T09 · Insecure Skill Coding Practices
Error
- Location
lib/generate-image.py:115- Finding
KIE API Key Disclosure Through Unvalidated Image Download URL in Image Generator
- Content
View full analysis
- Remediation
View remediation
Security audit
Kie Ai Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it claims, but a credential-handling flaw could send your kie.ai API key to an untrusted image-download URL.
Install only if you are comfortable sending image prompts to kie.ai and storing outputs locally, and avoid using a high-value KIE_API_KEY with this version. The main issue to fix before broad use is removing the Authorization header from image-download requests or enforcing a strict HTTPS host allowlist with redirect validation. Treat any key used with untrusted task results as potentially exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
lib/watch_task.py:49- Finding
KIE API Key Disclosure Through Unvalidated Image Download URL in Task Watcher
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (34)
Tainted flow: 'req' from os.getenv (line 158, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request(url, data=req_data, headers=headers, method=method) try: with urllib.request.urlopen(req) as response: return json.loads(response.read().decode('utf-8')) except urllib.error.HTTPError as e: error_body = e.read().decode('utf-8')
Tainted flow: 'req' from os.getenv (line 158, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 92% confidence
- Finding
The code forwards the Bearer API key when downloading image URLs returned by the remote service, but those URLs are not restricted to the trusted kie.ai domain. If the upstream response is compromised or malicious, this will leak the API key to an arbitrary host via the Authorization header, enabling credential theft and possible account abuse.
- Content
python } req = urllib.request.Request(url, headers=headers) with urllib.request.urlopen(req, timeout=30) as response: with open(output_path, 'wb') as f: f.write(response.read()) return True
Tainted flow: 'req' from os.getenv (line 59, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request(url, headers=headers) try: with urllib.request.urlopen(req) as response: result = json.loads(response.read().decode('utf-8')) return result except urllib.error.HTTPError as e:
Tainted flow: 'req' from os.getenv (line 59, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The code forwards the Bearer API key to whatever image URL is returned by the remote service, and on 403 it retries unauthenticated. If the returned URL points to a third-party or attacker-controlled host, the skill will disclose the API key to that host and perform an untrusted outbound fetch.
- Content
python } req = urllib.request.Request(url, headers=headers) with urllib.request.urlopen(req, timeout=30) as response: with open(output_path, 'wb') as f: f.write(response.read()) return True
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Python 3.6+** (usually pre-installed on macOS/Linux) 2. **kie.ai API Key**: - Sign up at https://kie.ai - Get API key from dashboard ### Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Python 3.6+** (usually pre-installed on macOS/Linux) 2. **kie.ai API Key**: - Sign up at https://kie.ai - Get API key from dashboard ### Setup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Python 3.6+** (usually pre-installed on macOS/Linux) 2. **kie.ai API Key**: - Sign up at https://kie.ai - Get API key from dashboard ### Setup
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared purpose emphasizes image generation, but the documentation advertises broader multimodal capabilities including video and music. This mismatch can cause operators or automated policy systems to grant trust or permissions under a narrower assumption than the skill's apparent scope, weakening review and containment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly promotes optional Google Drive upload and states that generated files are retained locally and in Drive indefinitely, but it does not clearly warn users that prompts and generated content may contain sensitive data and will persist outside the immediate task context. In an agent skill context, this increases the chance of unintentional data exposure or long-term retention of private material, especially if users assume outputs are ephemeral.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
}
text 2. Create symlink: ```bash ln -s ~/src/kie-ai-skill ~/.openclaw/workspace/skills/kie-ai-skill
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares broad capabilities in practice—environment variable access, filesystem read/write, network access, and shell execution—but does not define any explicit tool scope or permission boundaries. In an agentic environment, that omission increases the chance the skill will be invoked with more authority than necessary, making unintended data access or command execution harder to constrain.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # Make executable chmod +x kie-ai.sh lib/*.py # Create symlink for OpenClaw ln -s ~/src/kie-ai-skill ~/.openclaw/workspace/skills/kie-ai-skill # Test it
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The autonomous invocation guidance is broad—an agent may run the skill when asked to generate images—without clear guardrails on confirmation, data sensitivity, or upload behavior. In agent workflows, vague invocation boundaries can lead to unreviewed external transmission of prompts or files and make it easier for downstream prompt injection to trigger actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes the skill primarily as unified API access for AI models with emphasis on image generation, local storage, Google Drive upload, usage tracking, and task resume. In this file, the help text and models command explicitly present support for video, music, and chat categories, which materially broadens the advertised scope beyond the manifest description.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The config help directs users to unrelated MATON credentials and services even though the skill is branded for kie.ai. This can cause users to expose or misuse third-party credentials, connect the wrong external account, or trust a potentially copied/miswired integration path, which is especially risky in a skill that handles API keys and cloud uploads.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python Security manifest: Env vars: KIE_API_KEY (required) Endpoints: https://api.kie.ai/api/v1/chat/credit (GET - auth header only, no user data sent) File I/O: reads <skill-root>/.task-state.json (local read only) No data is sent to any endpoint other than those listed above. """
Static analysis
No suspicious patterns detected.