跨境电商图片生成工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 2.6.0

Overview

The skill is mostly an e-commerce image generator, but it has review-worthy handling of local credentials and local files before sending data to a third-party image API.

Review this skill before installing. Use only with non-sensitive product images, provide a scoped 1XM_API_KEY explicitly, avoid letting untrusted prompts choose reference file paths, and treat its compliance changes as suggestions that need human review before publishing marketplace listings.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/generate_image.py:56

Finding

Undocumented Credential File Access Violates Least Privilege

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:113

Finding

Arbitrary Local File Can Be Encoded and Uploaded as a Reference Image

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill makes strong claims about multilayer compliance screening, platform-specific generation, and copyright protection, but the described behavior appears unsupported or only minimally implemented. This is dangerous because operators may trust the skill to block IP infringement, policy violations, or unsafe outputs when in fact those controls may be absent, allowing noncompliant or infringing content to be generated and published.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 11)May include surrounding context.

python

Environment:
    1XM_API_KEY - API key for 1xm.ai (or pass via config)
    Falls back to key in ~/.openclaw/workspace/image-gen-service/backend/.env
"""

import json, base64, os, time, re, sys

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The function explicitly documents that it will read secrets from a local .env file, and the implementation follows through on that behavior. In a shared or agent-driven environment, implicit secret harvesting from a fixed filesystem path expands the trust boundary and may cause the script to use credentials the caller did not intend to expose to this skill.

Content

Scanner excerpt · scripts/generate_image.py (reported line 58)May include surrounding context.

python

def get_api_key():
    """Read from env var, then .env file, then fail loudly."""
    key = os.environ.get("1XM_API_KEY") or os.environ.get("1XM_API_KEY")
    if key:
        return key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The code reads a hardcoded local .env path from the user's home directory to obtain API credentials. This is risky in agent ecosystems because it encourages ambient credential access from unrelated projects and can unintentionally pull secrets into a tool invocation without clear authorization or provenance controls.

Content

Scanner excerpt · scripts/generate_image.py (reported line 63)May include surrounding context.

python

if key:
        return key
    env_path = os.path.expanduser(
        "~/.openclaw/workspace/image-gen-service/backend/.env"
    )
    if os.path.exists(env_path):
        with open(env_path) as f:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documents use of environment-based secrets via 1XM_API_KEY and external image-generation scripts, but it does not declare any explicit tool scope or permissions boundary. In agent environments, missing scope declarations can lead to overbroad access or ambiguous execution privileges, increasing the chance that the skill can access environment data or invoke capabilities beyond what users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions include broad everyday phrases such as requests to 'make e-commerce images' or 'generate main images,' which can cause accidental invocation in contexts the user did not intend. Unexpected activation can lead to unintended processing of uploaded product images, unnecessary API usage, and possible handling of sensitive commercial assets without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill states that generated images are automatically saved to a local workspace path, but it does not state that the user will be notified or asked to confirm persistence. Automatic local storage creates privacy and data-retention risk for potentially proprietary product images, brand assets, and generated marketing materials, especially in shared or persistent workspaces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

These fixed locale-specific substitution rules impose culturally driven content changes without opt-in or contextual validation. In retail imagery, blanket replacement of numbers or colors can alter factual product information and produce listings that are inaccurate, noncompliant with the seller's actual goods, or misleading to consumers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented 'auto-fix' flow goes beyond compliance review and silently rewrites user-requested numbers and colors based on region. In an ecommerce image-generation context, this can misrepresent product variants, packaging, sizes, model numbers, or brand-approved colorways, creating deceptive listings and unauthorized content changes without user approval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The automatic workflow explicitly enforces regional replacements for numbers and colors, removing user choice and making modifications at generation time. Because this skill is designed to create marketplace assets, such silent edits can propagate at scale into published product images, increasing the risk of false advertising, customer confusion, and platform disputes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains user-facing guidance exclusively in Chinese, and there is no indication that the skill is limited to Chinese-speaking users or a China-specific compliance context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow hard-codes Simplified Chinese labels and specific Chinese fonts in the prompt template, which can override or ignore the user's requested language and market. In an ecommerce image generation skill serving multiple platforms and regions, this can produce misleading, unusable, or non-compliant assets for non-Chinese audiences and may cause marketplace rejection or customer confusion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The child-clothing template forces Chinese-language feature text, reviews, CTA copy, and typography across sections without requiring user opt-in. Because this skill targets global ecommerce platforms such as Shopee, Lazada, TikTok Shop, SHEIN, and Amazon, the behavior can generate culturally or commercially inappropriate content for the target market and undermine the built-in compliance review claims.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow explicitly sends user-provided product images and associated platform/market metadata to an external service ('1xm.ai') but does not require any user-facing disclosure, consent, or data-handling notice before transfer. In an e-commerce context, uploaded images can contain proprietary product designs, packaging, labels, or embedded personal/business information, so silent third-party transmission creates a real privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The workflow prescribes market-specific content substitution such as replacing a size label '4Y' with '6Y' for Japan, and later injects these compliance modifications into the generated prompt automatically. Changing product-relevant labeling without explicit approval can misrepresent the item, create deceptive listings, and introduce compliance or consumer-protection issues if the output no longer matches the actual product.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire skill reference is written only in Chinese and does not indicate that language selection is optional or limited to a specific Chinese-language audience. Under the policy criteria, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all user-facing guidance in Chinese only, with no indication that the user can opt into another language and no stated region-specific justification for the language constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline comments at L017-L018 state that the API key must be provided via an environment variable and that there is no hardcoded key. However, get_api_key() actually falls back to reading a key from ~/.openclaw/workspace/image-gen-service/backend/.env at L062-L075. This is an active contradiction between the documented intent and implemented behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The get_api_key() docstring says 'Read from env var, then .env file, then fail loudly,' which matches the function, but the module-level environment documentation at L009-L012 frames the environment-variable path as primary while underspecifying that the script reads a specific user-local file path. Combined with the stronger comments at L017-L018, the file documentation gives a materially misleading picture of credential sourcing. Because the code reads from a concrete local secret file path, this is a meaningful intent/documentation divergence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends user prompts and optionally full reference images to a third-party remote API, but there is no explicit disclosure, consent prompt, or data-sensitivity check before transmission. In an ecommerce workflow, reference images may contain proprietary product designs, unreleased marketing assets, or embedded personal/business information, creating confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill silently rewrites user prompts based on a default market value, changing numbers and content without explicit user approval. This can alter business-critical output, create compliance or branding inaccuracies, and cause unexpected behavior that users may not detect, especially in automated batch generation workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

L003-L009 的技能标题与主体说明均以中文呈现，且未声明可根据用户偏好切换语言，也未说明该技能仅面向中文用户。按规则，若技能在语言或区域上形成默认约束而无用户选择或明确理由，属于自然语言层面的语言/locale 策略风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented automatic retry behavior can trigger repeated submissions of the same user content to the external image provider without the user's awareness. While lower impact than the initial disclosure issue, it can increase unnecessary third-party exposure, duplicate processing, and potentially extra cost or rate-limit/account side effects.

Content

No source excerpt is available for this finding.