ClawHub
Back to skill

Security audit

markdown-image-enricher

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it claims, but it needs review because it tells the agent to read local API-key configuration directly.

Review this before installing. It should be acceptable only if you are comfortable with the agent accessing OpenClaw runtime credential configuration for image generation; a safer version would rely on the platform image tool's existing authentication without instructing the agent to read secret files directly.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
# This skill expects the core image generation tool to be available.
    # The agent must NOT ask the user for API keys; it must read and reuse
    # the default image model and apiKey from the existing OpenClaw config
    # in ~/openclaw/.env or equivalent runtime config.
    required-tools:
      - image_generate
    # Recommended: expose as a slash command in chat UIs
Confidence
96% confidence
Finding
The skill explicitly instructs the agent to read credentials from ~/openclaw/.env or equivalent runtime configuration. Even though it says not to prompt the user and not to log secrets, this still authorizes access to a sensitive dotfile outside the user-specified markdown path, expanding filesystem access into credential material and creating a path for accidental disclosure or misuse. In skill context, this is more dangerous because the task itself is simple document enrichment, so direct secret-file access is not strictly necessary if the host tool already encapsulates authentication.

Static analysis

No suspicious patterns detected.