Security audit

Fast Image

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its send helper can execute shell-interpreted user input and has staging-path issues that make it unsafe without review.

Install only after the maintainer removes shell: true or otherwise prevents shell interpretation, validates channel and target values, uses a unique home-directory-based staging directory, and pins dependencies. Treat this as a Review item rather than proven malware: the core image-send behavior is disclosed, but the implementation has high-impact safety bugs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: send_image.mjs:67
Finding: Shell Command Injection Through Caller-Controlled CLI Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: send_image.mjs:19
Finding: Predictable and Incorrectly Resolved Media Staging Path
Content: View full analysis
= SIZE_THRESHOLD) { const stem = path.parse(fileName).name; targetName = `${stem}_compressed.jpg`; } else { targetName = fileName; } const targetPath = path.join(TMP_DIR, targetName); if (fileSize < SIZE_THRESHOLD) { await fs.copyFile(sourcePath, targetPath); } else { try { const sharp = (await import('sharp')).default; await sharp(sourcePath) .jpeg({ quality: 80, progressive: true }) .toFile(targetPath); } catch (err) { console.error('FAIL: 压缩图片失败'); process.exit(1); } } return targetPath; } ``` The resulting path is later deleted without confirming that it still refers to the file created by the current invocation: ```js async function cleanup(imagePath) { try { await fs.unlink(imagePath); } catch {} } ``` ### Technical Analysis Node.js filesystem APIs do not perform shell-style tilde expansion. Therefore, the literal path `"~/.openclaw/media/browser/"` is not reliably resolved to the current user's home directory. It is treated as a relative path beginning with a directory named `~`, making the actual location dependent on the process working directory. The destination filename is deterministically derived from `path.basename(sourcePath)`. Multiple invocations using the same basename t ...[truncated 2537 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:49
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Add a `package.json` and committed lockfile generated by a supported package manager. 3. Preserve and verify registry integrity hashes in the lockfile. 4. Use `npm ci` for reproducible installations. 5. Configure a trusted registry explicitly in deployment environments. 6. Review dependency provenance, release signatures, lifecycle scripts, and transitive dependencies before upgrading. 7. Use automated dependency scanning and establish a controlled update process. 8. Avoid recommending global or privileged installation unless it is strictly required. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger keywords are broad terms like "image," "media," "photo," and "send," which are common in normal conversation and can cause the skill to activate in unintended contexts. Because this skill copies local files, may compress them, and sends them to an external channel, accidental invocation could lead to unintended disclosure of local images.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documentation describes copying local files, transmitting media to a channel, and deleting temporary files, but it does not clearly warn the user that local data will be accessed and sent externally. In a file-handling skill, missing disclosure increases the risk of users invoking it without understanding the privacy and data-handling consequences, which can result in accidental exfiltration or loss of temporary artifacts needed for audit or recovery.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings in the header comments and runtime error messages are written only in Chinese, with no opt-in or indication that the skill is intended solely for Chinese-speaking users. This can violate language/locale policy when a skill imposes a specific language without user choice or justified regional scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code writes a user-supplied image into a local media directory and may create a compressed derivative, which affects user data on disk. While there are terse comments and success/failure logs, there is no clear user-facing disclosure at the point of execution that the file will be copied into ~/.openclaw/media/browser/ and then deleted for non-qqbot channels.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script invokes openclaw via spawn(..., { shell: true }) while passing user-controlled values such as channel, target, message, and the derived image path. Using a shell here creates command-injection risk if any argument contains shell metacharacters, turning a simple image-send utility into arbitrary command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script invokes an external command to send the image and optional message to a specified channel/target, which is a network-affecting operation involving user data. Although the file header says it sends a local image to a channel, the execution path lacks a clear runtime warning or confirmation that content will be transmitted to an external destination.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: send_image.mjs:75