Security audit

OpenClaw Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently runs a local helper to generate or edit images with Gemini, with ordinary but notable cautions around runtime dependencies and user-chosen output paths.

Install only if you are comfortable sending prompts and selected input images to Gemini. Use a dedicated output folder, avoid sensitive or existing filenames, and consider pinning or reviewing uv dependencies before use in a stricter environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/generate_image.py:2
Finding: Unbounded Runtime Dependency Resolution
Content: View full analysis
=3.10" # dependencies = [ # "google-genai>=1.0.0", # "pillow>=10.0.0", # ] # /// ``` `SKILL.md:10-14`: ```json "api_key_required": true, "runners": ["uv"], "dependencies": ["requests", "beautifulsoup4"], "requires": { "bins": ["uv"], "env": ["GEMINI_API_KEY"] }, "primaryEnv": "GEMINI_API_KEY", ``` ### Technical Analysis The documented execution command uses `uv run`, while the script specifies dependencies using open-ended lower bounds. No lockfile, exact version constraints, or package hashes are included in the reviewed project. Consequently, future executions can resolve and install dependency versions that were not represented in the audited artifact. The metadata also declares `requests` and `beautifulsoup4`, although the executable script actually depends on `google-genai` and `pillow`. This inconsistency can unnecessarily increase the dependency surface where the metadata declarations are honored. This does not establish that any current dependency is malicious. The weakness is that dependency behavior can change after review and package installation or import code executes with the invoking user's permissions. ### Attack Path 1. An attacker compromises the distribution account or release process for a permitted future version of a dependency. 2. A user or Agent invokes the documented `uv run` command. 3. Because dependency versions are not exactly pinned or locked, `uv` resolves the compromised version. 4. The package is installed and subsequently imported by the script. 5. Malicious package initialization code executes with the permissions and environment of the invoking process. 6. That process may access files and environment variables av ...[truncated 516 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_image.py:80
Finding: Unrestricted Output Path Creation and File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared purpose says the skill generates or edits images, but the provided code chunk is only a pytest test module. Its behavior is to import generate_image.py and verify functions like auto_detect_resolution and choose_output_resolution. While this may support an image-generation skill, the chunk itself does not perform the declared primary function and instead serves a testing/validation role that is not represented in the description. No suspicious extra permissions or external resource access are shown, but the actual code’s purpose is materially different from the declared runtime capability.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 39)May include surrounding context.
python
def get_api_key(provided_key: str | None) -> str | None: """Get API key from argument first, then environment.""" if provided_key: return provided_key return os.environ.get("GEMINI_API_KEY")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.