GPT-Image-2 for OpenClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.1

Overview

The skill appears to install the promised OpenClaw image provider, but it persists an agent extension that sends prompts and API keys to an under-disclosed third-party endpoint and overwrites any existing local HNBC plugin.

Review this before installing. Confirm that api.1415.xin is the intended HNBC API endpoint, use a dedicated revocable HNBC API key, and avoid sending sensitive prompts unless you trust that service. Back up any existing ~/.openclaw/extensions/hnbc directory before running the installer, because it replaces that directory. Treat any custom baseUrl as sensitive because the API key will be sent to it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/plugin/image-generation-provider.js:20

Finding

Hard-Coded Nonstandard API Endpoint Receives Credentials and User Prompts

Content

View full analysis

Vulnerability Details

File Location: assets/plugin/image-generation-provider.js, lines 20–22 and 101–121
Vulnerability Type: Unverified external data destination and credential disclosure risk
Risk Level: High

Vulnerable Code

js

function resolveHnbcBaseUrl(cfg) {
  const direct = cfg?.models?.providers?.hnbc?.baseUrl?.trim() || "https://api.1415.xin/v1";
  return direct.replace(/\/+$/u, "");
}

js

const apiKey = auth.apiKey || req.cfg?.models?.providers?.hnbc?.apiKey?.trim();
if (!apiKey) throw new Error("HNBC API key missing");
const response = await fetch(`${resolveHnbcBaseUrl(req.cfg)}/images/generations`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${apiKey}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    model: req.model || "gpt-image-2",
    prompt: req.prompt,
    n: req.count ?? 1,
    size: resolveRequestedSize(req)
  })
});

Technical Analysis

The provider defaults to the nonstandard domain api.1415.xin and transmits both the HNBC bearer credential and the user's image-generation prompt to it. The project documentation identifies the service as HNBC but does not disclose this destination domain or explicitly warn that credentials and prompts are sent there.

The destination can also be replaced through models.providers.hnbc.baseUrl without an origin allowlist or an explicit confirmation mechanism. If configuration can be modified by another local component or untrusted configuration source, the bearer credential and prompt can consequently be redirected to an attacker-controlled HTTPS server.

The code does not show an explicit cross-origin redirect policy. Depending on the runtime's Fetch implementation, authorization headers may be removed during cross-origin redirects; however, the project should not rely solely on implicit client behavior to protect credentials.

Attack Path

1. The user invokes scripts/install.sh, which installs the provider into OpenCl ...[truncated 1301 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify that the default endpoint is the provider's official, controlled API domain and document that ownership.
2. Clearly disclose the destination domain and the transmission of API credentials and user prompts before first use.
3. Restrict the default endpoint and configurable baseUrl to HTTPS.
4. Maintain an allowlist of approved origins. If custom origins are required, require explicit user opt-in and show a warning that the API key will be sent to that origin.
5. Parse the URL with the standard URL API and reject embedded credentials, unsupported protocols, unexpected ports, malformed hosts, and unapproved origins.
6. Set an explicit redirect policy such as redirect: "error" or manually validate every redirect destination before resending a request.
7. Add automated tests confirming that credentials are never sent to an unapproved origin or forwarded across redirects.
8. Provide credential revocation and rotation guidance for users who may already have used an untrusted endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk accurately supports the 'verify' and 'diagnose' parts of the description: it checks plugin file locations, gateway status, and runtime/provider registration for hnbc. However, it does not perform installation, re-installation, or repair actions. It only emits informational output and hints. Because the declared purpose prominently includes install and repair capabilities that are not represented in the supplied code, this is a material description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill directs the agent to run shell scripts and interact with runtime/tool state, yet the manifest declares no explicit tool scope such as allowed tools or permissions. That under-specification weakens least-privilege controls and can cause an agent framework to grant broader environment or network access than reviewers expect. In this context, the skill is specifically for installation and diagnosis, so code execution is expected, but the missing declaration still makes review and policy enforcement less safe.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The "When to use" trigger examples are exclusively in Chinese, which imposes a language expectation without user opt-in or an alternative locale option. The policy explicitly allows locale constraints only when documented and justified; this file does not explain why Chinese-only phrasing is required.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The provider defaults to transmitting prompts and authentication data to a hard-coded third-party endpoint, https://api.1415.xin, if no safer explicit configuration is present. In the context of an agent skill, this increases supply-chain and data-governance risk because sensitive prompts may be sent to an unexpected external service by default, and the unusual non-vendor domain makes trust verification harder.

Content

Scanner excerpt · assets/plugin/image-generation-provider.js (reported line 22)May include surrounding context.

js

};

function resolveHnbcBaseUrl(cfg) {
  const direct = cfg?.models?.providers?.hnbc?.baseUrl?.trim() || "https://api.1415.xin/v1";
  return direct.replace(/\/+$/u, "");
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code performs a network POST to a third-party endpoint and includes the user's prompt in the request body plus a bearer API key in the headers. There is no confirmation prompt, logging, comment, or docstring here disclosing that user content will be transmitted to an external provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installer unconditionally deletes the target extension directory with rm -rf "$DEST_DIR" before copying the new plugin. While DEST_DIR is derived from fixed path components rather than direct user input, this is still a real destructive action with no backup, prompt, or validation, so an operator can lose prior plugin contents or local modifications by running the script.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The thrown error string is written only in Chinese, which imposes a specific language on users regardless of their locale or preferences. The file does not offer a language choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes the provider only with the broad hint "Image generation" and onboarding scope "image-generation" without any clearer trigger constraints or examples of when this skill should or should not be invoked. In a manifest file, this lack of specificity can lead to overly broad matching for common image-related requests.

Content

No source excerpt is available for this finding.