Security audit

Agent Memes

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims, but it gives an agent broad, proactive power to post images to chat platforms and has under-scoped handling of targets, files, and shell execution.

Install only if you want this skill to let your agent post images into real chat channels. Configure explicit accounts and targets, use least-privileged bot tokens, require confirmation before sends, avoid LINE for sensitive local images unless you change the hosting path, and avoid the OpenClaw fallback sender until the `bash -c` command construction is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: When a local file is provided, the script silently uploads it to litterbox.catbox.moe and then sends that public URL through LINE. This changes the security model from private direct messaging to public third-party hosting, creating a serious confidentiality risk for sensitive images and metadata because users may not realize their local file is being disclosed outside LINE.

Context-Inappropriate Capability

Low

Confidence: 92% confidence
Finding: The script sources configuration files from user-controlled locations and reads a context file from /tmp to derive messaging targets and channels. Sourcing shell files executes arbitrary code in the current process, and trusting a /tmp file for routing can let another local process influence where content is sent, creating code execution and misdelivery risk.

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill instructs the agent to consider sending memes on essentially every reply based on broad emotional or situational cues, including proactive use based on the agent's own 'feelings.' This can cause unsolicited tool invocation and external message sending in ordinary conversations, increasing the risk of spammy behavior, accidental data transmission to third-party platforms, and actions taken without clear user intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill prominently describes sending images through Discord, Feishu, Telegram, LINE, and fallback channels, but does not warn that captions, targets, channel identifiers, and attachments may be transmitted to external services. In an agent setting, lack of disclosure and consent can lead to unintended sharing of conversation-derived content or metadata to third parties.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script intentionally resolves secrets and prints them directly to stdout, which creates a real secret-exposure risk in agent environments where stdout is commonly captured in logs, transcripts, shell history, or downstream tool output. Because this helper is designed to fetch bot tokens and app secrets for multiple platforms, any caller can easily exfiltrate credentials once the script is available and the config/env vars are populated.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script automatically transmits local image files to a public third-party service without an explicit confirmation at the point of action. In a skill/automation context, this can lead to unintentional exfiltration of local screenshots, documents, or other sensitive images, especially when users expect the file to be sent only via the LINE API.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Using source on configuration files means arbitrary shell commands in those files will execute with the privileges of the user running the script. In an agent-skill context, this is especially dangerous because merely using a meme utility can trigger unexpected code execution from a modified config file, leading to command execution, persistence, or credential theft.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/feishu-send-image.mjs:30

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/feishu-send-image.mjs:24

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/feishu-send-image.mjs:48