Jimeng Skills

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:59 PM UTC
• Version: 0.1.1

Overview

The skill describes a legitimate image/video generation workflow, but its runnable implementation is missing and its examples execute an unpinned npm tool while Volcengine credentials may be present.

Review before installing or running. Ask the publisher to include the referenced skill.yaml, scripts/openclaw-jimeng.ts, package.json, and lockfile, and prefer pinned or local-only dependency execution. Use least-privilege or temporary Volcengine credentials if you test it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-36
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx ts-node scripts/openclaw-jimeng.ts image "一只戴墨镜的柴犬，电影海报风格"

bash

npx ts-node scripts/openclaw-jimeng.ts video "一只戴墨镜的柴犬在沙滩上奔跑" --wait

Technical Analysis

The documented commands invoke ts-node through npx without specifying a reviewed version or requiring a locally installed, lockfile-controlled copy. If ts-node is not available in the local project, npx may resolve and download the package from the configured npm registry before executing it.

The audited project contains only SKILL.md; no package manifest, lockfile, integrity metadata, vendored dependency, or dependency verification mechanism is present. Consequently, the exact executable dependency is not reproducibly defined by the project. Its effective implementation can depend on registry state and local npm configuration at execution time.

This creates a supply-chain exposure if the resolved package, registry, package metadata, or dependency chain is compromised. The referenced scripts/openclaw-jimeng.ts file is also absent from the audited artifact, so its behavior could not be verified.

Attack Path

1. An operator follows one of the recommended npx ts-node commands.
2. The environment does not contain a suitable local ts-node executable.
3. npx resolves the unpinned package through the configured npm registry.
4. A compromised registry response, package release, transitive dependency, or registry configuration supplies attacker-controlled code.
5. The downloaded package or its dependency code executes under the invoking user's account.
6. The malicious code can access resources available to that process, potentially including project files, local output, network connectivity, and exported environment credentials such as the documented ...[truncated 772 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed package.json and lockfile to the project, and declare an exact or tightly controlled ts-node version.
2. Install dependencies reproducibly with npm ci, which enforces the committed lockfile.
3. Run the local dependency without permitting registry fallback:

   bash

   npx --no-install ts-node scripts/openclaw-jimeng.ts image "prompt"
   

4. Alternatively, invoke the locked binary directly:

   bash

   ./node_modules/.bin/ts-node scripts/openclaw-jimeng.ts image "prompt"
   

5. Commit and review the referenced scripts/openclaw-jimeng.ts implementation and the documented skill.yaml, both of which are absent from the audited artifact.
6. Use trusted registry configuration, dependency integrity checks, automated supply-chain scanning, and controlled dependency update reviews.
7. Execute generation tooling with least privilege and expose only the credentials required for the current task. Prefer short-lived tokens over permanent credentials where supported.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.