Volcengine Doubao Image Gen

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:06 AM UTC
• Version: 1.1.0

Overview

The skill mostly does what it says, but its video script reads a shared workspace .env file and imports all secrets, while downloads and network permissions are broader than clearly declared.

Review this before installing. It needs your Volcengine ARK_API_KEY and will make external API calls that may incur cost. The main risk is that the video script silently reads a shared workspace .env file and imports all secrets, so avoid using it in workspaces where that file contains unrelated credentials. Also prefer explicit filenames in a controlled output directory and be aware that returned media URLs are downloaded without host allowlisting or size limits.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/generate_video.py:28

Finding

Video Script Loads Unrelated Secrets from a Fixed Workspace Environment File

Content

View full analysis

None: env_path = Path(path) if not env_path.exists(): return for line in env_path.read_text(encoding="utf-8", errors="ignore").splitlines(): line = line.strip() if not line or line.startswith("#") or "=" not in line: continue key, value = line.split("=", 1) os.environ.setdefault(key.strip(), value.strip()) ``` The function is automatically invoked against a fixed, privileged workspace path: ```python def main() -> None: load_env_file("/root/.openclaw/workspace/.env") ``` ### Technical Analysis The video-generation script automatically reads `/root/.openclaw/workspace/.env` and imports every key-value pair into its process environment. The declared functionality requires only `ARK_API_KEY`, with optional model configuration through `DOUBAO_VIDEO_MODEL`. Loading all variables from a shared workspace environment file violates least-privilege principles. Unrelated credentials, service tokens, database passwords, or other secrets stored in that file become available to the script and all imported Python components, including the third-party Volcengine SDK. The behavior is not documented in `SKILL.md`, which instructs users to provide `ARK_API_KEY` through the environment. No direct transmission of unrelated environment variables was identified in the reviewed source code, but unnecessarily placing them in the process environment increases their exposure to dependencies, diagnostics, exception handlers, and future code changes. ### Attack Path 1. A user invokes `scripts/generate_video.py`. 2. Before parsing arguments or validating the required credential, the script opens `/root/.openclaw/workspace/.env`. 3. Every syntactically valid entry is inserte ...[truncated 780 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:107

Finding

Image Downloads Trust Response-Controlled HTTPS Hosts and Read Unbounded Responses

Content

View full analysis

str: parsed = urlparse(url) if parsed.scheme != "https": raise ValueError(f"Unsupported image URL scheme: {parsed.scheme or 'empty'}") if not parsed.netloc: raise ValueError("Image URL is missing host") return url def download_image(url: str, filepath: str) -> None: safe_url = validate_download_url(url) safe_path = ensure_safe_output_path(filepath) request = Request(safe_url, headers={"User-Agent": "OpenClaw-DoubaoImageGen/1.0"}) with urlopen(request, timeout=60) as response: content_type = (response.headers.get("Content-Type") or "").lower() if not content_type.startswith("image/"): raise ValueError(f"Downloaded content is not an image: {content_type or 'unknown'}") with open(safe_path, "wb") as f: f.write(response.read()) print(f"✓ Image saved to: {safe_path}") ``` The URL is taken from the remote API response: ```python if "data" in result and len(result["data"]) > 0: for idx, item in enumerate(result["data"]): image_url = item.get("url") if image_url: if len(result["data"]) > 1 and not args.filename: output_file = generate_filename(args.prompt, idx + 1) elif len(result["data"]) > 1 and args.filename: root, ext = os.path.splitext(filename) safe_root = ensure_safe_output_path(root) output_file = f"{safe_root}-{idx + 1}{ext or '.png'}" else: output_file = filename download_image(image_url, output_file) ``` ### Technical Analysis The validation checks only that the URL uses HTTPS and contains a network location. It does not restrict the hos ...[truncated 2094 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_video.py:66

Finding

Video Downloads Trust Response-Controlled HTTPS Hosts and Read Unbounded Responses

