Security audit

Qwen Comic Gen

Security checks across malware telemetry and agentic risk

Overview

The advertised image-generation skill works as described, but the package also includes a large unrelated personal workspace with credentials, memory files, hooks, and agent-behavior instructions.

Review this carefully before installing. The image-generation script itself is straightforward, but this package appears to include an entire personal OpenClaw workspace with credentials and unrelated automation. Prefer a repackaged version containing only SKILL.md and the image-generation script, and rotate any exposed credentials if they are real.

SkillSpector

By NVIDIA

SkillSpector could not complete.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: hooks/gateway-restart-protection/handler.js:57

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/autonomous-thinking.js:193

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/triple-line-sync.js:49

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: skills/send-html-to-feishu/scripts/run.js:41

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: skills/skill-vetting/scripts/scan.py:22

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/send-html-to-feishu/scripts/send-to-feishu.js:11

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: memory/2026-03-08.md:1773

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: memory/2026-03-14.md:55

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: reports/aliyun-embedding-analysis.md:12

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/debug-search-step.py:21

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/vectorize-and-store.py:19

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/vectorize-optimized.py:24

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: search_knowledge.py:22

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: skills/rag_search/TASK_COMPLETION_REPORT.md:178

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: skills/tts-automation/SKILL.md:96

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test_semantic_search.py:16

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test_vectorization.py:12

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-embedding-api.py:4

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-embedding-compare.py:16

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-vector-knowledge-flow.py:17

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: vector_query - 副本.py:22

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: vector_query.py:22

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: vectorize_all - 副本.py:27

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: vectorize_all.py:27

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: vectorize_content.py:25

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: vectorize_knowledge.py:27

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: skills/skill-vetting/references/patterns.md:108