critical
suspicious.env_credential_access
- Location
- aigc-claw/frontend/lib/workflowApi.ts:10
- Finding
- Environment variable access combined with network send.
aigc-director
AdvisoryAudited by Static analysis on May 10, 2026.
Overview
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification
Findings (15)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
OpenAI, Gemini, DashScope, Volc/Kling, or other provider keys could be exposed in chat logs, agent context, or debugging output.
Why it was flagged
The required pre-flight check would print API-key lines from the user's .env file into the agent/session context instead of only checking whether keys are configured; registry metadata also declares no required env vars or primary credential.
Skill content
cat aigc-claw/backend/.env | grep -E "API_KEY|KEY"
Recommendation
Replace this with a redacted presence check, declare the expected credentials, and never display full secret values to the agent or user.
What this means
If real provider keys are embedded in the package, they could grant unintended account access or incur usage costs for whoever owns those keys.
Why it was flagged
The static scan reports possible hardcoded API secret literals here and in multiple other provider clients; the snippets are redacted, so the exact value should be manually verified.
Skill content
self._official_client = OpenAI(api_key=[REDACTED], **kwargs)
Recommendation
Inspect all redacted secret findings, remove any literal credentials from source, rotate exposed keys, and load credentials only from user-controlled environment variables or secret storage.
What this means
Other devices or web pages on the same network could potentially call workflow APIs, consume model credits, alter sessions, or fetch generated files if the service is reachable.
Why it was flagged
The backend enables broad cross-origin access and statically serves the whole CODE_DIR; combined with the skill's instruction to share a local IPv4 URL, the local tool may be reachable beyond the user's own browser.
Skill content
allow_origins=["*"],
allow_credentials=True,
allow_methods=["*"],
allow_headers=["*"],
...
app.mount("/code", StaticFiles(directory=settings.CODE_DIR), name="code")Recommendation
Bind to 127.0.0.1 by default, add authentication for workflow APIs, restrict CORS to the frontend origin, and statically serve only the specific generated-media directory needed by the UI.
What this means
Private ideas, prompts, generated media metadata, and workflow state may remain on disk and could be exposed through the local web service if access is not restricted.
Why it was flagged
Session state and artifact metadata are persisted under backend/code; api_server.py mounts settings.CODE_DIR at /code, so persisted session data may sit inside a statically served tree.
Skill content
会话状态和产物元数据存储在 `aigc-claw/backend/code/data/sessions/` 目录下
Recommendation
Store session state outside the static web root, document retention and cleanup, and require authentication before serving session metadata or generated private assets.
What this means
A network attacker could tamper with downloaded media or responses used in the video workflow.
Why it was flagged
The static scan shows HTTPS certificate verification disabled during image processing or download, which is not required by the stated purpose.
Skill content
verify=False,
Recommendation
Remove verify=False, validate certificates by default, and only allow an explicit documented override for controlled troubleshooting.
What this means
Dependency installation can run third-party code on the user's machine if the manifests or packages are compromised.
Why it was flagged
The local app requires user-directed Python and npm dependency installation; this is normal for the project, but the registry lists the source as unknown and there is no install spec.
Skill content
pip install -r requirements.txt ... npm install
Recommendation
Install in an isolated virtual environment, review dependency manifests and lockfiles, and prefer a known source/provenance before running the services.
Findings (15)
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/core/agents/character_agent.py:396
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/core/agents/reference_agent.py:462
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/image_client.py:40
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/image_dashscope.py:144
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/image_gpt.py:47
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/llm_client.py:26
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/llm_gemini.py:101
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/llm_gpt.py:77
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/video_client.py:45
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/video_wan.py:118
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/vlm_client.py:25
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/vlm_dashscope.py:23
- Finding
- File appears to expose a hardcoded API secret or token.
critical
suspicious.exposed_secret_literal
- Location
- aigc-claw/backend/tool/vlm_gemini.py:128
- Finding
- File appears to expose a hardcoded API secret or token.
warn
suspicious.insecure_tls_verification
- Location
- aigc-claw/backend/tool/image_processor.py:182
- Finding
- HTTPS certificate verification is disabled.