Security audit

Dashscope Image Gen

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent DashScope image generator, but it can silently reuse a local OpenClaw API key and send it to a caller-selected endpoint.

Review this before installing if you keep DashScope credentials in OpenClaw config or might let agents choose command arguments. Prefer explicit DASHSCOPE_API_KEY use, avoid custom --base-url values, and consider requiring endpoint allowlisting plus bounded image downloads before trusting it with paid API credentials.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/dashscope_image_gen.py:45
Finding: API Credential Disclosure Through an Unrestricted Endpoint Override
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dashscope_image_gen.py:124
Finding: Unvalidated Server-Directed Image URL Retrieval
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill describes and invokes capabilities that access environment variables, read local files, and make outbound network requests, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a mismatch between the skill’s documented behavior and its effective capabilities, which weakens policy enforcement and can allow broader execution than reviewers or orchestrators expect.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Reading credentials from an unrelated application's config file is a genuine security design issue because it allows this helper to inherit privileges the user did not explicitly provide to it. In a skill/agent context, this is more dangerous than a normal local script because the tool can opportunistically access local secrets and use them for outbound network requests, increasing the risk of covert credential use or abuse if the endpoint or surrounding workflow is modified.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script silently falls back to reading an API key from ~/.openclaw/openclaw.json even though its documented credential sources are the environment or --api-key. This creates an unexpected secret boundary crossing: a utility for one service automatically consumes credentials from an unrelated local application, which can cause unintended credential use and weakens least-privilege expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.