Security audit

Meitu Skills

Security checks across malware telemetry and agentic risk

Overview

The package is a coherent Meitu media-generation integration, but it needs review because it can use stored API credentials, upload user media/context to Meitu, and persist or reuse personal visual profile data with uneven consent controls.

Install only if you are comfortable with Meitu API credentials being available to the CLI, user media and prompt/context summaries being sent to Meitu OpenAPI, and local visual memory/profile files being created or updated. Prefer environment variables over a persistent credentials file, avoid sensitive portraits/documents unless necessary, and review or disable the ./visual and ~/.openclaw/workspace/visual memory/profile files if you do not want long-lived personalization.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (263)

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The skill declares read-only access to a credentials file, but also instructs use of `meitu auth login`, which commonly creates or updates local session artifacts outside the declared permission model. That mismatch can lead operators or agent runtimes to perform unintended state-changing authentication flows and persist sensitive session data without explicit approval in the skill contract.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The template explicitly tells the model to generate a prompt beginning with the platform name, which contradicts earlier prohibitions on including platform names anywhere in the final prompt. This creates instruction inconsistency that can cause policy bypass, prompt leakage into downstream image generation, or unintended brand/platform text appearing in outputs.

Scope Creep

Medium

Confidence: 95% confidence
Finding: The workflow documentation explicitly instructs reading `$VISUAL/assets/` when `DESIGN.md` references project assets, but that path is not included in the declared `file_read` permissions. This creates a mismatch between documented behavior and declared access scope, encouraging undeclared data access and weakening permission boundaries for project files.

Scope Creep

Medium

Confidence: 96% confidence
Finding: The one-off workflow resolves `output_dir` to `$VISUAL/output/meitu-game-2d-assets/`, but the declared `file_write` permissions only cover `./output/` and memory/rules paths, not `$VISUAL/output/`. This discrepancy can lead the agent to write outside its declared write scope, bypassing intended filesystem controls and surprising users about where data is stored.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill claims results are written only to ./output/ or $VISUAL/output/meitu-id-photo/, but its declared write permissions and Record workflow also allow modifying DESIGN.md, quality rules, and persistent visual-memory files. This mismatch weakens user consent and can let a photo-editing skill persist or alter unrelated project state beyond what a user would reasonably expect.

Scope Creep

Medium

Confidence: 93% confidence
Finding: The workflow directs the agent to read several bundled reference files such as design-constraints, industry-styles, creative-framework, and output/poster analysis guides, but those reads are not reflected in the declared file_read permissions. This creates a spec/permission mismatch where the runtime behavior can exceed the reviewed manifest, undermining least-privilege review and making it harder to reason about what data the skill may access.

Scope Creep

Low

Confidence: 95% confidence
Finding: The workflow says project mode may additionally read platform rule and brand asset directories, but those paths are absent from the metadata requires.read list even though some appear later in the requirements block. A mismatch between declared metadata permissions and actual reads weakens trust boundaries and can cause the orchestrator or reviewer to miss data exposure paths.