Content

View full analysis

str: parsed = urlparse(url) if parsed.scheme != "https": raise ValueError(f"Unsupported video URL scheme: {parsed.scheme or 'empty'}") if not parsed.netloc: raise ValueError("Video URL is missing host") return url ``` ```python def download_video(url: str, filepath: str) -> None: safe_url = validate_download_url(url) safe_path = ensure_safe_output_path(filepath) request = Request(safe_url, headers={"User-Agent": "OpenClaw-SeedanceVideo/1.0"}) with urlopen(request, timeout=180) as response: content_type = (response.headers.get("Content-Type") or "").lower() if not content_type.startswith("video/"): raise ValueError(f"Downloaded content is not a video: {content_type or 'unknown'}") Path(safe_path).write_bytes(response.read()) print(f"✓ Video saved to: {safe_path}") ``` The download URL is obtained from the remote task response: ```python if current.status == "succeeded": video_url = current.content.video_url if current.content else None if not video_url: print("Error: task succeeded but no video_url returned") sys.exit(1) download_video(video_url, output_file) ``` ### Technical Analysis The video downloader accepts any URL with an HTTPS scheme and a nonempty host. It does not enforce an approved media-host allowlist, validate redirect destinations, reject private or link-local networks, or bound the amount of downloaded data. The value originates in a task-status response obtained through the Volcengine SDK. If that response or upstream service is compromised, the process can be directed to an unintended HTTPS destination. The content-type check is performed only afte ...[truncated 1503 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

该代码块的主要行为与“豆包图片生成”一致：读取 ARK_API_KEY，向火山引擎的 /api/v3/images/generations 发起请求，接收图片 URL，并校验后下载为本地图片文件。它还支持参考图、多图顺序生成、模型别名和文件名/path 安全处理。这些都属于已声明的图像生成功能范围内。 但声明中明确包含“视频生成”“Seedance 文生视频”，而代码没有任何视频生成专用接口、视频响应处理、视频文件下载或媒体类型处理逻辑。即使模型列表中包含一个 Seedance 模型名，实际请求仍发往图像生成接口，且下载函数强制要求 Content-Type 以 image/ 开头，因此不能认为真正支持视频生成。故存在描述与实际能力不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk’s primary function is accurately aligned with the video-generation portion of the description: it uses the Volcengine/Ark API to create a video generation task, waits for completion, and saves an MP4 locally. However, the declared purpose explicitly claims both image and video generation, including Seedream image features, while this code implements only video generation. That is a material description-versus-behavior mismatch for this supplied code chunk. The local file download and environment variable loading are supporting implementation details and not mismatches by themselves.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 96)May include surrounding context.

python

def main() -> None:
    load_env_file("/root/.openclaw/workspace/.env")

    parser = argparse.ArgumentParser(description="豆包视频生成 - 使用火山方舟 Seedance 生成视频")
    parser.add_argument("--prompt", "-p", required=True, help="视频描述/提示词")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.py (reported line 114)May include surrounding context.

python

def main() -> None:
    load_env_file("/root/.openclaw/workspace/.env")

    parser = argparse.ArgumentParser(description="豆包视频生成 - 使用火山方舟 Seedance 生成视频")
    parser.add_argument("--prompt", "-p", required=True, help="视频描述/提示词")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 77% confidence

Finding

The skill documentation describes use of environment variables, local file output, and network access, but it does not declare any tool scope or allowed-tools boundaries. Without explicit permission scoping, an agent runtime may grant broader capabilities than intended, increasing the chance of over-privileged execution or misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad everyday phrases like '生成图片' and '生成视频', which can cause accidental invocation in unrelated conversations. Because this skill uses network access, API credentials, and file output, false activation can lead to unintended external requests, cost-incurring API usage, and creation of local artifacts without clear user intent.

Content

No source excerpt is available for this finding.

Scope Creep

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest exposes video generation through the description and the generate:video script, and also defines a video model variable at L38-L42. Yet the only declared outbound permission purpose at L53 says it is for calling the image generation API, so the permission declaration is narrower than the actual stated functionality and does not fully cover video API use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring and CLI description state that the script generates images, yet the supported model list includes 'doubao-seedance-1-5-pro-251215', described as a video model. That documentation does not merely omit detail; it conflicts with the code's acceptance of a video-model identifier, creating misleading intent documentation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes both image and short-video generation via Seedream and Seedance, but this file's CLI, API endpoint, response handling, and downloader are all specific to images. There is no code path here that generates or saves video output, so the behavior implemented by this script is narrower than the declared skill description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The package description at L04 and scripts at L17-L18 clearly indicate both image and video generation capabilities. However, the required secret ARK_API_KEY is documented at L24 as being used only for the image generation API, which mismatches the broader behavior and could mislead operators about what the credential enables.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s docstring and command-line descriptions are written in Chinese, and the script later continues using Chinese user-facing help text and status messages. This imposes a specific language/locale on users without any opt-in or alternative, which matches the language-policy concern for natural-language policy violations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.