✅ **View stored data**: `cat ~/.openclaw/memory/ima_prefs.json`
- ✅ **Delete preferences**: `rm ~/.openclaw/memory/ima_prefs.json` (resets to defaults)
- ✅ **Delete logs**: `rm -rf ~/.openclaw/logs/ima_skills/` (auto-cleanup after 7 days anyway)

### ⚠️ Advanced Users: Fork & Modify

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 696)May include surrounding context.

md
### ⚠️ Advanced Users: Fork & Modify

If you need to modify this skill for your use case:
1. **Fork the repository** (don't modify the original)
2. **Update your fork** with your changes
3. **Test thoroughly** with limited API keys

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This code does not perform the declared primary function of AI image generation. Instead, it provides ancillary logging functionality, including creating directories, writing rotating log files, and deleting old logs. Those file-system behaviors are not reflected in the declared permissions, and the actual behavior shown is materially different from the advertised end-user capability. While logging can be a supporting detail in a larger image-generation skill, the supplied code chunk itself does not implement or demonstrate any image generation functionality, so the description does not accurately represent what this code actually does.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ima_image_create.py (reported line 1294)May include surrounding context.

python
args   = build_parser().parse_args()
    base   = args.base_url
    
    # Get API key from args or environment variable
    apikey = args.api_key or os.getenv("IMA_API_KEY")
    if not apikey:
        logger.error("API key is required. Use --api-key or set IMA_API_KEY environment variable")

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The keyword list is extremely broad and repetitive, with many generic triggers such as 'AI image generator', 'thumbnail generator', and 'image generator' that can match a wide range of unrelated user intents. In a routing or invocation system, this can cause the skill to be selected too often, overshadow more appropriate skills, and increase the chance that image-generation capabilities are invoked in unintended contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instruction 'Match the user's language (Chinese/English)' imposes a language constraint in the skill's natural-language behavior. Because it does not offer a broader language choice or explain a justified region-specific limitation, it can violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 474)May include surrounding context.

md
**v1.3 enhancement:**
- Step 3 caption now includes original image URL
- Users can easily copy/share the link without asking

---

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 601)May include surrounding context.

md
**Both domains are owned by IMA Studio**, but if you're concerned about credential exposure:

✅ **Best practices:**
- Use a **test/scoped API key** for initial testing (create at https://imastudio.com/api-keys)
- Set a low quota (e.g., 100 credits) for the test key
- Rotate your key after testing if needed
- Contact IMA support to confirm domain ownership: support@imastudio.com

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The documentation makes a strong privacy claim that user_id is never transmitted to IMA servers while simultaneously instructing agents to pass --user-id into the bundled script. Without code in this file proving local-only handling, operators may be misled about what identifiers are shared, creating a privacy and trust risk if the script forwards or logs that value remotely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a unified tool for AI image and photo generation, specifically text-to-image and image-to-image workflows. In the FAQ, the skill instructs users to use video models such as Wan 2.6 and extract the first frame as an image, which is a materially different capability outside the described image-generation scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

An image generator skill can reasonably upload images, poll tasks, and return generated images, but advising use of separate video models introduces a new modality and workflow not necessary for the skill's declared purpose. This is context-inappropriate because the manifest does not claim any video-generation support.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code performs external transmission of prompts, model parameters, and authenticated requests to a third-party service. In context, that is the skill's intended function, but it is still security-relevant because sensitive user content and API credentials leave the local environment and are exposed to an external provider.

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 1506)May include surrounding context.

md
"parameters":    nested_params,
        }],
    }
    r = requests.post(f"{BASE_URL}/open/v1/tasks/create", headers=HEADERS, json=body)
    r.raise_for_status()
    return r.json()["data"]["id"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-DETAIL.md (reported line 1514)May include surrounding context.

md
def poll(task_id: str, interval: int = 3, timeout: int = 300) -> dict:
    deadline = time.time() + timeout
    while time.time() < deadline:
        r = requests.post(f"{BASE_URL}/open/v1/tasks/detail", headers=HEADERS, json={"task_id": task_id})
        r.raise_for_status()
        task   = r.json()["data"]
        medias = task.get("medias", [])

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Line L164 hard-codes x_app_language: en, which imposes a specific language/locale behavior. The file does not state that this is optional, user-selected, or required for a region-specific purpose, so it conflicts with the policy against forcing a language without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ima_image_create.py (reported line 714)May include surrounding context.

python
f"credit={credit}, attribute_id={attribute_id}")

    try:
        resp = requests.post(url, json=payload, headers=headers, timeout=30)
        resp.raise_for_status()
        data = resp.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ima_image_create.py (reported line 776)May include surrounding context.

python
f"credit={credit}, attribute_id={attribute_id}")

    try:
        resp = requests.post(url, json=payload, headers=headers, timeout=30)
        resp.raise_for_status()
        data = resp.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

User preference data is written to disk without any user-facing notice in this file, which can violate expectations about data handling in an image-generation tool. In agent or shared-system deployments, silent persistence may expose usage history and model choices tied to a user identifier, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is specified as requests>=2.25.0, which allows installation of many different future or environment-dependent versions rather than a known-reviewed release. This weakens build reproducibility and can inadvertently pull in a vulnerable or incompatible version of requests, especially given the package's history of advisories.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
# Python dependencies for ima-ai-image-photo-generator skill
# Install with: pip install -r requirements.txt

requests>=2.25.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

Because the manifest does not pin the requests version, it is impossible to verify whether deployments will receive a release affected by one of the known advisories. In a network-facing skill that likely fetches remote resources or interacts with external services, an affected requests version could expose credentials, weaken TLS-related guarantees, or introduce other client-side request handling issues.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The code defines a persistent preferences path under the user's home directory and later reads/writes it for convenience features unrelated to strict task execution. This broadens the skill's data footprint beyond core image generation and can expose user-associated metadata to other local processes or users if filesystem permissions are weak.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL-DETAIL.md:692