Media Generation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:14 AM UTC
• Version: 2.2.0

Overview

The skill is coherent for media generation, but its video polling and media download helpers can make unsafe provider-directed network requests that may expose API keys or hit unintended hosts.

Review or patch this skill before installing. Use only trusted media providers, avoid sensitive prompts or private images unless the provider is approved, run it with restricted network access where possible, and fix URL validation so polling and downloads only contact trusted HTTPS provider or CDN origins without leaking bearer tokens. Clean tmp/images, tmp/videos, masks, and batch summaries after sensitive jobs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_video.py:138

Finding

Provider-Controlled Video Polling URL Leaks the Provider Bearer Token

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_video.py, lines 138–152
Vulnerability Type: Arbitrary authenticated outbound request / credential disclosure
Risk Level: High

Vulnerable Code

python

status_url = extract_status_url(payload)
job_id = extract_job_id(payload)
if not status_url and job_id:
    status_url = base_url + endpoint_template.format(id=job_id)
if not status_url:
    return payload
if status_url.startswith("/"):
    status_url = base_url + status_url
headers = {"Authorization": f"Bearer {api_key}", "Accept": "application/json"}
last_payload = payload
for _ in range(max_polls):
    try:
        resp = requests.get(status_url, headers=headers, timeout=timeout)

Technical Analysis

The asynchronous video workflow accepts a polling URL obtained from the provider response through extract_status_url(). Absolute URLs are used without validating their scheme, hostname, port, resolved IP address, or relationship to the configured provider origin.

The request then unconditionally includes the configured provider API key in an Authorization: Bearer header. A malicious or compromised generation endpoint can return an attacker-controlled absolute status_url, poll_url, result_url, or retrieve_url. The polling routine will consequently send the provider credential to that destination.

This behavior exceeds the minimum privileges required for asynchronous polling. Poll requests only need to reach the configured provider or an explicitly trusted polling origin; they do not need arbitrary Internet or internal-network access with provider credentials attached.

Attack Path

1. An attacker controls, compromises, or impersonates the configured video-generation endpoint.
2. A user invokes generate_video.py, causing an authenticated generation request.
3. The endpoint returns a successful asynchronous payload containing an absolute URL such as an attacker ...[truncated 1211 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve relative polling paths against the configured provider URL using a standards-compliant URL resolver such as urllib.parse.urljoin.
2. Permit polling only when the resulting URL has the same normalized scheme, hostname, and effective port as the configured provider.
3. Require HTTPS except where an explicit, narrowly scoped local-development option permits HTTP.
4. Never attach the provider Authorization header to a cross-origin polling request.
5. Reject URLs resolving to loopback, private, link-local, multicast, reserved, or unspecified IP ranges unless explicitly required by trusted local configuration.
6. Resolve and validate all returned addresses to mitigate DNS rebinding.
7. Disable redirects for authenticated polling, or manually validate every redirect target before following it.
8. Add tests covering attacker-controlled absolute polling URLs, cross-origin redirects, IPv4 and IPv6 loopback addresses, private ranges, and cloud metadata addresses.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_generated_media.py:91

Finding

Unrestricted Returned-Media Fetching Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_generated_media.py, lines 91–99 and 161–165
Vulnerability Type: Server-side request forgery and unbounded response download
Risk Level: Medium

Vulnerable Code

python

def build_url(ref, origin):
    if ref.startswith('http://') or ref.startswith('https://'):
        return ref.rstrip('\\')
    if ref.startswith('data:'):
        return ref
    if not origin:
        raise SystemExit(f"relative media path found but --origin was not provided: {ref}")
    return origin.rstrip('/') + '/' + ref.lstrip('/')

python

headers = parse_headers(args.header)
resp = requests.get(url, headers=headers, timeout=args.timeout)
resp.raise_for_status()

ext = guess_extension(url, resp.headers.get('content-type'))
out_path = save_bytes(args.out_dir, args.prefix, ext, resp.content)

Technical Analysis

The media-fetch helper accepts absolute HTTP and HTTPS references extracted from provider-controlled JSON, HTML, Markdown, or raw text. It performs the request without validating the destination hostname, resolved IP address, port, or network range.

Redirects are followed by default by the requests library, and redirect destinations are not revalidated. A public URL can therefore redirect the downloader to a loopback, private, link-local, or cloud metadata address.

The implementation also accesses resp.content, buffering the entire response in memory before writing it to disk. It imposes no maximum response size and does not require an image or video content type. A malicious endpoint can consequently return an oversized or non-media response, causing memory and disk consumption.

Fetching generated media is necessary for the declared functionality, but unrestricted access to arbitrary network destinations and unlimited response bodies is not.

Attack Path

1. A malicious or compromised media provider returns a response containing a ...[truncated 1578 chars]

Remediation

View remediation

Remediation Suggestions

1. Allow downloads only from the configured provider origin and explicitly approved media CDN origins.
2. Require HTTPS for remote media outside narrowly scoped local-development configurations.
3. Resolve destination hostnames and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
4. Protect against DNS rebinding by validating every resolved address and ensuring the actual connection cannot switch to an unapproved address.
5. Disable automatic redirects or validate the scheme, origin, hostname, port, and resolved addresses of every redirect target.
6. Use stream=True and process the body in bounded chunks.
7. Enforce a strict maximum download size using both Content-Length when available and a running byte counter.
8. Permit only expected image and video MIME types, and verify file signatures rather than relying solely on response headers or filename extensions.
9. Apply separate connection and read timeouts.
10. Add tests for loopback and private addresses, IPv6 literals, encoded IP forms, DNS rebinding, redirect chains, misleading content types, and oversized responses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents capabilities that require shell, file, environment, and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an unnecessarily broad execution surface and weakens policy enforcement, making it easier for the skill to invoke powerful operations without clear restriction or review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 72% confidence

