ClawHub
Back to skill

Security audit

minds-eye

Security checks for vulnerabilities and agentic risk

Overview

This visual-memory skill is mostly coherent, but it needs Review because it persists untrusted visual/page content into agent-readable memory and captures arbitrary URLs without network safety bounds.

Install only if you are comfortable with images and captured webpages being sent to the configured vision provider and stored under ~/.multimodal-memory. Avoid using it on private dashboards, authenticated pages, intranet URLs, localhost, cloud metadata addresses, credentials, or sensitive screenshots. Review or patch URL restrictions, remove the --no-sandbox fallback, pin dependencies, and treat memory.md as untrusted data before enabling automatic session-start loading.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T02 · Agent Memory Poisoning

Error
Location
scripts/store.py:58
Finding

Persistent Agent Memory Poisoning Through Untrusted Markdown Content

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/capture_url.py:23
Finding

Unrestricted URL Capture Permits Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/capture_url.py:48
Finding

Chromium Fallback Renders Untrusted Pages With the Browser Sandbox Disabled

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Playwright and Browser Installation Creates Supply-Chain Exposure

Content
View full analysis
=1.40.0 ``` `SKILL.md:98-101`: ```markdown If `capture_url.py` fails: ```bash pip install playwright && python -m playwright install chromium ``` ``` ### Technical Analysis The dependency specification permits any Playwright version from 1.40.0 onward. No upper bound, lock file, package hash, or artifact integrity policy is provided. The setup instructions also invoke Playwright's browser installer, which downloads and installs an executable Chromium build. This makes installation non-reproducible: the effective package and browser versions can change after the skill has been reviewed. A compromised upstream release, compromised distribution channel, or unexpectedly incompatible future release could execute code during installation or introduce vulnerable browser behavior. No evidence was found that the current `playwright` package name is typosquatted or intentionally malicious. The issue is the absence of version and integrity controls around executable dependencies. ### Attack Path 1. A user follows the documented setup command or installs from `requirements.txt`. 2. The package resolver selects the newest version satisfying `playwright>=1.40.0`. 3. Playwright's installer downloads a Chromium artifact selected by that package version. 4. If an upstream package or browser artifact is compromised, or if an unsafe future release is selected, code executes or is installed in the Agent environment. 5. The affected browser is subsequently used to process attacker-controlled websites. ### Impact Assessment A malicious package installation script executes with the privileges of the account running `pip`. A compromised browser artifact later runs with the Agent account's privileges when URL c ...[truncated 282 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (19)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to send image content to GPT-4o via API for analysis, but it does not disclose that user images and captured website screenshots will be transmitted to an external service. This is dangerous because screenshots and images can contain sensitive personal, corporate, or credential-bearing information, and users are not given an informed choice before exfiltration occurs.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The documented credential resolution behavior includes harvesting API keys from global OpenClaw config and .env sources, which is broader than necessary for a narrow-purpose skill. Even if only used for API calls here, secret discovery from shared locations is dangerous because it grants the skill access to credentials outside its immediate scope.

Content

Scanner excerpt · scripts/analyze.py (reported line 40)May include surrounding context.

python
1. openclaw.json imageModel -> find matching provider
    2. openclaw.json first provider that has an apiKey
    3. OPENAI_API_KEY env var -> standard OpenAI endpoint
    4. ~/.openclaw/.env OPENAI_API_KEY
    """
    cfg = load_openclaw_config()

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Reading OPENAI_API_KEY from the environment and then falling back to a user-wide .env file gives the skill access to secrets without explicit scoping to this tool invocation. In an adversarial or compromised skill scenario, this pattern materially increases the chance of secret misuse because the code is permitted to retrieve credentials on its own.

Content

Scanner excerpt · scripts/analyze.py (reported line 70)May include surrounding context.

python
if key:
            return key, base_url, model_name

    # Fall back to environment / .env file
    key = os.environ.get("OPENAI_API_KEY", "")
    if not key:
        env_file = Path.home() / ".openclaw" / ".env"

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The code directly opens and parses ~/.openclaw/.env to extract OPENAI_API_KEY, which is explicit credential access from a shared secrets file. That is dangerous because it normalizes secret scraping by the skill and bypasses stronger separation between the skill's purpose and the user's broader stored credentials.

Content

Scanner excerpt · scripts/analyze.py (reported line 73)May include surrounding context.

python
# Fall back to environment / .env file
    key = os.environ.get("OPENAI_API_KEY", "")
    if not key:
        env_file = Path.home() / ".openclaw" / ".env"
        if env_file.exists():
            for line in env_file.read_text().splitlines():
                line = line.strip()

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/analyze.py (reported line 172)May include surrounding context.

