ClawHub
Back to skill

Security audit

Runpod Media

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does RunPod media generation, but it needs review because it can call arbitrary RunPod endpoints and uses an undeclared direct Telegram bot-token delivery workaround.

Review before installing. Use dedicated, narrowly scoped RunPod and Cloudflare R2 credentials, avoid sending private media or sensitive prompts unless you accept remote processing, prefer known registry endpoints, and do not use the Telegram curl fallback unless you trust the bot token, chat ID handling, and delivery path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (21)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill uses sensitive capabilities including environment access, reading and writing local files, and network transmission, but does not declare permissions. This weakens governance and user/admin visibility into what the skill can actually do, especially because the documented behavior includes secret access, uploads, and outbound API calls.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The manifest presents a narrow RunPod image/video skill, but the documentation expands behavior to third-party uploads, arbitrary endpoint invocation, audio handling, and registry discovery/mutation. This mismatch can cause users and platform policy to authorize a seemingly simple media tool that actually has broader data-exfiltration and code-path reach.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The documented `call_endpoint` feature allows use of arbitrary RunPod public endpoints, including capabilities outside image/video generation such as TTS. That is broader than the skill's declared purpose and increases the chance that users or operators grant access without understanding the true scope of external processing.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Endpoint discovery and mutation of a local registry are privileged administrative capabilities that are not necessary for ordinary media generation. They broaden the attack surface by enabling unreviewed services to be added and used later under the same trusted skill.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The skill claims delivery through the user's active channel, but the fallback explicitly reads Telegram bot secrets and uses Telegram chat metadata to send files directly. This creates a hidden cross-channel transmission path and bypasses normal messaging abstractions and policy controls.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
Reading Telegram bot credentials from secrets and sending messages directly is unrelated to the stated purpose of RunPod media generation. It grants the skill access to a second sensitive integration that can be abused for unauthorized messaging or data exfiltration.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The helper can upload arbitrary local files to Cloudflare R2 using credentials pulled from local secrets, but the skill description only states a RunPod API key requirement and AI media generation purpose. That creates an undisclosed external transfer path for user-provided local files, which is materially relevant because images may contain sensitive personal or proprietary data.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The code reads from a broad shared secrets store and contains logic for multiple credential domains beyond the prominently declared RunPod requirement. Even though it fetches specific paths rather than dumping the whole file here, accessing a wider local secret store than users expect increases trust and blast-radius concerns if the skill is modified or misused.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The wrapper exposes `call_endpoint` and `discover_endpoints`, which are broader capabilities than the skill metadata describes. In an agent setting, this creates a scope-expansion issue: a caller expecting only image/video generation or editing could be induced to enumerate or invoke arbitrary RunPod public endpoints, potentially causing unintended external requests, policy bypass, or use of higher-risk models/services.

Missing User Warnings

High
Confidence
97% confidence
Finding
The documentation states that local images and credentials are used to upload content to third-party services, but it does not present a clear user-facing warning or consent step. This is dangerous because users may provide local files expecting local processing, while the skill actually transmits them externally to Cloudflare R2 and RunPod.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The default behavior to delete local files after sending is destructive and is not clearly surfaced as a user-facing warning. Users may reasonably expect generated artifacts to remain available locally, and silent deletion can cause data loss or interfere with auditability and troubleshooting.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The explicit instruction to run `rm <path>` after delivery introduces irreversible deletion behavior without a corresponding user notice or confirmation. In a skill that writes media files to shared workspace paths, this can lead to unintended loss of user data or operational artifacts.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill silently reads the RunPod API key from local secret storage without any user-facing disclosure in the code path shown. In an agent skill ecosystem, undisclosed credential access is risky because users may not realize the skill can automatically consume stored secrets when invoked.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code uploads local files to Cloudflare R2 and returns a presigned URL, but there is no explicit warning that user data leaves the machine and is staged on third-party object storage. For media-editing workflows, this matters because local images can contain sensitive content or metadata, and the off-device transfer is not obvious from the skill description.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script explicitly allows any custom RunPod endpoint ID and sends user-supplied payloads to that remote endpoint, while also uploading local image/audio files to obtain URLs before submission. In a skill that handles user prompts and media, this creates a real data-disclosure risk because users may not realize their text and local files are being transmitted to arbitrary external services selected via an endpoint parameter.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script takes local image paths, uploads or resolves them to remote URLs via `ensure_url`, and then sends those URLs to a third-party RunPod endpoint without any explicit notice or confirmation about network transmission. Because image files often contain sensitive visual content and metadata, users may unknowingly disclose private data to external services, which is a real privacy/security weakness even if it is part of the skill's intended functionality.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The script sends the user-provided prompt to RunPod via `run_async(...)`, but it does not clearly warn the user at the point of execution that their prompt content will be transmitted to a third-party external service. This is a real privacy/transparency issue because prompts may contain sensitive or proprietary information, even though such transmission is expected for a media-generation skill.

External Transmission

Medium
Category
Data Exfiltration
Content
-F "chat_id=CHAT_ID" \
  -F "photo=@$HOME/.openclaw/workspace/runpod-media/OUTPUT_FILE.jpg" \
  -F "caption=YOUR CAPTION" \
  "https://api.telegram.org/bot${TOKEN}/sendPhoto"

# Send video (.mp4)
curl -s \
Confidence
95% confidence
Finding
https://api.telegram.org/

External Transmission

Medium
Category
Data Exfiltration
Content
-F "chat_id=CHAT_ID" \
  -F "video=@$HOME/.openclaw/workspace/runpod-media/OUTPUT_FILE.mp4" \
  -F "caption=YOUR CAPTION" \
  "https://api.telegram.org/bot${TOKEN}/sendVideo"
```

**Where to find CHAT_ID:** Use the `chat_id` from the inbound message metadata (e.g. `telegram:1231438498` → use `1231438498`).
Confidence
95% confidence
Finding
https://api.telegram.org/

Credential Access

High
Category
Privilege Escalation
Content
|----------|---------|-------------|
| `/runpod/apiKey` | Call RunPod endpoints | [runpod.io/console/user/settings](https://www.runpod.io/console/user/settings) |

Local images are uploaded to **Cloudflare R2** as presigned URLs (1 min expiry) before being sent to RunPod endpoints. R2 credentials are read from `/cloudflare/r2` in secrets.json — already configured ✅

> imgbb is no longer used. R2 presigned URLs replace it for all local file uploads.
Confidence
90% confidence
Finding
secrets.json

External Script Fetching

High
Category
Supply Chain
Content
### The Problem
The `message` tool with a local `media` path may fail in sandboxed agent modes due to SecretRef resolution not being available for media sends. This is a known OpenClaw limitation.

### The Solution: Use curl + Telegram Bot API directly

Read the bot token from secrets and send via curl — this always works regardless of sandbox mode:
Confidence
94% confidence
Finding
curl + Telegram Bot API directly Read the bot token from secrets and send via curl — this always works regardless of sandbox mode: ```bash TOKEN=$(cat ~/.openclaw/secrets.json | python

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.