doubaoimg

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:25 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent image-saving purpose, but it uses unsafe browser-script and file-write patterns that deserve review before installation.

Review this skill before installing. It is not clearly malicious, but only use it with prompts and output paths you trust, avoid running it in a privileged account, and prefer a version that passes prompt/path values as data arguments and restricts downloads to a dedicated image folder without overwriting existing files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:45
• Finding: User-Controlled Prompt Interpolation into Browser JavaScript<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45–60 **Vulnerability Type**: JavaScript injection through unsafe string interpolation **Risk Level**: High ### Vulnerable Code ```js () => { const ta = document.querySelector('textarea'); if (!ta) return { ok: false, reason: 'no textarea' }; const text = 'PROMPT_HERE'; const setter = Object.getOwnPropertyDescriptor(window.HTMLTextAreaElement.prototype, 'value').set; setter.call(ta, text); ta.dispatchEvent(new Event('input', { bubbles: true })); ta.dispatchEvent(new Event('change', { bubbles: true })); return { ok: true, valueLength: ta.value.length }; } ``` ### Technical Analysis The skill instructs the agent to replace `PROMPT_HERE` with the image prompt and execute the resulting source using browser `evaluate`. The prompt is placed inside a single-quoted JavaScript string without requiring escaping, serialization, or argument binding. A malicious prompt containing a single quote followed by JavaScript syntax can terminate the intended string and inject additional statements. The injected code would execute in the context of the authenticated Doubao page. For example, a prompt shaped like the following could escape the string if inserted verbatim: ```text '; /* attacker-controlled JavaScript */ // ``` The precise capabilities of injected code depend on the browser automation environment and Doubao's page security controls. It could access page-visible content, inspect conversations rendered in the DOM, initiate same-origin actions, or send browser requests. Cookies protected with `HttpOnly` would not be directly readable, but the active authenticated session could still potentially be abused through same-origin requests. ### Attack Path 1. An attacker supplies or influences the image-generation prompt. 2. The agent follows the documented fallback and substitutes the prompt directly for `PROMPT_HERE`. 3. The prompt closes the single-quoted JavaScript string and ap ...[truncated 951 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never concatenate or interpolate the prompt into executable JavaScript source. - Pass the prompt as a separate argument supported by the browser evaluation API. For example: ```js (prompt) => { const ta = document.querySelector('textarea'); if (!ta) return { ok: false, reason: 'no textarea' }; const setter = Object.getOwnPropertyDescriptor( window.HTMLTextAreaElement.prototype, 'value' ).set; setter.call(ta, prompt); ta.dispatchEvent(new Event('input', { bubbles: true })); ta.dispatchEvent(new Event('change', { bubbles: true })); return { ok: true, valueLength: ta.value.length }; } ``` - If argument passing is unavailable, serialize the value with a trusted serializer such as `JSON.stringify` before constructing the expression. Do not implement ad hoc quote escaping. - Explicitly state in the skill instructions that user input must never be substituted directly into JavaScript, PowerShell, Python, shell, or other executable source. - Add test cases containing quotes, backslashes, newlines, template-literal characters, and JavaScript fragments to verify that prompts remain data rather than code. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:161
• Finding: Unrestricted Caller-Controlled Output Path Allows File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–20 and 161–170 **Vulnerability Type**: Arbitrary file write or overwrite through an unrestricted output path **Risk Level**: Medium ### Vulnerable Code The skill accepts a caller-provided local path without defining any validation or containment requirement: ```markdown Collect or infer: - `prompt`: image prompt for 豆包 - `output_path`: local save path If the user does not specify an output path, default to a timestamped file name in: - `C:\Users\Administrator\.openclaw\workspace\tmp\` ``` The supplied path is then used directly as the download destination: ```powershell @' import urllib.request url = 'IMAGE_URL_HERE' out = r'OUTPUT_PATH_HERE' urllib.request.urlretrieve(url, out) print(out) '@ | python - ``` ### Technical Analysis `OUTPUT_PATH_HERE` is passed directly to `urllib.request.urlretrieve` without requiring canonicalization, workspace containment, extension validation, collision checks, or confirmation before overwriting an existing file. `urlretrieve` writes to the specified destination and can replace an existing writable file. Consequently, a malicious or mistakenly supplied absolute path or traversal path could target files outside the intended temporary image directory. The maximum impact is limited by the filesystem permissions of the account running the agent. The documented default path references an Administrator profile, which may increase the number of writable sensitive locations in deployments that run the agent with elevated privileges. The example also embeds the path in a Python raw string inside a PowerShell script. Certain crafted values could make the generated Python invalid or potentially alter its syntax if substituted verbatim. The confirmed issue is the unrestricted file destination; safe parameter passing should also be used to avoid creating a secondary injection condition. ### Attack Path 1. An attacker supplies or influences `output_path` ...[truncated 1234 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Restrict all generated files to a dedicated download directory, such as: ```text C:\Users\Administrator\.openclaw\workspace\tmp\ ``` - Resolve the requested destination to a canonical absolute path and verify that it remains beneath the approved directory. - Reject absolute paths outside the approved directory, parent-directory traversal, alternate data streams, device paths, and symbolic-link or junction escapes. - Treat a caller-provided value as a filename rather than an unrestricted filesystem path. - Permit only expected image extensions, such as `.png`, `.jpg`, or `.webp`, and verify that the downloaded content is a valid image before finalizing it. - Create files exclusively and refuse to overwrite existing files unless the user gives explicit confirmation. - Download to a newly created temporary file first, validate its content and size, and then atomically move it to the approved destination. - Run the agent with a non-administrative account and the minimum filesystem permissions required. - Pass the URL and output path as command arguments or environment values instead of substituting them into Python source. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill instructs the agent to write files to local disk, including a default path under the user's workspace, without requiring explicit confirmation at the time of the write. While saving an image is core to the skill's stated purpose, silent filesystem writes can still surprise users, overwrite expected locations, or create unintended local artifacts if the output path is inferred automatically.

Static analysis

No suspicious patterns detected.