Finding

The skill is designed to save generated and fetched media under tmp/images and tmp/videos and to support batch workflows and reusable pipelines, which introduces session persistence of user-provided and provider-returned artifacts. Persisting prompts, reference-derived outputs, and fetched remote content beyond the immediate task can increase privacy exposure and create residual sensitive data on disk.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: media-generation
description: Generate images, edit existing images, create short videos, run inpainting/outpainting and object-focused edits, use reference images as provider inputs, batch related media jobs from a manifest, and fetch returned media from URLs/HTML/JSON/data URLs/base64. Use when working on AI image generation, AI image editing, mask-based inpainting, outpainting, reference-image workflows, short AI video generation, product-shot variations, or reusable media-production pipelines.
---

# Media Generation

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly supports sending prompts and reference images to external providers and fetching returned media from remote URLs, HTML, JSON, data URLs, and base64, but the description does not clearly warn users that their content may leave the local environment. This can lead to unintentional disclosure of sensitive prompts, images, or internal URLs and causes users to consent to behavior they may not understand.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documented batch summary persists rendered items, resolved commands, and per-item stdout/stderr, which can expose sensitive prompts, local file paths, provider endpoints, tokens passed via arguments, or other operational details if users store or share the summary artifact. In a media-generation workflow, manifests often contain proprietary prompts, asset locations, and integration parameters, so documenting this behavior without an explicit warning or redaction guidance increases the chance of unintentional data leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly states that reference images are read from local paths and uploaded or encoded for provider requests, but it does not warn users that these files may contain sensitive or proprietary content that will be transmitted to third-party services. In a media-generation skill, this omission increases the risk of unintentional privacy, confidentiality, or compliance violations because users may reasonably provide internal or personal images without realizing they leave the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This script uploads the provided image and optional mask to a remote provider API via multipart HTTP POST, but it does not present any explicit user-facing notice or confirmation that local media will leave the system. In a media-generation skill, users may reasonably expect cloud processing, but the absence of a clear warning still creates a privacy and data-handling risk, especially if sensitive images are edited unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script performs an HTTP GET to a model-extracted URL and then writes the downloaded content to disk. While these actions are core to the utility, the code provides no confirmation prompt, warning message, or explanatory comment/docstring disclosing that it will contact a remote host and save arbitrary media locally.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_consistent_media.py (reported line 9)May include surrounding context.

python

if __name__ == "__main__":
    target = Path(__file__).resolve().parent / "reference_media.py"
    raise SystemExit(subprocess.call([sys.executable, str(target), *sys.argv[1:]]))

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 92)May include surrounding context.

python

if args.model == "image-model":
        print("WARN: using placeholder model 'image-model'. Pass --model or set the OPENCLAW_MEDIA_IMAGE_MODEL env var for a real provider model name.", file=sys.stderr)
    try:
        resp = requests.post(
            url,
            headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
            json=payload,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 214)May include surrounding context.

python

timeout=args.timeout,
                )
        else:
            resp = requests.post(
                url,
                headers={**headers, "Content-Type": "application/json"},
                json=payload,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/media_request_common.py (reported line 147)May include surrounding context.

python

cmd.extend(["--origin", origin])
    for header in headers or []:
        cmd.extend(["--header", header])
    result = subprocess.run(cmd, capture_output=True, text=True, check=True)
    lines = [line for line in result.stdout.strip().splitlines() if line.strip()]
    return lines[-1] if lines else None

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/object_select_edit.py (reported line 41)May include surrounding context.

python

def run_cmd(cmd):
    return subprocess.run(cmd, text=True, capture_output=True)


def main():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_batch_media.py (reported line 173)May include surrounding context.

python

def run_attempt(cmd, script_name, label):
    proc = subprocess.run(cmd, text=True, capture_output=True)
    return {
        "label": label,
        "script": script_name,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/reference_media.py (reported line 96)May include surrounding context.

python

def run_attempt(cmd, script_name, label):
    proc = subprocess.run(cmd, text=True, capture_output=True)
    return {
        "label": label,
        "script": script_name,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mask_inpaint.py (reported line 207)May include surrounding context.

python

def run(cmd):
    result = subprocess.run(cmd, text=True, capture_output=True)
    return {"cmd": cmd, "returncode": result.returncode, "stdout": result.stdout.strip(), "stderr": result.stderr.strip()}

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/outpaint_image.py (reported line 106)May include surrounding context.

python

def run(cmd):
    result = subprocess.run(cmd, text=True, capture_output=True)
    return {"cmd": cmd, "returncode": result.returncode, "stdout": result.stdout.strip(), "stderr": result.stderr.strip()}

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 18)May include surrounding context.

python

def run(cmd):
    result = subprocess.run(cmd, text=True, capture_output=True)
    return {"cmd": cmd, "returncode": result.returncode, "stdout": result.stdout.strip(), "stderr": result.stderr.strip()}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code invokes another Python script via subprocess.run, which is a safety-relevant operation under the audit criteria for code files. While the helper name suggests expected behavior, there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring in this file disclosing that an external process will be launched.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code creates directories and output mask files, then invokes other scripts via subprocess to prepare masks and edit images. While these actions are part of the script's purpose, there is no explicit user-facing disclosure at execution time that files will be written and external helper scripts will be run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script creates the output directory and saves a prepared image file to disk, but there is no confirmation prompt, pre-write notice, or inline comment/docstring warning that a new file will be written. Although the script prints the prepared path later, that disclosure happens only after the write has already occurred.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script constructs and executes a subprocess to run another helper, which is a safety-relevant operation under this rule. While the argument parser description says it will call the image-edit helper, there is no explicit runtime notice or warning to the user before launching the subprocess.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/mask_inpaint.py:152