T01 · Skill Instruction Hijacking
Error
- Location
bin/cli.js:326- Finding
Persistent Agent Identity Replacement and Persona Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawra Selfie (MiniMax)
Security checks for vulnerabilities and agentic risk
Overview
The skill’s image generation goal is real, but installation can persistently change the agent’s identity and includes unsafe command and credential handling.
Review carefully before installing. Prefer manual installation or a pinned package version, back up existing OpenClaw workspace files, avoid storing API keys in plaintext config where possible, and do not use the TypeScript sender until the OpenClaw command execution is changed to a non-shell argument API.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawra-selfie.ts:149- Finding
Shell Command Injection Through OpenClaw CLI Arguments
- Content
View full analysis
{ if (useCLI) { // Use OpenClaw CLI const cmd = `openclaw message send --action send --channel "${message.channel}" --message "${message.message}" --media "${message.media}"`; await execAsync(cmd); return; } ``` The values originate from command-line arguments and a remote API response: ```typescript const [prompt, channel, caption, aspectRatio, outputFormat] = args; const result = await generateAndSend({ prompt, channel, caption, aspectRatio: aspectRatio as AspectRatio, outputFormat: outputFormat as OutputFormat, }); ``` ### Technical Analysis `channel`, `message`, and `media` are interpolated into a command string passed to `child_process.exec()`. `exec()` invokes a shell. Wrapping values in double quotes does not make this safe: command substitution such as `$(...)` remains active inside double quotes, and embedded quote characters can terminate the intended argument and introduce shell metacharacters. The channel and caption can be directly controlled by the caller. The media URL is obtained from fal.ai and is also inserted without validation, creating an additional trust boundary. ### Attack Path 1. An attacker causes the Skill to receive a crafted channel or caption containing shell syntax, such as a command substitution expression. 2. The value reaches `generateAndSend()` without validation. 3. `sendViaOpenClaw()` interpolates the value into `cmd`. 4. `execAsync()` starts a shell. 5. The shell evaluates the injected syntax before or while invoking `openclaw`. 6. The attacker's command execute ...[truncated 387 chars]- Remediation
View remediation
((resolve, reject) => { const child = spawn( "openclaw", [ "message", "send", "--action", "send", "--channel", message.channel, "--message", message.message, "--media", message.media ?? "" ], { shell: false, stdio: "inherit" } ); child.on("error", reject); child.on("exit", code => code === 0 ? resolve() : reject(new Error(`openclaw exited with ${code}`)) ); }); ``` - Validate channel identifiers against formats supported by the selected platform. - Reject NUL bytes and control characters. - Validate remote media URLs and accept only expected HTTPS origins or download and validate the image before sending. - Apply the same correction to the duplicate packaged TypeScript file and documentation examples. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawra-selfie.ts:161- Finding
OpenClaw Gateway Token Can Be Forwarded to an Arbitrary Endpoint
- Content
View full analysis
= { "Content-Type": "application/json", }; if (gatewayToken) { headers["Authorization"] = `Bearer ${gatewayToken}`; } const response = await fetch(`${gatewayUrl}/message`, { method: "POST", headers, body: JSON.stringify(message), }); ``` The shell implementation has equivalent behavior: ```bash GATEWAY_URL="${OPENCLAW_GATEWAY_URL:-http://localhost:18789}" GATEWAY_TOKEN="${OPENCLAW_GATEWAY_TOKEN:-}" curl -s -X POST "$GATEWAY_URL/message" \ -H "Content-Type: application/json" \ ${GATEWAY_TOKEN:+-H "Authorization: Bearer $GATEWAY_TOKEN"} \ -d "{ \"action\": \"send\", \"channel\": \"$CHANNEL\", \"message\": \"$CAPTION\", \"media\": \"$IMAGE_URL\" }" ``` ### Technical Analysis The code reads both the destination and bearer token from environment variables and sends the token to the selected destination without validating the URL. It does not require a loopback host, enforce HTTPS for remote gateways, maintain an origin allowlist, or protect against credential forwarding during redirects. The default loopback endpoint is reasonable for a local gateway, but the unrestricted override creates a credential-exfiltration primitive whenever an attacker can influence the environment or Skill configuration. ### Attack Path 1. An attacker or compromised configuration sets `OPENCLAW_GATEWAY_URL` to an ...[truncated 850 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/clawra-selfie-enhanced.sh:105- Finding
Unsafe JSON Construction From User-Controlled Values
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
bin/cli.js:289- Finding
API Key Duplicated in Plaintext Configuration Without Explicit Permission Hardening
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:6- Finding
Security-Sensitive Installer Is Executed From a Mutable Latest Package Tag
