Jimeng Image Skill Openclaw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:00 AM UTC
• Version: 0.1.0

Overview

This image-generation skill is not malicious, but it needs Review because it asks the agent to install unpinned dependencies while using API credentials and an external image service.

Review the dependency installation before installing: pin volcengine-python-sdk to a known version, avoid installing standard-library names, and use an isolated environment. Only provide Jimeng credentials you are comfortable using for image generation, and avoid sending sensitive prompts because prompt text is submitted to the external service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-29
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Requirement

- argparse
- datetime
- volcengine-python-sdk
- base64
- os

If not exits ,you need pip it.

Technical Analysis

The Skill instructs the Agent to install missing dependencies with pip but does not provide an exact package version, dependency lock file, cryptographic hashes, trusted package index, or package verification procedure.

Consequently, the package resolved at installation time can differ from the package reviewed when the Skill was published. Python package installation can execute package-controlled build or installation logic. The requirements list also mixes the external volcengine-python-sdk dependency with Python standard-library modules such as argparse, datetime, base64, and os. The broad instruction to install anything missing could therefore cause mistaken package installation.

This constitutes a supply-chain weakness rather than evidence that the currently referenced SDK is malicious.

Attack Path

1. The Agent loads the Skill and attempts to execute scripts/main.py.
2. The external SDK is unavailable in the current environment.
3. Following SKILL.md, the Agent uses pip to install the missing dependency.
4. pip resolves mutable package content from an unspecified package index without validating a pinned version or hash.
5. A compromised release, malicious similarly named package, dependency-confusion package, or compromised transitive dependency executes installation or runtime code.
6. That code runs with the Agent process's privileges and can access data available to that process, including workspace files and environment-provided credentials.

Impact Assessment

Successful exploitation could permit arbitrary code execution under ...[truncated 613 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin volcengine-python-sdk to a reviewed exact version.
2. Provide a lock file containing all transitive dependency versions.
3. Record and verify cryptographic hashes, and install with a command such as pip install --require-hashes -r requirements.txt.
4. Explicitly configure a trusted package index rather than relying on ambient pip configuration.
5. Remove argparse, datetime, base64, and os from the installation requirements because they are Python standard-library modules.
6. Replace the ambiguous “pip it” instruction with an exact, reviewed installation command.
7. Install dependencies in an isolated virtual environment using an unprivileged account.
8. Avoid exposing Jimeng credentials to package installation processes; inject narrowly scoped credentials only when running the audited image-generation script.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (11)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: "Jimeng-Image"

description: "Use Python to send an image prompt to the Jimeng API and retrieve the generated image from the response when user says "generate image ..."
---

# Jimeng-Image

## When to use this skill

Use this skill when user express "You need generate a image".

## How to use this skill

1. You need putAccess Key and Secret Key via either environment variable: `Jimeng_Secret_Key` and  ` Jimeng_Access_Key=...`, or`~/.openclaw/.env` line: `Jimeng_Secret_Key=...` and ` Jimeng_Access_Key=...`   on your environment variable.

2. You need to  execute scripts/main.py
3. When the response is arrive,

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

**user**:

​	i need a image by prompt:"A girl in an anime style"

**You**:

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

**user**:

​	i need a image by prompt:"A girl in an anime style"

**You**:

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

**user**:

​	i need a image by prompt:"A girl in an anime style"

**You**:

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

**user**:

​	i need a image by prompt:"A girl in an anime style"

**You**:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill activates on broad, common image-request language like "generate image," which can cause unintended invocation in normal conversations. In an agent setting, vague triggers increase the chance that user input is routed to this skill without clear user awareness, causing accidental external API use and image generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does not clearly disclose that user prompts and API credentials are used to interact with an external Jimeng service. This creates a data-transparency and consent problem because users may not realize their content is being transmitted off-platform or that configured secrets are being used on their behalf.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill stores generated images under a persistent shared path in ~/.openclaw/workspace/images and instructs the agent to later send files from that location. In a multi-session or multi-user environment, persistent storage can expose prior outputs to unrelated sessions, causing data leakage or accidental cross-user file disclosure.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

1. You need putAccess Key and Secret Key via either environment variable: `Jimeng_Secret_Key` and  ` Jimeng_Access_Key=...`, or`~/.openclaw/.env` line: `Jimeng_Secret_Key=...` and ` Jimeng_Access_Key=...`   on your environment variable.

2. You need to  execute scripts/main.py
3. When the response is arrive, the script will save the png file on ~/.openclaw/workspace/images. (The script will create images dir if the images  dir is not exist)
4. Finally, you need send the new image to user by same channel,such as qqbot etc. from  ~/.openclaw/workspace/images

## Requirement

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends the user-supplied prompt to an external VisualService API and authenticates with environment-provided credentials, but it provides no explicit disclosure, consent flow, or indication that prompt contents leave the local environment. This creates a privacy and data-handling risk if users enter sensitive text, especially in an agent skill context where network exfiltration may not be obvious to the caller.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code returns user-facing status/error messages only in Chinese, such as prompting for a prompt value or missing environment variables. This imposes a specific language on all users without opt-in or any documented locale justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill creates the output directory if needed and writes a generated PNG file to the specified output path. The code does not include a confirmation prompt, print/log message, or explanatory comment/docstring informing the user that it will create directories and persist files locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.