ClawHub
Back to skill

Security audit

markdown-image-enricher

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Markdown image-enrichment purpose, but it tells the agent to read local OpenClaw API credentials from configuration files or environment variables.

Review before installing. The core Markdown-to-image workflow is understandable, but this skill should be changed so the host-managed image_generate tool uses its configured credentials internally. The agent should not read .env files, enumerate environment variables, display keys, log keys, or receive raw API secrets.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:5
Finding

Unnecessary Direct Access to Secret-Bearing Runtime Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–6, 13–15, 151–157, and 321–322
Vulnerability Type: Least-privilege violation through direct credential-file and environment access
Risk Level: Medium

Vulnerable Instructions

text
using the default OpenClaw image model and API key from
~/openclaw/.env
text
# The agent must NOT ask the user for API keys; it must read and reuse
# the default image model and apiKey from the existing OpenClaw config
# in ~/openclaw/.env or equivalent runtime config.
text
All images are generated using the **default** image model and API key that are
already configured in OpenClaw. The agent must not prompt the user for keys,
tokens, or secret values. Instead:

- Read the image model and credentials from the existing OpenClaw runtime
  configuration (for example the `.env` file under `~/openclaw/` or equivalent
  environment variables).
- Use the core `image_generate` tool (or host-provided equivalent) with those
  defaults.
text
4. Resolve the OpenClaw default image model and API key from the host
   configuration (no user prompts).

Technical Analysis

The Skill explicitly requires the Agent to read an API key from ~/openclaw/.env, an equivalent runtime configuration, or environment variables. This exceeds the minimum privileges required to enrich a Markdown document with images. The sanctioned image_generate tool should obtain its credentials internally through the host's credential-management boundary; the Agent does not need access to the raw secret.

A .env file or the process environment may contain credentials unrelated to image generation. The phrase “equivalent environment variables” is also insufficiently scoped and could lead to inspection of the broader runtime environment rather than a dedicated, non-secret model setting.

These instructions contradict the Skill's own filesystem restrictions, which state that access should be limited to the requested Ma ...[truncated 1493 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove every instruction requiring the Agent to read ~/openclaw/.env, raw API keys, credentials, or general environment variables.
  2. Require the Agent to invoke image_generate with host-managed defaults, without receiving or resolving the underlying credential.
  3. If model discovery is necessary, expose a dedicated host API that returns only non-secret model metadata.
  4. Explicitly prohibit reading secret-bearing dotfiles and enumerating environment variables.
  5. Preserve the existing filesystem allowlist: the user-specified Markdown file, its sibling _img.md output, and the sibling img/ directory.
  6. Replace the affected instructions with wording such as:
text
Use the host-provided image_generate tool with its configured default model.
Credential resolution must be performed internally by the host. Do not read,
request, display, log, or otherwise handle API keys, .env files, or runtime
environment secrets.
  1. Ensure failures from image_generate return only sanitized configuration errors and never raw tokens or environment contents.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The explicit reference to ~/openclaw/.env indicates credential access to a local secret store. In a skill whose user-facing task is Markdown enrichment, reaching into a .env file materially expands privileges beyond the requested document operation and creates a pathway for accidental disclosure, logging, or abuse of API credentials.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
# This skill expects the core image generation tool to be available.
    # The agent must NOT ask the user for API keys; it must read and reuse
    # the default image model and apiKey from the existing OpenClaw config
    # in ~/openclaw/.env or equivalent runtime config.
    required-tools:
      - image_generate
    # Recommended: expose as a slash command in chat UIs

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly directs the agent to read and reuse secrets from ~/openclaw/.env or equivalent runtime config without user confirmation. Directing an agent to access local secret material outside the user-provided input scope is a credential-access pattern that can be misused, especially if similar instructions are later copied into broader skills or executed in less constrained environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill claims it will never access unrelated files or secrets, but it also instructs the agent to read runtime configuration for model credentials. That contradiction weakens the trust boundary and normalizes secret access beyond the user-specified Markdown path, which can lead to unauthorized credential exposure or overbroad file access in agent implementations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The security section limits file access to the Markdown file, output file, and img directory, yet the operational flow still requires reading host configuration for API credentials. This creates an implicit exception to the stated sandbox and encourages implementations to bypass the declared scope, increasing the risk of unintended secret or dotfile access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The operational checklist tells the agent to resolve the default image model and API key from host configuration. Even if intended for convenience, this semantically authorizes secret discovery outside the user-requested file set and can cause agents to inspect configuration stores, environment variables, or dotfiles that should remain out of scope.

Content

No source excerpt is available for this finding.