python
api_key, base_url, model = resolve_api_config()
    if not api_key:
        print("ERROR: No API key found. Add OPENAI_API_KEY to ~/.openclaw/.env or configure a provider in openclaw.json.", file=sys.stderr)
        sys.exit(1)

    print(f"Analyzing {args.image_path} with {model} via {base_url} ...")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that website screenshots are captured and analyzed with GPT-4o or a compatible vision model, which implies that captured webpage content and images may be sent to an external API provider. Without an explicit disclosure, users may unknowingly transmit sensitive webpage content, including authenticated pages or proprietary internal information, to third-party model services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that website screenshots are captured and analyzed with GPT-4o or a compatible vision model, which implies that captured webpage content and images may be sent to an external API provider. Without an explicit disclosure, users may unknowingly transmit sensitive webpage content, including authenticated pages or proprietary internal information, to third-party model services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes local Python scripts, reads and writes files under the user's home directory, captures websites, and sends data over the network, but it declares no explicit tool scope or permission boundaries. That creates an overbroad execution surface where an agent may use sensitive capabilities without clear policy constraints or user awareness, increasing the risk of unintended file access, persistence, and outbound data transfer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs persistent storage of images, screenshots, and metadata in a fixed directory under the user's home folder, but it does not clearly warn the user that this data will be retained across conversations. This can lead to accidental long-term storage of sensitive visual content, URLs, and derived metadata that the user may have expected to be ephemeral.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction tells the agent to ask the user a fallback question in Chinese, regardless of the user's current language or locale. This is a natural-language policy issue because it imposes a specific language choice without offering an alternative or checking user preference.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill reads global OpenClaw provider configuration and API credentials from ~/.openclaw/openclaw.json, environment variables, and ~/.openclaw/.env, extending its access beyond the narrow visual-memory function described in the manifest. In this context, that broad credential discovery capability is risky because it allows the skill to leverage unrelated global secrets and arbitrary provider endpoints, increasing the blast radius if the skill is modified or misused.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The code supports transmitting image content to an external model endpoint selected from provider configuration, which means potentially sensitive visual data leaves the local environment. In a memory skill handling screenshots, charts, and website captures, this is security-relevant because such images may contain secrets, personal data, or internal UI details.

Content

Scanner excerpt · scripts/analyze.py (reported line 59)May include surrounding context.

python
if provider_name and provider_name in providers:
        p = providers[provider_name]
        key = p.get("apiKey", "")
        base_url = p.get("baseUrl", "https://api.openai.com/v1")
        if key:
            return key, base_url, model_name

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

By iterating over any configured provider with an API key, the skill may send image data to a provider not specifically intended for this action. That expands external transmission risk because the selected endpoint may be less trusted or unrelated to the user's expectations.

Content

Scanner excerpt · scripts/analyze.py (reported line 66)May include surrounding context.

python
# Try any provider that has an apiKey
    for p in providers.values():
        key = p.get("apiKey", "")
        base_url = p.get("baseUrl", "https://api.openai.com/v1")
        if key:
            return key, base_url, model_name

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The default return path hardcodes an external OpenAI endpoint, enabling outbound transfer whenever an API key is found. For a skill that remembers visual content, automatic transmission to a third party is sensitive because images can contain credentials, PII, or confidential business information.

Content

Scanner excerpt · scripts/analyze.py (reported line 80)May include surrounding context.

python
if line.startswith("OPENAI_API_KEY="):
                    key = line.split("=", 1)[1].strip().strip('"').strip("'")
                    break
    return key, "https://api.openai.com/v1", model_name


def analyze_with_gpt4o(image_path: str, source: str, api_key: str,

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The analysis function is explicitly designed to send the full image as base64 to a remote /chat/completions endpoint. This is a true data-exposure concern in context because the skill's purpose is to process user-supplied visual material that may include secrets or proprietary information.

Content

Scanner excerpt · scripts/analyze.py (reported line 84)May include surrounding context.

python
def analyze_with_gpt4o(image_path: str, source: str, api_key: str,
                        base_url: str = "https://api.openai.com/v1",
                        model: str = "gpt-4o") -> dict:
    import urllib.request
    import urllib.error

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language prompt instructs the model to produce the description 'in the same language as any text in the image, default Chinese if ambiguous.' This imposes a specific language choice without user opt-in, which matches the locale/language policy violation category.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze.py (reported line 192)May include surrounding context.

python
if args.url:
        store_cmd += ["--url", args.url]

    subprocess.run(store_cmd, check=True)

    if result["raw_text"]:
        print(f"  Detected text: {result['raw_text'][:300]}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
84% confidence
Finding

The script accepts a user-controlled URL and launches a real browser to fetch and render it, which creates server-side request forgery style behavior: an attacker can cause the host running the skill to make network requests to arbitrary destinations, including internal services. In the Chrome fallback, the browser is started with --no-sandbox, which weakens process isolation and increases the severity if malicious web content exploits a browser vulnerability during rendering.

Content

Scanner excerpt · scripts/capture_url.py (reported line 48)May include surrounding context.

python
if not chrome:
        raise FileNotFoundError("Chrome/Chromium not found.")

    subprocess.run(
        [
            chrome,
            "--headless",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified with a lower-bound only (playwright>=1.40.0), which allows installation of any newer version, including unreviewed major releases that may introduce breaking changes or supply-chain risk. In a skill that captures and recalls web and visual content, Playwright is a powerful browser automation library, so unexpected dependency drift could materially change runtime behavior or expose the system to newly introduced vulnerabilities.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
playwright>=1.40.0