Bento Grid Generator

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:57 AM UTC
• Version: 1.0.0

Overview

This skill is a small, disclosed image-generation helper with minor dependency and temporary-file hygiene risks.

Reasonable to install for local image generation. Prefer running it in a normal least-privileged environment, be aware it may overwrite /tmp/bento_grid.png, /tmp/stats_card.png, or /tmp/music_card.png, and consider pinning Pillow before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party Dependency Allows Unreviewed Package Changes## Vulnerability Details **File Location**: `SKILL.md:5-9` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: requires: bins: [python3] pip: [Pillow] ``` ### Technical Analysis The Skill declares `Pillow` without an exact version, integrity hash, lockfile, or explicit trusted package source. Consequently, dependency resolution is not reproducible: separate installations can retrieve different package versions that were not present when the Skill was reviewed. This does not establish that the current Pillow package is malicious. However, it creates a supply-chain exposure because a compromised upstream release, package repository, or dependency-resolution path could introduce code into the Agent environment. Python package installation may execute package build hooks, while imported package code runs with the privileges of the Agent process. ### Attack Path 1. An attacker compromises an upstream package release, repository account, distribution channel, or applicable dependency-resolution path. 2. A malicious or compromised package version becomes eligible under the unrestricted `Pillow` requirement. 3. The Skill environment resolves and installs that unreviewed version. 4. Malicious code executes during package installation, initialization, or import. 5. The code gains access to files, environment variables, network capabilities, and other resources available to the Agent process. ### Impact Assessment Exploitation could permit arbitrary code execution with the privileges of the account installing or running the Skill. The accessible scope would be limited by the Agent's operating-system permissions and sandbox controls, but could include workspace files, process environment variables, generated content, and network resources available to that account.
• Remediation: ## Remediation Suggestions - Pin Pillow to a specific version that has been reviewed and tested, for example with an exact `==` constraint. - Maintain a dependency lockfile or equivalent reproducible environment definition. - Require cryptographic hashes for downloaded distributions where the package-management workflow supports them. - Install dependencies only from an explicitly configured, trusted package index. - Regularly scan the pinned dependency for disclosed vulnerabilities and update it through a controlled review process. - Install and execute the Skill in a least-privileged, isolated environment with restricted filesystem and network access.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69
• Finding: Predictable Shared Temporary Filenames Permit Collisions and Symlink Redirection## Vulnerability Details **File Location**: `SKILL.md:69`, `SKILL.md:104`, and `SKILL.md:140` **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```python img.save('/tmp/bento_grid.png') ``` ```python img.save('/tmp/stats_card.png') ``` ```python img.save('/tmp/music_card.png') ``` ### Technical Analysis Each command writes to a fixed, predictable filename in the shared `/tmp` directory. The code neither creates the output file exclusively nor creates a private temporary directory. It also does not verify whether the destination already exists or resolves through a symbolic link. On systems where `/tmp` is shared between users, another local process may create one of these paths before the Skill runs. If the path is a symbolic link and the image-writing operation follows it, the generated image can overwrite or truncate another file writable by the Agent account. Independently of symbolic links, simultaneous or repeated invocations can overwrite each other's output and cause integrity failures. ### Attack Path 1. A local attacker predicts one of the documented paths, such as `/tmp/bento_grid.png`. 2. Before the Skill executes, the attacker creates that path as a symbolic link to a target file writable by the Agent process, or creates a colliding regular file. 3. The Skill calls `img.save()` without exclusive file creation or destination validation. 4. If symbolic links are followed, Pillow opens and writes to the resolved target; otherwise, a colliding output may still be overwritten. 5. The target file is replaced or corrupted with PNG data, or another invocation's generated output is destroyed. This exploitation path requires local access to the shared temporary namespace and a target that the Agent process is authorized to write. ### Impact Assessment A successful attack can corrupt or overwrite files within the Agent account's existing write permissio ...[truncated 311 chars]
• Remediation: ## Remediation Suggestions - Create a private temporary directory with Python's `tempfile.TemporaryDirectory()` and place generated images inside it. - Use randomized, exclusively created filenames rather than fixed paths in the shared `/tmp` namespace. - Where persistent output is required, accept an explicit destination inside an approved output directory and reject symbolic links or paths escaping that directory. - Open output files using secure exclusive-creation semantics and pass the resulting file object to Pillow where practical. - Set restrictive directory and file permissions appropriate to the generated content. - Return the generated randomized path to the caller instead of relying on a predictable global filename. - Do not execute the image-generation commands with elevated privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.