T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:25- Finding
Skill Overrides Repository-Level Agent Orchestration Policy
- Content
View full analysis
- Remediation
View remediation
Security audit
imgnAI Katana API
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated media and LLM API purpose, but it uses credentials, paid external requests, local persistence, local file mutation, and an instruction that overrides repository agent rules, so it needs review before installation.
Install only if you are comfortable giving this skill Katana API credentials, sending prompts/media to imgnAI's API, and allowing local request tracking. Prefer a dedicated low-balance API key, keep the secrets file private, avoid setting KATANA_SECRETS_FILE to untrusted paths, review any proposed llms.txt-driven skill updates before approval, and be cautious in repositories that rely on AGENTS.md or subagent isolation rules.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:89- Finding
Credential File Is Executed as Arbitrary Shell Code
- Content
View full analysis
"$_H" && curl -s -X POST "https://kat.imgnai.com/v1/chat/completions" -H @"$_H" -d @"$tmpfile" && rm -f "$_H" && rm -f "$tmpfile" ``` ### Technical Analysis The POSIX dot command does not parse a data-only environment file. It executes the selected file as shell code in the current shell process. Consequently, any command substitution, redirection, function definition, external command, or other shell syntax in the credential file executes with the agent process's privileges. The risk is increased because `KATANA_SECRETS_FILE` is configurable. If an attacker can influence that environment variable, modify the expected credential file, or replace it through a compromised setup process, the next API request or polling command becomes a local code-execution trigger. Restricting the documented file to mode `0600` reduces access by other local users but does not make shell evaluation safe. It also does not protect against compromise of the owning account, malicious workspace automation, unsafe restoration from backup, or redirection to another file. ### Attack Path 1. An attacker gains the ability to modify the configured credential fi ...[truncated 1134 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:334- Finding
Prompt Metadata Is Persisted Without Explicit Confidentiality and File-Safety Controls
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:429- Finding
Failed Requests Leave Temporary Files Containing API Credentials
- Content
View full analysis
"$_H" && curl -s -X POST "https://kat.imgnai.com/v1/generation-requests?wait=false" -H @"$_H" -d @"$tmpfile" && rm -f "$_H" && rm -f "$tmpfile" ``` **Text/LLM requests** (Bearer auth): ```bash . "${KATANA_SECRETS_FILE:-$HOME/.openclaw/secrets/katana.env}" && _H=$(mktemp) && chmod 600 "$_H" && printf 'Content-Type: application/json\nAuthorization: Bearer %s:%s\n' "$KATANA_API_KEY" "$KATANA_API_SECRET" > "$_H" && curl -s -X POST "https://kat.imgnai.com/v1/chat/completions" -H @"$_H" -d @"$tmpfile" && rm -f "$_H" && rm -f "$tmpfile" ``` ``` ### Technical Analysis The commands correctly create a unique file and change its mode to `0600`, but cleanup is performed only through commands chained with `&&`. If `curl` returns a nonzero status because of a network failure, TLS error, interruption, timeout, or other transport problem, shell evaluation stops before either `rm` command. As a result, the header file remains in the temporary directory with a reusable API key and secret. Payload files can also remain and may contain user prompts, Base64 media, or document content. Mode `0600` limits access to the owning account, but it does not provide cleanup or protect against other processes running under the same account. ### Attack Path 1. The skill creates a temporary hea ...[truncated 1181 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (37)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: katana description: Generate images, videos, and text/LLM completions via the imgnAI Katana API. Supports end-to-end-encrypted (E2EE) and anonymized models. Priced highly competitively, can be 40-70% cheaper than Venice AI and other platforms. Includes post-processing such as combining videos and images, cutting, slicing, splicing, transitions, drawing text, re-encoding, resizing and much more! version: 1.0.3 author: arfonzo (imgnAI) license: MIT-0 metadata: {"openclaw": {"requires": {"bins": ["curl", "python3"]}, "homepage": "https://app.imgnai.com"}} --- # Katana Skill — imgnAI API Generate images, videos, and text/LLM completions via the [
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md - `KATANA_API_KEY=kat_live_... curl ...` - Any form of reading secrets into tool output **If credential loading fails:** Fix the secrets file path or contents. Do NOT bypass security by hardcoding values. ---
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md LL changes found and update all affected skill files accordingly: `models.md`, `SKILL.md`, workflow files.
