ClawHub
Back to skill

Security audit

Jimeng AI Image Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Jimeng/Volcengine media-generation skill, but prompts are sent to Volcengine and the configured Jimeng API key is read for authentication.

Install only if you are comfortable sending prompts and generated-media requests to Volcengine using your Jimeng credentials. Store the AccessKeyId and SecretAccessKey only in the intended OpenClaw token manager, avoid sensitive prompts or proprietary images unless Volcengine handling is acceptable, and prefer explicit output paths in private directories.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.py:127
Finding

Unvalidated Retrieval of an API-Provided Media URL

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate.py:137
Finding

Predictable Output Files Allow Symlink-Based File Overwrite

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documentation overstates functionality and omits important behavior, including external credential usage and capabilities that appear unsupported by the implementation summary. Description-behavior mismatches are dangerous because users may trust the declared purpose while the skill accesses local secrets or behaves differently than expected, undermining informed consent and security review.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_jimeng.py (reported line 10)May include surrounding context.

python
SERVICE = "cv"

def get_credentials():
    """从 secrets.json 获取凭证"""
    secrets_file = os.path.expanduser("~/.openclaw/workspace/secrets.json")
    try:
        with open(secrets_file, encoding="utf-8") as f:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_jimeng.py (reported line 11)May include surrounding context.

python
SERVICE = "cv"

def get_credentials():
    """从 secrets.json 获取凭证"""
    secrets_file = os.path.expanduser("~/.openclaw/workspace/secrets.json")
    try:
        with open(secrets_file, encoding="utf-8") as f:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 18)May include surrounding context.

python
SERVICE = "cv"

def get_credentials():
    """从 secrets.json 获取凭证"""
    secrets_file = os.path.expanduser("~/.openclaw/workspace/secrets.json")
    try:
        with open(secrets_file, encoding="utf-8") as f:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 96)May include surrounding context.

python
SERVICE = "cv"

def get_credentials():
    """从 secrets.json 获取凭证"""
    secrets_file = os.path.expanduser("~/.openclaw/workspace/secrets.json")
    try:
        with open(secrets_file, encoding="utf-8") as f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes Python scripts that call an external API, so it has network capability, but the manifest does not declare any tool scope such as permissions or allowed-tools. This weakens reviewability and least-privilege controls, making it easier for a user or platform to misunderstand what the skill can transmit externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill states it uses the Volcengine API for image/video generation but does not clearly warn that user prompts and possibly input/generated media are transmitted to an external service. This is a privacy and compliance issue because users may unknowingly send sensitive business data, personal data, or proprietary images off-platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The official example explicitly instructs that the generated step-by-step tutorial text "要中文". This is a natural-language locale constraint presented as a directive, and the file does not offer any user choice or explain a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Natural-language strings such as the module docstring and CLI help text force a specific language/locale for all users. The file does not offer an alternative language, locale selection, or indicate that the restriction is region-specific and intentional.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script sends the user-provided --prompt value to the external Volcengine API as part of the request body. While the network call is visible in code, there is no explicit user-facing warning that prompt content leaves the local system, and the module docstring only describes output behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script's title, argument descriptions, and operational messages are presented in Chinese, which imposes a specific language on users without opt-in or documented locale scope. This matches the language/locale policy concern for natural-language content embedded in code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains natural-language strings for the title and argument help in Chinese only, such as the module docstring and argparse descriptions. The policy disallows forcing a specific language without user opt-in, and this file provides no alternative locale selection or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill instructs users to use stored API credentials but does not warn about secret handling, storage sensitivity, or the risk of exposing AccessKeyId and SecretAccessKey through logs, shell history, or misconfigured files. While this is documentation-level rather than direct code execution risk, it increases the chance of credential leakage and misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The function loads AccessKeyId and SecretAccessKey from a user-local secrets file, which is access to sensitive credentials. Although there is an internal docstring, there is no user-facing prompt, warning, or other disclosure in this file explaining that credentials will be read for API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The call_api function serializes body_dict and sends it to https://visual.volcengineapi.com over the network. This is a data-transmitting operation, but the file does not include a user-facing warning, confirmation, or other visible disclosure about external transmission of request content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The code accesses ~/.openclaw/workspace/secrets.json and extracts AccessKeyId and SecretAccessKey, but the surrounding documentation and comments do not warn users that local credentials will be read. This qualifies as sensitive credential access lacking user disclosure under the rule.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file performs a network API call using the user's prompt content, which may contain sensitive or private text. Although it prints the prompt and indicates image generation, it does not explicitly warn the user that their input is being transmitted to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The natural-language strings describing the skill and its arguments are written only in Chinese, including the module docstring and CLI help text. Under the policy, locale or language constraints should not be forced without user opt-in unless clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.