Scope Creep

High

Confidence: 98% confidence
Finding: The Refine step introduces use of image-edit, but the declared exec permissions only authorize the meitu command set documented earlier and do not explicitly include this capability. Undeclared command capability expansion is dangerous because it grants the skill a materially broader execution surface than reviewers and policy enforcers may expect.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The protocol mixes two storage models: it says memory operations must be skipped when the visual workspace is absent, but later allows project creation in the current directory as a fallback. That inconsistency can cause data to be written outside the expected controlled path, increasing the chance of accidental persistence, leakage into unrelated repos, or unsafe path assumptions by downstream tooling.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file states that PROFILE.md should contain only confirmed facts, but the template explicitly allows storing 'identified from reference photo' key features and 'extracted from user's positive feedback' tone. That creates a policy contradiction that can cause the agent to persist inferred or subjective attributes as if they were factual, which is a privacy and integrity risk in a profile/memory system.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The workflow explicitly instructs the agent to extract features from a generated result and write them to ./visual/PROFILE.md on first use, creating persistent biometric/profile storage without any documented consent, retention policy, or stated necessity. In a visual-generation skill, inferred appearance traits and identity details are sensitive personal data; silently persisting them increases privacy risk and broadens the blast radius of any later misuse or compromise.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill clearly invokes an external Meitu CLI/API for portrait generation, which implies user-supplied images and prompts are sent to a third-party service, but the user-facing workflow/output sections do not clearly disclose that transfer. For portrait and pet images, this creates a meaningful privacy risk because sensitive biometric or personal images may leave the local environment without explicit informed consent.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: Automatically translating non-Chinese/English group-photo instructions into Chinese without opt-in can alter user intent and silently expose prompts to an additional transformation step the user did not request. This is risky in a portrait-generation context because subtle prompt changes can materially affect likeness, consent boundaries, or policy-sensitive content.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger description is broad enough to activate on many ordinary design-related requests, which can cause the agent to invoke this skill unexpectedly. Because the skill reads local credential material and executes an external CLI, over-broad activation increases the chance of unnecessary tool use and unintended access to privileged resources.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The routing rules rely on ambiguous keywords like '海报' and 'Banner' without sufficient constraints, so unrelated or borderline requests may still route here. In this skill's context, misrouting is security-relevant because activation leads to external command execution and potential use of API credentials and local file permissions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill metadata declares access to credential files and external command execution, but the user-facing description does not disclose these sensitive behaviors. This reduces informed consent and can mislead users into triggering a skill that consumes privileged API credentials and interacts with local files.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The delivery/output section describes writing and renaming generated files on disk, but this side effect is not clearly surfaced as a user warning. While lower severity than credential access, undisclosed filesystem writes can still surprise users and create privacy, overwrite, or data-management issues.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill sends user-provided images to external Meitu APIs and saves resulting files to disk, but the user-facing description and workflow do not clearly disclose this data transfer and persistence. This creates a privacy and transparency risk, especially for sensitive or personal images, because users may not realize their content leaves the local environment and is retained in output directories.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger description is very broad and overlaps with many ordinary image-editing requests, which increases the chance the skill is auto-invoked without the user realizing it will call an external CLI and send image inputs to a third-party service. In context, that matters because the skill also has credential access, execution privileges, and filesystem write permissions, so accidental invocation expands the attack surface.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill requests sensitive capabilities—reading local credential files, executing an external binary, and writing files—but the user-facing description does not disclose these behaviors. That omission can mislead users into approving or triggering the skill without informed consent, especially since images and associated prompts may be processed by an external service.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger list is very broad and includes common phrases like changing a name, title, or price, which can cause the skill to activate for ordinary conversations without clear user intent to run an external image-editing workflow. In context, that matters because this skill also reads local configuration/credential files, invokes a CLI, and writes outputs, so accidental invocation expands the chance of unintended side effects.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill declares access to credential files, execution of an external binary, and file writes, but the user-facing description does not clearly disclose these behaviors. This reduces informed consent and can mislead users about the operational and privacy implications of invoking the skill.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill clearly routes user-supplied images to an external Meitu service and depends on API credentials read from environment variables or local credential files, but the user-facing description does not explicitly disclose either fact. This creates a privacy and consent gap: users may provide sensitive images without understanding they will leave the local environment, and operators may not realize credential material will be accessed.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The skill writes transformed images to persistent local directories, but the description does not clearly warn users that files will be saved on disk under ~/.openclaw/workspace/visual/ or ./output/. This can surprise users handling confidential images and increase residual data exposure on shared systems.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The protocol instructs the agent to create directories/files and persist user preference observations automatically when the user gives style-approval feedback, but it does not require an explicit notice or consent at the moment of capture. This creates a privacy and transparency risk because users may not realize their feedback is being stored as memory, and the later non-blocking promotion prompt does not mitigate the initial undisclosed write.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: meitu-tools/SKILL.md:62

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/routing-guide.md:81

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:23