Kimi K2.5 Vision

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:53 AM UTC
• Version: 1.0.0

Overview

The skill does image recognition as described, but it can expose a recovered API key in terminal or agent logs.

Install only if you are comfortable with local images being sent to DashScope and with the skill reading DashScope credentials from your environment or OpenClaw config. The publisher should remove raw API-key printing, avoid shell-history based persistence guidance, document credential sources precisely, and narrow activation to explicit user requests before this is treated as routine.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/recognize.py:80

Finding

Recovered API Key Is Disclosed in Diagnostic Output

Content

View full analysis

> ~/.openclaw/.env", file=sys.stderr) ``` ### Technical Analysis The script retrieves an existing DashScope API key from OpenClaw configuration and interpolates the complete credential into a persistence command printed to stderr. Although stderr is intended for diagnostic output, agent runtimes, CI systems, terminal recorders, monitoring systems, and support bundles commonly retain it. Consequently, a credential originally stored in a configuration file can be copied into additional and potentially less protected logging systems. Displaying the complete key is not necessary for image recognition or credential discovery. The script can provide persistence guidance using a placeholder without exposing the recovered value. ### Attack Path 1. A valid API key exists in one of the supported fields in `~/.openclaw/openclaw.json`. 2. The `.env` file does not exist or does not contain the string `DASHSCOPE_API_KEY`. 3. The user or agent invokes the image-recognition script. 4. The script retrieves the key and prints it verbatim to stderr as part of an `echo` command. 5. An agent platform, CI runner, terminal recorder, or diagnostic collector retains stderr. 6. A party with access to the retained output extracts and reuses the API key. ### Impact Assessment An attacker who obtains the disclosed key may authenticate to DashScope with the permissions associated with that credential, consume paid API quota, submit infere ...[truncated 280 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:40

Finding

Credential Persistence Guidance Does Not Enforce Secure Storage

Content

View full analysis

> ~/.openclaw/.env ``` The script provides equivalent guidance when no key is found: ```python print("然后设置：", file=sys.stderr) print(" echo 'DASHSCOPE_API_KEY=sk-sp-你的key' >> ~/.openclaw/.env", file=sys.stderr) ``` ### Technical Analysis The recommended command places a long-lived API credential directly on a shell command line and appends it to a plaintext file. The guidance does not ensure that `~/.openclaw/.env` has restrictive permissions. After replacing the placeholder with a real key, an interactive shell may retain the complete command in its history. The resulting file may also be readable by unintended local principals if the containing directory, existing file permissions, process umask, backups, or synchronization systems are insufficiently restrictive. Using append redirection can create duplicate definitions and does not safely update an existing key. It also relies on the current umask when creating the file. ### Attack Path 1. A user follows the documented instructions and substitutes a real API key for the placeholder. 2. The complete key is entered as part of an interactive shell command. 3. The shell or terminal-management system records that command in history or session logs. 4. The key is appended to `~/.openclaw/.env` without an explicit permission check. 5. A local user, process, backup reader, or party with access to shell history obtains the credential. 6. The exposed key is reused against provider APIs. Exploitation requires access to the affected user's command history, environment file, backups, or captured terminal output. ### Impact Assessment Exposure allows use of t ...[truncated 406 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (11)

Tainted flow: 'req' from os.environ.get (line 152, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/recognize.py (reported line 160)May include surrounding context.

python

)

    try:
        with urllib.request.urlopen(req, timeout=60) as response:
            result = json.loads(response.read().decode("utf-8"))
            return result["choices"][0]["message"]["content"]
    except urllib.error.HTTPError as e:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

首次运行时，脚本会提示你将 API Key 写入 ~/.openclaw/.env 以持久化：

bash

echo 'DASHSCOPE_API_KEY=sk-sp-你的key' >> ~/.openclaw/.env

这样重启后也能直接使用。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/recognize.py (reported line 80)May include surrounding context.

python

os.environ["DASHSCOPE_API_KEY"] = api_key

        # 第一次找到，提示用户持久化
        env_file = os.path.expanduser("~/.openclaw/.env")
        if not os.path.exists(env_file) or "DASHSCOPE_API_KEY" not in open(env_file).read():
            print(f"✓ 从 OpenClaw 配置 ({source}) 找到 API Key", file=sys.stderr)
            print("", file=sys.stderr)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/recognize.py (reported line 104)May include surrounding context.

python

os.environ["DASHSCOPE_API_KEY"] = api_key

        # 第一次找到，提示用户持久化
        env_file = os.path.expanduser("~/.openclaw/.env")
        if not os.path.exists(env_file) or "DASHSCOPE_API_KEY" not in open(env_file).read():
            print(f"✓ 从 OpenClaw 配置 ({source}) 找到 API Key", file=sys.stderr)
            print("", file=sys.stderr)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

This line prints a command containing the actual discovered API key, directly exposing a credential obtained from local secret storage. In the context of an agent skill that auto-reads OpenClaw configuration, this is especially dangerous because it converts silently discovered secrets into user-facing output that may be captured outside the user's control.

Content

Scanner excerpt · scripts/recognize.py (reported line 85)May include surrounding context.

python

print(f"✓ 从 OpenClaw 配置 ({source}) 找到 API Key", file=sys.stderr)
            print("", file=sys.stderr)
            print("💡 建议持久化到环境变量，重启后也能直接使用：", file=sys.stderr)
            print(f"   echo 'DASHSCOPE_API_KEY={api_key}' >> ~/.openclaw/.env", file=sys.stderr)
            print("", file=sys.stderr)

        return api_key, source

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script emits the discovered API key directly in a shell command suggestion, which exposes the full credential in user-visible output. This can leak into terminal scrollback, CI logs, remote session transcripts, or wrappers that capture stderr, enabling unauthorized API use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documents behavior that reads environment variables, accesses local configuration files, and makes network requests, but it declares no explicit tool scope or permission boundaries. This can cause the agent runtime or user to invoke a skill with broader capabilities than expected, increasing the risk of unintended secret access or outbound exfiltration if the implementation is modified or abused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition includes broad language such as activating when the model returns "no media-understanding provider" or when a user asks for image analysis, which may cause the skill to run in more contexts than necessary. Because the skill can read configuration and use credentials for external network access, over-broad triggering increases the chance of unintended execution and data being sent to a third-party provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The docstring and multiple user-facing messages are written only in Chinese, and the default prompt also instructs Chinese output. For an all-users skill file, this imposes a specific language/locale without opt-in, which matches the policy category for language or locale violations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

When the script discovers an API key in local config, it prints a shell-ready command containing the full secret to stderr. This unnecessarily discloses credentials to terminal history, logs, screen recordings, and any calling process that captures stderr, turning a local secret lookup into credential exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The stated purpose is recognizing images with Kimi and automatically reading an API key from OpenClaw config. This implementation also searches environment variables and a separate cache file, then mutates the process environment, expanding its credential-handling behavior beyond the specific 'read from OpenClaw config' scope described in the manifest.

Content

No source excerpt is available for this finding.