ClawHub
Back to skill

Security audit

OATDA Generate Image

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OATDA image-generation helper whose API-key use matches its stated purpose.

Install only if you trust OATDA with your image prompts and API key. Prefer using OATDA_API_KEY from your environment or a properly permissioned credentials file, avoid logging the key, and remember that generated image URLs or public file URLs used as parameters may be visible to the service.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
"openclaw":
      {
        "emoji": "🎨",
        "requires": { "bins": ["curl", "jq"], "env": ["OATDA_API_KEY"], "config": ["~/.oatda/credentials.json"] },
        "primaryEnv": "OATDA_API_KEY",
      },
  }
Confidence
86% confidence
Finding
The skill instructs the runtime to read an API key from ~/.oatda/credentials.json and export it into the shell environment for subsequent commands. Accessing secrets from a local credential store is sensitive behavior: if the skill, surrounding tooling, or logs are compromised, the credential could be exposed or reused, and the broad fallback to a file increases the blast radius compared with requiring explicit secure secret injection.

Static analysis

No suspicious patterns detected.