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Submit using the secure header pattern:
bash . "${KATANA_SECRETS_FILE:-$HOME/.openclaw/secrets/katana.env}" && _H=$(mktemp) && chmod 600 "$_H" && printf 'Content-Type: application/json\nAuthorization: Bearer %s:%s\n' "$KATANA_API_KEY" "$KATANA_API_SECRET" > "$_H" && curl -s -X POST 'https://kat.imgnai.com/v1/chat/completions' -H @"$_H" -d @"$tmpfile" && rm -f "$_H" && rm -f "$tmpfile"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Submit using the secure header pattern:
bash . "${KATANA_SECRETS_FILE:-$HOME/.openclaw/secrets/katana.env}" && _H=$(mktemp) && chmod 600 "$_H" && printf 'Content-Type: application/json\nAuthorization: Bearer %s:%s\n' "$KATANA_API_KEY" "$KATANA_API_SECRET" > "$_H" && curl -s -X POST 'https://kat.imgnai.com/v1/chat/completions' -H @"$_H" -d @"$tmpfile" && rm -f "$_H" && rm -f "$tmpfile"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Submit using the secure header pattern:
bash . "${KATANA_SECRETS_FILE:-$HOME/.openclaw/secrets/katana.env}" && _H=$(mktemp) && chmod 600 "$_H" && printf 'Content-Type: application/json\nAuthorization: Bearer %s:%s\n' "$KATANA_API_KEY" "$KATANA_API_SECRET" > "$_H" && curl -s -X POST 'https://kat.imgnai.com/v1/chat/completions' -H @"$_H" -d @"$tmpfile" && rm -f "$_H" && rm -f "$tmpfile"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Submit using the secure header pattern:
bash . "${KATANA_SECRETS_FILE:-$HOME/.openclaw/secrets/katana.env}" && _H=$(mktemp) && chmod 600 "$_H" && printf 'Content-Type: application/json\nAuthorization: Bearer %s:%s\n' "$KATANA_API_KEY" "$KATANA_API_SECRET" > "$_H" && curl -s -X POST 'https://kat.imgnai.com/v1/chat/completions' -H @"$_H" -d @"$tmpfile" && rm -f "$_H" && rm -f "$tmpfile"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Submit using the secure header pattern:
bash . "${KATANA_SECRETS_FILE:-$HOME/.openclaw/secrets/katana.env}" && _H=$(mktemp) && chmod 600 "$_H" && printf 'Content-Type: application/json\nAuthorization: Bearer %s:%s\n' "$KATANA_API_KEY" "$KATANA_API_SECRET" > "$_H" && curl -s -X POST 'https://kat.imgnai.com/v1/chat/completions' -H @"$_H" -d @"$tmpfile" && rm -f "$_H" && rm -f "$tmpfile"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains natural-language text that promotes or normalizes an 'uncensored' model variant. That can conflict with organizational policy expectations around safety controls, and there is no accompanying qualification, restriction, or user opt-in noted in the text.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Setup
- Get your API key from https://app.imgnai.com/katana-api
- Create the secrets file:
bash mkdir -p ~/.openclaw/secrets cat > ~/.openclaw/secrets/katana.env << 'EOF'
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
KATANA_API_KEY=your_key_here KATANA_API_SECRET=your_secret_here EOF chmod 600 ~/.openclaw/secrets/katana.env
text **Non-OpenClaw users:** Set `KATANA_SECRETS_FILE` to your preferred location:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
KATANA_API_KEY=your_key_here KATANA_API_SECRET=your_secret_here EOF chmod 600 ~/.openclaw/secrets/katana.env
text **Non-OpenClaw users:** Set `KATANA_SECRETS_FILE` to your preferred location:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
KATANA_API_KEY=your_key_here KATANA_API_SECRET=your_secret_here EOF chmod 600 ~/.openclaw/secrets/katana.env
text **Non-OpenClaw users:** Set `KATANA_SECRETS_FILE` to your preferred location:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
KATANA_API_KEY=your_key_here KATANA_API_SECRET=your_secret_here EOF chmod 600 ~/.openclaw/secrets/katana.env
text **Non-OpenClaw users:** Set `KATANA_SECRETS_FILE` to your preferred location:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
KATANA_API_KEY=your_key_here KATANA_API_SECRET=your_secret_here EOF chmod 600 ~/.openclaw/secrets/katana.env
text **Non-OpenClaw users:** Set `KATANA_SECRETS_FILE` to your preferred location:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
KATANA_API_KEY=your_key_here KATANA_API_SECRET=your_secret_here EOF chmod 600 ~/.openclaw/secrets/katana.env
