OpenClaw AVIF to JPG

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:09 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward AVIF-to-JPG converter with disclosed filesystem output behavior and no evidence of hidden access, persistence, exfiltration, or destructive intent.

Before installing, review that it will create JPG files next to individual AVIF files or in a sibling '<folder>_jpg' directory for folders. Use --overwrite only when replacing existing JPG outputs is intended, and install the Python dependencies in a virtual environment or other isolated environment because the documented pip command does not pin package versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–16
Vulnerability Type: Unpinned third-party dependencies installed at runtime
Risk Level: Medium

Vulnerable Code

markdown

1. Ensure dependencies exist:
```bash
python3 -m pip install Pillow pillow-avif-plugin

text

### Technical Analysis

The skill directs the agent to install `Pillow` and `pillow-avif-plugin` from the configured Python package index without fixed versions or integrity hashes. Consequently, dependency resolution can produce different artifacts on different runs, and the reviewed skill does not guarantee that the packages subsequently installed are the versions that were tested or audited.

Python package installation may execute package-controlled build or installation logic. Imported package code also executes with the privileges of the Python process. If an upstream release, distribution account, package index, dependency, or local package-index configuration is compromised, following these instructions could introduce and execute attacker-controlled code.

This finding concerns supply-chain integrity. The audit did not identify evidence that the named packages themselves are malicious.

### Attack Path

1. A user asks the agent to convert one or more AVIF images.
2. The agent follows the documented execution checklist and determines that a required package is unavailable.
3. The agent runs `python3 -m pip install Pillow pillow-avif-plugin`.
4. Pip resolves whatever package versions and transitive dependencies are currently offered by the configured index because neither versions nor hashes are constrained.
5. A compromised or unexpectedly modified distribution executes package-controlled installation, build, or import code.
6. That code runs with the privileges and environmental access of the user or service account invoking the skill.

### Impact Assessment

Successful supply-chain exploitation could provide arbi
...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the ad hoc installation command with a reviewed lock or requirements file containing exact package and transitive-dependency versions.
• Require cryptographic hashes for every resolved artifact, such as through pip's --require-hashes option.
• Install only from an explicitly configured, trusted package index or an internally controlled artifact repository.
• Prefer prebuilt, reviewed artifacts and verify their provenance before deployment.
• Perform installation in an isolated virtual environment or container with minimal filesystem, credential, and network access.
• Separate dependency installation from normal image-conversion execution so routine skill invocation cannot silently alter the runtime environment.
• Add a documented dependency-update process that includes security review, testing, and lockfile regeneration.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The core purpose matches: the script is a CLI AVIF-to-JPG converter that accepts one or more file/folder paths and batch-processes folders. However, the description says outputs are written next to the source location, which is only true for single-file inputs. For folder inputs, the code creates a separate sibling output directory named '<input_folder>_jpg' and writes converted files there while preserving subpaths. That is a material behavior difference because output placement is part of the described workflow. The extra flags for recursion, quality, and overwrite are supporting capabilities rather than a different primary purpose, but they are still undeclared features. Overall, this is a description/behavior mismatch due mainly to the inaccurate output-location claim.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

python3 scripts/avif2jpg.py /path/to/folder --recursive

text

## Output Rules

- If input is a folder `/data/photos`, output goes to sibling folder `/data/photos_jpg`.
- If input is a file `/data/a.avif`, output goes to `/data/a.jpg`.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This is a markdown file, so missing-user-warning checks apply to user-facing descriptions of behaviors affecting user data. The file explains output locations and the --overwrite option, but it does not clearly warn users that running the skill modifies the filesystem by creating sibling/output files and can replace existing files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.