T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/generate.py:29- Finding
Mandatory Access to an Unused Tavily API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
pollinations-sketch-note
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its image-card purpose, but it needs review because it requires an unused API key and sends topics/prompts to third-party services with limited disclosure.
Review before installing. Use this only with non-sensitive topics, use revocable low-quota API keys, and be aware that themes/prompts leave the local environment. The publisher should remove the unused Tavily key requirement, document the actual providers and data sent, narrow the triggers, and harden temporary-file handling.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate.py:247- Finding
Pollinations API Key Exposed in a URL Query Parameter
- Content
View full analysis
``` TLS protects the URL while it travels across the network, but it does not prevent the receiving service, reverse proxies, monitoring systems, browser-independent HTTP diagnostics, or application logs from recording the complete URL. Query strings are routinely retained in access and observability logs. The code does not explicitly log the final URL, but placing a long-lived credential in the URL increases its exposure surface beyond the request authentication mechanism. ### Attack Path 1. A user invokes image generation with a valid Pollinations key. 2. `requests.get()` places the key in the request query string. 3. The complete request URL is processed by the remote service and may pass through reverse proxies or monitoring infrastructure. 4. A person or system with access to retained URL logs can recover the API key. 5. The recovered key can be reused against Pollinations until it expires or is revoked. ### Impact Assessment An exposed key could permit unauthorized Pollinations API usage, consume the victim's quota, incur charges where applicable, or access functionality granted to that credential. The exact scope depends on the permissions and billing ...[truncated 211 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate.py:457- Finding
Predictable Temporary Image File Permits Symlink-Based Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Tainted flow: 'params' from os.environ.get (line 253, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python } # print(f"🎨 正在生成背景图（风格：{style[:50]}...）") # 静默模式 response = requests.get(url, params=params, timeout=60) if response.status_code == 200: with open(output_path, 'wb') as f:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The introduction states that the skill uses Tavily Search and Pollinations AI, but it does not disclose that user prompts, topics, or generated content may be transmitted to third-party services. This creates a privacy and consent risk because users may provide sensitive educational, business, or personal topics without realizing they leave the local OpenClaw environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill automatically searches Wikipedia and Baidu Baike, but it does not clearly warn users that their topic queries will be sent to external third-party services. This creates a privacy and data-handling risk, especially if users provide sensitive, proprietary, or personal topics assuming the request stays local to the assistant.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - ✍️ Auto signature and timestamp **Who it's for:** - Students: Create learning note cards - Educators: Quick teaching materials - Content creators: Social media knowledge sharing - Corporate training: Standardized training materials
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The invocation phrases shown to users are very broad generic requests for image generation, such as asking to generate a picture about a topic. In an agent environment, broad triggers can cause this skill to activate when a user intended a different image workflow, leading to unintended external searches and generation behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly advertises automatic search against external services, but the description does not warn users that their query/theme content will be transmitted to third-party providers such as Wikipedia, Baidu Baike, and likely API-backed summarization services. This creates a real privacy and transparency issue because users may provide sensitive topics or internal terms without realizing the data leaves the local environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest advertises automatic search and summarization but does not disclose that user topics may be transmitted to third-party APIs via the configured POLLINATIONS_API_KEY and TAVILY_API_KEY integrations. This is dangerous because users may provide sensitive subjects, assuming local processing, while the skill silently sends that data to external providers with their own retention and logging practices.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrases are broad enough to match generic image-generation requests, which can cause the skill to activate outside its intended sketch-note use case. This creates a prompt-routing and consent problem: users may unintentionally send topics to this skill and its linked external services when they expected a different tool or no third-party processing at all.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script transmits user-provided themes and fetched content to external services (Jina Reader/Pollinations) without making that data-sharing behavior explicit at the point of use. In a skill/agent context, users may assume local-only processing, so undisclosed outbound transmission can leak sensitive prompts or private topics entered as themes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation does not clearly warn users that their topic input may be transmitted to external services for both search and image generation. This creates a privacy and consent risk, especially if users provide sensitive, personal, or proprietary topics assuming the operation is local or self-contained.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are very broad and overlap with generic image-generation requests, which can cause the skill to activate in situations where the user did not specifically intend to use this tool. Because the skill sends prompts to external APIs and may perform web search, accidental invocation can expose user topics to third parties and produce unexpected actions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The natural-language description labels the skill as a Chinese AI tool, which can imply a locale or language constraint. Although the file later lists support for Chinese and English, this early phrasing does not clearly present language choice or explain why a Chinese-specific framing is required.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The description is given in both English and Chinese, and the example usage uses a Chinese placeholder, which suggests language-specific behavior or expectations. The file does not state whether users may choose their preferred language/output locale or whether the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 70% confidence
- Finding
Keywords, tags, and trigger examples are exclusively Chinese-centric, including labels such as "chinese" and "中文 AI", but the manifest does not explicitly state whether other languages are supported or whether Chinese is an intentional regional constraint. This can create an implicit language policy restriction without user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill description, CLI help text, and generated fallback text are all written in Chinese, and the text filtering/compression logic is tailored to Chinese output, with no indication that users may choose another language. This constitutes a locale/language policy concern because the skill effectively forces one language without documented opt-in or justification.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The docstring says the function fetches Wikipedia content, which implies a specific source and behavior. In reality, the implemented primary behavior is to access Baidu Baike through r.jina.ai, with Wikipedia only as a secondary fallback, so the documentation actively misstates what the function does.
- Content
Static analysis
No suspicious patterns detected.