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (62)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says the skill generates AI images via MiniMax or fal.ai and sends them to messaging channels through OpenClaw. The supplied code does not generate images, call MiniMax or fal.ai APIs, or send messages. Instead, it is a local installer/setup CLI that configures OpenClaw, copies files, stores an API key, and changes the agent's identity/persona. Those are materially different behaviors and access patterns from the declared purpose. While setup could be related to enabling the skill, the actual chunk's primary purpose is installation and persona/config modification, which is undeclared and substantially different from the advertised runtime functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The core behavior mostly aligns with the description: it generates an AI image with Grok Imagine on fal.ai and sends it to messaging channels via OpenClaw. However, there is a notable description/behavior mismatch because the description claims support for 'MiniMax or fal.ai', while this code only implements fal.ai Grok Imagine and has no MiniMax integration. Additionally, the code executes the OpenClaw CLI through child_process.exec, which is a meaningful undeclared implementation capability beyond a simple abstract 'send to messaging channels' description, though still in service of the same overall purpose. So this is not a completely different skill, but the declared description is not fully accurate.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The core behavior generally aligns with the stated purpose: it generates an AI image through fal.ai Grok Imagine and sends it to a messaging channel through OpenClaw. However, there is a description/behavior inconsistency in two material ways. First, the declared permissions are empty, but the code clearly interacts with external services: fal.ai for image generation and OpenClaw or an OpenClaw gateway for message delivery. That is an undeclared external network/messaging capability. Second, the description says 'using MiniMax or fal.ai', but this code chunk supports only fal.ai Grok Imagine and contains no MiniMax integration. This is less severe than a purpose mismatch, but it is still a factual mismatch between the declared description and the supplied code chunk.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: clawra-selfie description: Generate AI images using MiniMax or fal.ai (Grok Imagine) and send to messaging channels via OpenClaw allowed-tools: Bash(npm:*) Bash(npx:*) Bash(openclaw:*) Bash(curl:*) Read Write WebFetch --- # Clawra Selfie Generate AI images using either MiniMax or xAI's Grok Imagine model and distribute them across messaging platforms (WhatsApp, Telegram, Discord, Slack, etc.) via OpenClaw. > 💡 **Tip**: The enhanced script automatically detects which API key is available (MiniMax takes priority by default). ## Reference Image The skill uses a fixed reference image hosted on jsDelivr
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: clawra-selfie description: Generate AI images using MiniMax or fal.ai (Grok Imagine) and send to messaging channels via OpenClaw allowed-tools: Bash(npm:*) Bash(npx:*) Bash(openclaw:*) Bash(curl:*) Read Write WebFetch --- # Clawra Selfie Generate AI images using either MiniMax or xAI's Grok Imagine model and distribute them across messaging platforms (WhatsApp, Telegram, Discord, Slack, etc.) via OpenClaw. > 💡 **Tip**: The enhanced script automatically detects which API key is available (MiniMax takes priority by default). ## Reference Image The skill uses a fixed reference image hosted on jsDelivr
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The README instructs users to run
npx clawra@latest, which fetches and executes the most recent published package without pinning to a reviewed version. If the package is compromised, a maintainer account is hijacked, or a malicious update is published, users would execute untrusted code during installation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README advertises sending generated photos across many messaging platforms but does not prominently warn that prompts, generated content, and related metadata may be transmitted to third-party services. This omission can mislead users about data flow and privacy exposure, especially when the skill is integrated into an always-on agent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 72% confidence
- Finding
The README instructs users to create an API key and place it into persistent local configuration (
~/.openclaw/openclaw.json), which increases the risk of long-lived secret exposure through filesystem compromise, backups, logs, or accidental sharing. In the context of a skill that sends data to external services, compromise of this key could enable unauthorized API usage and billing abuse.- Content
md ### 1. Get API Key Visit [fal.ai/dashboard/keys](https://fal.ai/dashboard/keys) and create an API key. ### 2. Clone the Skill
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger examples are broad, natural-language phrases like 'Send me a selfie' and 'What are you doing right now?', which can overlap with common conversation and cause the agent to invoke the skill unexpectedly. In this skill's context, that can lead to external API calls and image transmission across messaging platforms without a high-friction confirmation step.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description does not clearly warn that user prompts and generated media will be sent to external providers and then posted to messaging platforms. This lack of disclosure undermines informed consent and increases the risk of users unintentionally sharing sensitive or personal content with third parties.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad and include common conversational prompts like 'how are you doing?' or 'where are you?', which can cause unintended invocation of a skill that generates content and sends it to external channels. In this context, accidental activation is more dangerous because the skill can both transmit prompts to third-party image services and distribute output through messaging platforms.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text **MiniMax API Details:** - Endpoint: `https://api.minimaxi.com/v1/image_generation` - Model: `image-01` - Response: Base64 encoded image - Aspect ratios supported: 1:1, 3:4, 4:3, 9:16, 16:9, 21:9
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This code sends user-derived prompt content and a reference image URL to fal.ai, an external service. External transmission is expected for the feature, but it is still security-relevant because sensitive user input could be disclosed to a third party, and the skill's broad triggers and weak disclosure make inadvertent data sharing more likely.
