Moark Image Gen

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:30 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward image generator that uses a Gitee AI API key, but users should avoid passing the key on the command line.

Install only if you are comfortable sending prompts to Gitee AI and using a Gitee AI API key. Prefer setting GITEEAI_API_KEY through your environment or a secret manager instead of passing --api-key in commands, and consider pinning the openai dependency in controlled environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/perform_image_gen.py:54

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

str | None: """Get API key from argument, config, or environment.""" if provided_key: return provided_key return os.environ.get("GITEEAI_API_KEY") ``` ### Technical Analysis Secrets passed through command-line arguments may be exposed outside the intended process. Depending on the operating system and runtime environment, command arguments can appear in process inspection interfaces, monitoring agents, diagnostic output, job execution records, shell history, or orchestration logs. The documentation makes this exposure more likely by presenting `--api-key YOUR_API_KEY` as the normal invocation method. The script also gives the command-line value precedence over the environment variable. The key is not hardcoded and is not deliberately printed by the script, but its presence in the process invocation creates an avoidable credential-handling weakness. Exploitation requires access to command history, process metadata, or a logging system that records invocations. It is therefore primarily a local or operational credential-disclosure issue rather than a remote ...[truncated 1158 chars]

Remediation

View remediation

str | None: return os.environ.get("GITEEAI_API_KEY") ``` The invocation should then omit the secret: ```bash GITEEAI_API_KEY="..." python scripts/perform_image_gen.py \ --prompt "your image description" \ --model Qwen-Image ``` For higher-assurance deployments, the environment value should itself be populated by a protected secret-management facility rather than committed to a file or embedded in reusable shell scripts. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/perform_image_gen.py:4

Finding

Unpinned Third-Party Dependency

Content

View full analysis

=3.10" # dependencies = [ # "openai" # ] # /// ``` The installation instructions similarly request the latest resolvable package: ```text Ensure you have installed the required dependencies (`pip install openai`). Use the bundled script to generate images. ``` ### Technical Analysis An unconstrained package requirement allows different installations of the same Skill to resolve to different versions of the dependency and its transitive dependency graph. A future incompatible, defective, or compromised release could therefore be installed without any change to the audited project. Python packages can execute code during installation or whenever they are imported. In this project, `openai` is imported at module startup: ```python from openai import OpenAI ``` Consequently, the security behavior of the Skill depends on whichever package version the environment resolves at installation time. The project uses the legitimate package name and the standard package index is implied; there is no evidence of typosquatting, dependency confusion, or a deliberately malicious source in the reviewed files. The finding concerns missing reproducibility and integrity controls. ### Attack Path 1. An operator follows the documented `pip install openai` instruction, or a script-aware runner resolves the inline dependency declaration. 2. The package manager selects the latest version allowed by the unconstrained requirement. 3. If that release or one of its transitive dependencies has been compromised, the malicious package content is downloaded. 4. Package-controlled code may run during installation or when `perform_image_gen. ...[truncated 906 chars]

Remediation

View remediation

=3.10" # dependencies = [ # "openai==" # ] # /// ``` The documentation should refer to the same pinned version or, preferably, instruct users to install from the project's locked dependency manifest. The placeholder must be replaced with a version that maintainers have tested and approved rather than copied blindly. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/perform_image_gen.py (reported line 23)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument, config, or environment."""
    if provided_key:
        return provided_key
    return os.environ.get("GITEEAI_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill requires access to an environment variable containing an API key but does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it easier for an agent runtime to expose secrets or execute code paths without clear authorization expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends user prompts and an API key to an external image-generation service, but the documentation does not clearly warn users that their input leaves the local environment. This creates a privacy and secret-handling risk because users may provide sensitive prompts or misunderstand where their data is processed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The helper docstring says the API key is obtained from 'argument, config, or environment', and the user-facing error text says users can configure it in ~/.openclaw/openclaw.json. In reality, get_api_key only returns the provided argument or GITEEAI_API_KEY from the environment and never reads any config file, so the documentation actively misstates the implemented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.