Security audit

suhe

Security checks for vulnerabilities and agentic risk

Overview

This package has a real selfie-generation feature, but it also bundles broad persistent OpenClaw agent setup and inconsistent third-party image/provider flows that users should review before installing.

Install only if you intentionally want a Suhe/OpenClaw agent bootstrap package, not just a selfie skill. Review the persistent writes under ~/.openclaw, avoid using sensitive prompts or private images, require explicit confirmation before any channel send or public hosting, and verify which provider and gateway will receive prompts, image URLs, captions, and tokens.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:338
Finding: Shell Command Injection in the Documented OpenClaw Invocation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skill/scripts/suhe-selfie.sh:159
Finding: Unsafe JSON Construction and Unrestricted Gateway Destination
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skill/SKILL.md:142
Finding: Unnecessary Public Republishing of Generated Images over Plaintext HTTP
Content: View full analysis
console.error('Error:', e.message)); " ``` ### Technical Analysis The workflow takes an image already hosted by the generation provider, downloads it to a predictable temporary path, uploads another copy to OSS, and returns a public custom-domain URL over plaintext HTTP. This republishing is disclosed in the Skill workflow, so it is not hidden credential exfiltration. However, it exceeds the minimum privilege and data handling required to send the generated image through OpenClaw. The existing provider URL could be sent directly, or the image could be published through a private, short-lived signed URL. The response metadata sets a one-year ...[truncated 1838 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (94)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill requires sensitive credentials and performs outbound requests to external and local services, but this is only partially reflected in the high-level description and can surprise users. In skill ecosystems, undisclosed token use and message-sending capability are dangerous because they can lead to unauthorized external actions or leakage of user-provided content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill requires sensitive credentials and performs outbound requests to external and local services, but this is only partially reflected in the high-level description and can surprise users. In skill ecosystems, undisclosed token use and message-sending capability are dangerous because they can lead to unauthorized external actions or leakage of user-provided content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill requires sensitive credentials and performs outbound requests to external and local services, but this is only partially reflected in the high-level description and can surprise users. In skill ecosystems, undisclosed token use and message-sending capability are dangerous because they can lead to unauthorized external actions or leakage of user-provided content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill requires sensitive credentials and performs outbound requests to external and local services, but this is only partially reflected in the high-level description and can surprise users. In skill ecosystems, undisclosed token use and message-sending capability are dangerous because they can lead to unauthorized external actions or leakage of user-provided content.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are very broad and overlap with routine conversation such as 'what are you doing?' or 'how are you doing?'. In context, this is dangerous because the skill can activate unexpectedly and proceed toward generating and sending images to messaging channels, creating consent, impersonation, and unwanted outbound-action risks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The Node.js implementation contradicts the rest of the skill by using fal.ai/Grok Imagine instead of Tongyi Wanxiang/DashScope. This inconsistency is dangerous because operators may trust one vendor/data flow while the code actually sends images and prompts to a different external provider, causing unintended data disclosure and breaking security review assumptions.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The CLI reads environment-derived paths via process.env.HOME and later stores secrets and configuration under that location. Undeclared environment access matters because it influences where files are copied and where configuration is written, expanding the skill's effective privileges beyond a narrowly scoped selfie utility.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This installer copies workspace, skill, and documentation trees into broad ~/.openclaw locations immediately on execution, far beyond the manifest's stated selfie-editing/sending purpose. That scope mismatch is dangerous because users invoking a media skill would not reasonably expect full agent bootstrap and persistent environment modification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module documentation explicitly describes a general OpenClaw agent initialization template installer, which contradicts the declared selfie-focused purpose. This documentation mismatch is a strong signal of deceptive packaging or at least materially misleading functionality, increasing the risk of users granting trust under false assumptions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The banner and installation flow advertise and deploy identity, metacognition, covenant, and safety systems unrelated to a selfie skill. Hidden or bundled capability expansion increases the chance of over-privileged installation and deceptive user expectations about what the package actually changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The installer interactively collects persona and user-profile data, then persists it into workspace files unrelated to image editing or message sending. In the context of a selfie skill, this broad collection and durable storage of identity/profile data creates unnecessary privacy exposure and silently transforms the package into an agent-persona configurator.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill does not clearly warn users that prompts, reference images, and resulting media may be transmitted to third-party AI providers and messaging platforms. This is dangerous because the skill is designed specifically to exfiltrate user-supplied content to external services and then redistribute generated media to potentially public channels.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · workspace/SAFETY.md (reported line 112)May include surrounding context.
md
### 敏感信息定义 - API Key（如 `DASHSCOPE_API_KEY`、`KIMI_API_KEY`） - Access Token - 数据库连接字符串 - 私钥、证书文件 - 密码、密钥

