ClawHub
Back to skill

Security audit

LrshuAI Image To Image

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill appears functional, but it uploads prompts and media to a remote API using a bearer token while also telling the agent to bypass the normal OpenClaw runner.

Install only if you trust the `dlazy.com` service and are comfortable uploading the provided prompts, images, and possible videos to it. Use a dedicated low-privilege `TEAM_API_KEY`, avoid setting `TEAM_BASE_URL` unless you control the endpoint, and review the exact command before allowing direct Python execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()
Confidence
91% confidence
Finding
The request destination is taken from TEAM_BASE_URL without validation, and the script sends the Bearer API key plus prompt and possibly base64-encoded local media to that endpoint. If an attacker can influence the environment variable, they can redirect requests to an attacker-controlled server and exfiltrate credentials and user content.

Tainted flow: 'poll_endpoint' from os.getenv (line 132, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
while True:
            time.sleep(3) # 每3秒查询一次
            poll_resp = requests.get(poll_endpoint, headers=headers)
            poll_resp.raise_for_status()
            poll_data = poll_resp.json()
Confidence
89% confidence
Finding
The polling URL is derived from the same untrusted base URL and is queried repeatedly with Authorization headers attached. This compounds the exfiltration risk by continuing to disclose the API token and task metadata to an attacker-controlled host if the base URL is tampered with.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no explicit permissions, yet the metadata indicates access to environment variables and the instruction forces direct execution of a Python script that is likely to make outbound API calls using TEAM_API_KEY. This creates a transparency and least-privilege problem: reviewers and calling agents may underestimate the skill's ability to access secrets and communicate over the network.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a narrow image-to-image tool, but the behavior described by analysis is much broader, including arbitrary remote model invocation, video workflows, and remote URL inputs. This mismatch is dangerous because users and orchestrators may approve or route the skill under false assumptions, enabling unexpected data egress, broader attack surface, and misuse of more powerful capabilities than advertised.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script base64-encodes local image/video files and transmits them, along with the prompt, to a remote API, but the skill description does not clearly disclose this data upload behavior. In an agent-skill context, undisclosed exfiltration of local content is security-relevant because users may assume local references are handled locally.

Static analysis

No suspicious patterns detected.