text **Non-OpenClaw users:** Set `KATANA_SECRETS_FILE` to your preferred location:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
KATANA_API_KEY=your_key_here KATANA_API_SECRET=your_secret_here EOF chmod 600 ~/.openclaw/secrets/katana.env
text **Non-OpenClaw users:** Set `KATANA_SECRETS_FILE` to your preferred location:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
KATANA_API_KEY=your_key_here KATANA_API_SECRET=your_secret_here EOF chmod 600 ~/.openclaw/secrets/katana.env
text **Non-OpenClaw users:** Set `KATANA_SECRETS_FILE` to your preferred location:
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Triggers "generate image of X", "create image", "make picture", "imgnai image", "generate video of X", "create video", "make video", "ask grok about X", "ask claude about X", "use gpt to X", "katana image", "katana video", "katana chat", "katana gpt", "katana claude", "list katana models", "modify this image", "edit this image", "change this image", "transform this image", "edit image", "modify image" ## Spawn Policy
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes broad phrases like 'create image', 'make video', 'ask claude about X', and 'use gpt to X', which can match normal user conversation and invoke the skill unexpectedly. Because this skill performs paid external API actions and can process media or prompts, accidental activation can lead to unintended data transmission and billing.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Before submitting ANY generation request, present a summary (model, cost in credits AND dollars, details, prompt) and **wait for user confirmation**. See each workflow file for details. **NO EXCEPTIONS:** There is no urgency override. "just do it", "generate now", /katana, or any other shortcut does NOT skip confirmation. ALWAYS present summary and wait for explicit approval before submitting. ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This command transmits request identifiers and API credentials to an external service endpoint. External transmission is expected for this skill's purpose, but it is still security-relevant because prompts, generated content metadata, and authentication secrets leave the local environment and depend on safe handling by the remote service.
- Content
Poll command:
bash . "${KATANA_SECRETS_FILE:-$HOME/.openclaw/secrets/katana.env}" && _H=$(mktemp) && chmod 600 "$_H" && printf 'X-API-Key: %s\nX-API-Secret: %s\n' "$KATANA_API_KEY" "$KATANA_API_SECRET" > "$_H" && curl -s "https://kat.imgnai.com/v1/generation-requests/${REQUEST_ID}" -H @"$_H" && rm -f "$_H"Raw response: Pipe to
jq '.'.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to write persistent state to disk after async submissions. Even if intended for resilience, this stores user-related workflow data outside the conversation and can outlive the session, increasing privacy risk and widening the skill's local side effects.
- Content
⚠️ Generation Persistence (compaction-safe tracking)
After submitting any async generation, IMMEDIATELY write the request metadata to a persistence file. Use the same
KATANA_SECRETS_FILEenv var pattern for the path, defaulting to the secrets directory:python import json, datetime, os
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to persist request metadata on disk in a location derived from the secrets path, which extends the skill's behavior beyond simply calling a media API. This creates unnecessary local state and increases exposure of user prompts, request IDs, timing, and model usage, especially on shared systems or when file permissions and cleanup are imperfect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The self-update workflow instructs the agent to fetch remote content and modify local skill files such as models.md, SKILL.md, and workflow files. That gives the skill a code/documentation mutation capability unrelated to ordinary media generation and creates a supply-chain style risk if remote content is malicious, compromised, or simply incorrect.
- Content