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 该文件全文仅使用中文编写，且没有说明这是可选语言、提供多语言版本，或明确限定为仅面向特定中文区域贡献者。根据规则，若技能或项目文档在自然语言层面强制特定语言而未取得用户选择/同意，可构成语言/区域政策问题。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says this skill edits Suhe's reference image with Tongyi Wanxiang and sends selfies via OpenClaw, implying a narrowly scoped image/selfie capability. However, the README primarily documents a full agent bootstrap package with identity, memory, metacognition, covenant, A2A networking, installation tooling, and workspace initialization, which is materially broader than the manifest's stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README tells users to configure a DashScope API key for the selfie feature but does not clearly warn that prompts, reference images, and related metadata may be transmitted to a third-party external service. In a selfie-editing skill that also sends outputs to messaging channels, this omission can mislead operators about privacy and data-flow risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example triggers for the selfie feature include broad, ordinary conversational phrases such as '你在做什么？', which can cause the skill to activate when the user did not intend to request image generation or message sending. In this skill context, that increases the chance of accidental external API usage and unintended transmission of generated selfies to messaging channels.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description does not prominently warn that the skill will transmit prompts/images to external AI services and distribute generated media to messaging platforms. In this context, lack of upfront disclosure is risky because users may provide personal or sensitive context without understanding it will be sent off-platform and rebroadcast.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This code performs external transmission of user-derived prompt content and a reference image URL to DashScope. In a skill that can be triggered from conversational context, sending data to a third-party model provider is security-relevant because it may expose personal content, sensitive context, or regulated data without adequate consent or minimization.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
} }') curl -X POST "https://dashscope.aliyuncs.com/api/v1/services/aigc/image-generation/generation" \ -H "Authorization: Bearer $DASHSCOPE_API_KEY" \ -H "Content-Type: application/json" \ -d "$JSON_PAYLOAD"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The complete script again transmits prompts and reference-image information to an external DashScope endpoint, reinforcing that third-party data sharing is an operational behavior of the skill. The main danger is privacy and policy exposure: user context can be forwarded externally and then used to generate media that is subsequently distributed elsewhere.
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
} }') RESPONSE=$(curl -s -X POST "https://dashscope.aliyuncs.com/api/v1/services/aigc/image-generation/generation" \ -H "Authorization: Bearer $DASHSCOPE_API_KEY" \ -H "Content-Type: application/json" \ -d "$JSON_PAYLOAD")

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline docs and captions reference Grok Imagine even though the skill is presented as a Tongyi Wanxiang skill. While not an exploit by itself, this kind of provider confusion undermines informed consent and safe deployment because users may not realize which third party receives their prompts and images.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code presents user-facing logs, prompts, and generated profile defaults in Chinese, and later hard-codes a China timezone, with no mechanism to select another language or locale. That is a natural-language locale policy concern because the skill imposes a specific language/locale experience on all users rather than offering choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill description does not justify invoking platform command discovery via which/where through execSync. Checking for external CLI availability is part of a system installer/bootstrapper, not an obvious requirement for a selfie image-editing and messaging skill itself.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/cli.js:151

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/suhe-selfie.ts:127

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skill/scripts/suhe-selfie.ts:127