a2e.ai Full Platform

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 2.1.0

Overview

This is a broad a2e.ai media API wrapper, but it needs review because it sources a shared shell credential file and enables identity-sensitive face/voice features plus account asset deletion without clear guardrails.

Install only if you trust a2e.ai and are comfortable giving this skill an A2E API key for media generation and account management. Avoid sourcing the shared workspace .env; provide only A2E_KEY through a scoped secret or clean environment. Use face, voice, avatar, dubbing, and try-on features only with media you own or are authorized to use, and require explicit confirmation before cloning identities, uploading media, spending credits, or deleting remote assets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14

Finding

Unsafe Execution of a Shared Environment File for Credential Loading

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-16; duplicated in references/api-key.md:3-8
Vulnerability Type: Unsafe shell sourcing and excessive credential scope
Risk Level: Medium

Vulnerable Code

SKILL.md:14-16:

bash

source ~/.openclaw/workspace/.env  # loads A2E_KEY

references/api-key.md:3-8:

markdown

The API key is stored in `~/.openclaw/workspace/.env` as `A2E_KEY`.

Load it before using the a2e.sh script or curl commands:
```bash
source ~/.openclaw/workspace/.env

text

### Technical Analysis

The documented initialization procedure uses the shell `source` command to load one required credential from a shared workspace file. `source` does not parse the file as passive configuration; it executes every statement in the file in the context of the current shell.

The Skill declares only `A2E_KEY` as required, but this procedure loads all variables and executes all commands contained in `~/.openclaw/workspace/.env`. If the file contains credentials for unrelated services, those values become available in the current shell and may be inherited by subsequently invoked processes. This exceeds the minimum credential scope needed for the declared A2E API functionality.

If another user, Skill, process, or compromised component can modify the shared file, it can insert command substitutions, shell functions, redirections, or arbitrary commands. These execute when a user or Agent follows the documented setup instructions.

The executable wrapper itself does not source the file. At `scripts/a2e.sh:6`, it only requires an existing environment variable:

```bash
A2E_KEY="${A2E_KEY:?Set A2E_KEY environment variable (source ~/.openclaw/workspace/.env)}"

Therefore, exploitation depends on the documented sourcing step and an attacker first obtaining write influence over the shared environment file. No evidence was found that the Skill modifies that file, transmits unrelated ...[truncated 1341 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that source the shared workspace .env file.
2. Rely on the Skill runtime to inject only A2E_KEY, consistent with the existing metadata declaration:

   yaml

   requires:
     env:
       - A2E_KEY
   primaryEnv: A2E_KEY
   

3. If manual setup is necessary, instruct users to export only the required value:

   bash

   read -rsp "A2E API key: " A2E_KEY
   export A2E_KEY
   printf '\n'
   

4. If file-backed storage is unavoidable, use a dedicated file containing only the A2E credential, restrict it to the owner with mode 0600, and parse the expected key as data rather than executing the file as shell code.
5. Do not use eval, command substitution, or source when parsing credential files.
6. Update the error message in scripts/a2e.sh:6 so it no longer recommends sourcing the shared file:

   bash

   A2E_KEY="${A2E_KEY:?Set the A2E_KEY environment variable}"
   

7. Document credential rotation and ensure the A2E key is scoped to only the API permissions required by this Skill, where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (73)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description overstates supported features and omits significant state-changing/account-management capabilities such as balance checks, uploads, presigned URLs, asset management, and deletion. This mismatch can mislead agents and users about what actions may occur, causing consent and authorization failures when the skill is invoked in broader workflows.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill explicitly instructs sourcing a shared .env file to load credentials into a shell context, which is a credential-access pattern. In an agent environment with shell capability, this can expose secrets to downstream commands, logs, subprocesses, or prompt-influenced operations that were not intended to access the token.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Auth

bash

source ~/.openclaw/workspace/.env  # loads A2E_KEY

If key expired → Daniel generates new one at https://video.a2e.ai → Account Settings → API Keys

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 31)May include surrounding context.

Delete Record

text

DELETE /api/v1/userText2image/{_id}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 59)May include surrounding context.

Delete Record

text

DELETE /api/v1/userNanoBanana/{_id}

---

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes face-swap and face-upload capabilities without any consent, identity, or misuse guardrails. In an agent context, this increases the risk of non-consensual impersonation, harassment, fraud, and creation of deceptive media because the capability is presented as routine and ready to use.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 79)May include surrounding context.

Delete Face Swap Image

text

DELETE /api/v1/userFaceSwapImage/{_id}

Start Face Swap Task

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 107)May include surrounding context.

Delete Face Swap Task

text

DELETE /api/v1/userFaceSwapTask/{_id}

Quick Preview Face Swap

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation advertises voice cloning and even automatic voice cloning from input media without consent or impersonation safeguards. In a conversational agent, this can directly enable social engineering, fraud, and reputational harm by making it easy to clone a third party's voice from a URL or uploaded sample.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 159)May include surrounding context.