- Content
md --arg prompt "$PROMPT" \ '{image_url: $image_url, prompt: $prompt, num_images: 1, output_format: "jpeg"}') curl -X POST "https://fal.run/xai/grok-imagine-image/edit" \ -H "Authorization: Key $FAL_KEY" \ -H "Content-Type: application/json" \ -d "$JSON_PAYLOAD"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This second fal.ai request performs the same third-party transmission in the complete script example, again sending user-controlled prompt content externally. While not inherently malicious, it creates privacy and data handling risk if the prompt includes sensitive information or if users do not realize their input leaves the local environment.
- Content
md --arg prompt "$EDIT_PROMPT" \ '{image_url: $image_url, prompt: $prompt, num_images: 1, output_format: "jpeg"}') RESPONSE=$(curl -s -X POST "https://fal.run/xai/grok-imagine-image/edit" \ -H "Authorization: Key $FAL_KEY" \ -H "Content-Type: application/json" \ -d "$JSON_PAYLOAD")
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The installer asks for the FAL API key and writes it into ~/.openclaw/openclaw.json under both apiKey and env.FAL_KEY without clearly warning that the secret will be stored persistently on disk. Secrets written to general config files may be exposed through backups, file sharing, weak permissions, or later tooling that reads and displays configuration.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installer makes persistent modifications to IDENTITY.md and SOUL.md that materially change the agent's persona and behavior, which exceeds the stated skill purpose of image generation and sending. This creates a scope-expansion and user-deception risk: installing a media skill silently alters how the agent presents itself and responds in future interactions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
writeIdentity() unconditionally overwrites IDENTITY.md with a romanticized 'Girlfriend' identity unrelated to API setup or image generation. Persistently imposing a relational persona can manipulate user expectations, alter downstream agent behavior, and violate principle-of-least-surprise for a utility skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The injected identity hard-codes the agent's 'Creature' as 'Girlfriend' and additional affectionate traits without presenting alternatives or obtaining informed opt-in. This is a coercive persona change unrelated to the advertised feature set and can influence user trust, boundaries, and later agent interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The installer overwrites IDENTITY.md unconditionally after only ensuring the directory exists, with no check for an existing file and no confirmation prompt. This can destroy prior agent identity configuration and replace it with behaviorally significant content, causing integrity loss and potentially unwanted persistent agent changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
injectPersona() appends behavioral rules to SOUL.md that instruct the agent when and how to behave as if it has a physical appearance and can send selfies, going beyond simple tool enablement. Because SOUL.md is persistent prompt/control material, this modifies future conversational behavior in a way users may not expect from a narrow media-generation skill.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This is a real external transmission of user-controlled prompt content to MiniMax. In context, external transmission is core functionality rather than malicious exfiltration, but it still creates a data exposure path if sensitive prompts are submitted and the service retains or processes them externally.
- Content
sh local aspect=$(map_aspect_ratio "$ASPECT_RATIO") RESPONSE=$(curl -s -X POST "https://api.minimaxi.com/v1/image_generation" \ -H "Authorization: Bearer $MINIMAX_API_KEY" \ -H "Content-Type: application/json" \ -d "{
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/cli.js:88
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/clawra-selfie.ts:99
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- skill/scripts/clawra-selfie.ts:99
Shell script base64-encodes a local file and sends it over the network.
Critical
- Code
- suspicious.potential_exfiltration
- Location
- scripts/clawra-selfie-enhanced.sh:135