Delete Voice

text

DELETE /api/v1/userVoice/{_id}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 194)May include surrounding context.

Delete/Cancel Video

text

DELETE /api/v1/video/{_id}

Auto Language Detect

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 269)May include surrounding context.

Delete

text

DELETE /api/v1/userImage2Video/{_id}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 294)May include surrounding context.

Delete

text

DELETE /api/v1/motionTransfer/{_id}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 319)May include surrounding context.

Delete

text

DELETE /api/v1/talkingPhoto/{_id}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 336)May include surrounding context.

text

GET /api/v1/talkingVideo/allRecords
GET /api/v1/talkingVideo/{_id}
DELETE /api/v1/talkingVideo/{_id}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 368)May include surrounding context.

Delete

text

DELETE /api/v1/userDubbing/{_id}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 387)May include surrounding context.

GET /api/v1/userCaptionRemoval/allRecords?pageNum=1&pageSize=10 GET /api/v1/userCaptionRemoval/processingRecord GET /api/v1/userCaptionRemoval/detail?_id={_id} DELETE /api/v1/userCaptionRemoval/{_id}

text

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 405)May include surrounding context.

text

GET /api/v1/virtualTryOn/allRecords?pageNum=1&pageSize=10
GET /api/v1/virtualTryOn/{_id}
DELETE /api/v1/virtualTryOn/{_id}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-complete.md (reported line 425)May include surrounding context.

Delete Custom Background

text

DELETE /api/v1/anchor/background/{_id}

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The file explicitly documents the location of a live API secret in a workspace .env file and instructs users to source it into their shell environment. In an agent-skill context, this increases the chance that other scripts, subprocesses, logs, or prompt-injected tooling can access or exfiltrate the credential, especially because the skill is designed to call external media-generation services.

Content

Scanner excerpt · references/api-key.md (reported line 7)May include surrounding context.

Load it before using the a2e.sh script or curl commands:

bash

source ~/.openclaw/workspace/.env

If the key is expired, Daniel needs to generate a new one at:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-overview.md (reported line 13)May include surrounding context.

md

- `POST /api/v1/userText2image/start` — Start generation
- `GET /api/v1/userText2image/{_id}` — Get task details
- `GET /api/v1/userText2image/allRecords?pageNum=&pageSize=` — List all tasks
- `DELETE /api/v1/userText2image/{_id}` — Delete task
- `POST /api/v1/userText2image/quickAddAvatar` — Quick add avatar from generated image

### NanoBanana (Gemini-2.5-Flash Image Preview)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-overview.md (reported line 20)May include surrounding context.

md

- `POST /api/v1/userNanoBanana/start` — Start text-to-image or image-editing
- `GET /api/v1/userNanoBanana/{_id}` — Query task detail
- `GET /api/v1/userNanoBanana/allRecords` — List all records
- `DELETE /api/v1/userNanoBanana/{_id}` — Delete record

### Image to Video
- `POST /api/v1/userImage2Video/start` — Start (produces 5s 720p video)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-overview.md (reported line 26)May include surrounding context.

md

- `POST /api/v1/userImage2Video/start` — Start (produces 5s 720p video)
- `GET /api/v1/userImage2Video/{_id}` — Check status
- `GET /api/v1/userImage2Video/allRecords` — List all
- `DELETE /api/v1/userImage2Video/{_id}` — Delete

### TTS and Voice Clone
- `GET /api/v1/ttsPublicVoice/list` — List public TTS voices

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Because this DELETE endpoint manages voice assets in a skill that supports voice cloning, the operational risk is higher than for ordinary media tasks: an agent could delete sensitive biometric-style voice resources without clear confirmation or ownership context. While the doc alone does not prove an authorization flaw, the combination of high-sensitivity assets and no stated safeguards makes this a credible security concern in agent use.

Content

Scanner excerpt · references/api-overview.md (reported line 34)May include surrounding context.

md

- `POST /api/v1/userVoiceClone/start` — Train voice clone
- `GET /api/v1/userVoiceClone/allRecords` — List voice clones
- `GET /api/v1/userVoice/{_id}` — Get voice details
- `DELETE /api/v1/userVoice/{_id}` — Delete voice

### Avatar Videos
- `POST /api/v1/video/generate` — Generate AI avatar video

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-overview.md (reported line 41)May include surrounding context.

md

- `GET /api/v1/video/{_id}` — Get video task status
- `GET /api/v1/video/allRecords` — List all videos
- `GET /api/v1/avatar/list` — List avatars
- `DELETE /api/v1/video/{_id}` — Delete/cancel video

### Miscellaneous
- `GET /api/v1/user/remainingCoins` — Check coin balance

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill exposes voice cloning, custom avatar training, face swap, talking-photo/video, and similar biometric or identity-sensitive features without visible privacy, consent, or impersonation safeguards in this file. These capabilities materially increase the risk of non-consensual deepfakes, identity misuse, reputational harm, and privacy violations, especially because the skill is explicitly marketed for face and voice cloning tasks.

Content

No source excerpt is available for this finding.