xAI Image Generator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:19 AM UTC
• Version: 1.0.0

Overview

This is a coherent xAI image-generation skill with disclosed API use, but users should handle the API key carefully and note that the packaged main executable is missing from the inspected artifact.

Install only if you are comfortable sending prompts and generated-image requests to xAI with your xAI API key. Avoid putting the key in shared dotfiles or synced shell profiles, prefer a per-session export or secret manager, and be aware this reviewed package appears to be missing the documented xai-gen executable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: test.sh:39

Finding

Overbroad Wildcard Deletion Can Remove Unrelated User Files

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Non-Reproducible Third-Party Dependency Installation

Content

View full analysis

=2.28.0 ``` The project documentation directs users to install this specification with commands such as: ```bash pip3 install -r requirements.txt ``` ### Technical Analysis The lower-bound-only constraint permits pip to install any current or future `requests` release satisfying `>=2.28.0`. No exact version, lock file, upper bound, or package hash is provided. As a result, an installation performed later may resolve to dependency code that was not present during this audit. Transitive dependencies are also not locked or integrity-checked. This weakens build reproducibility and increases exposure to future package-index compromise, compromised releases, or incompatible dependency changes. The package name is the legitimate `requests` name; there is no evidence of typosquatting, dependency confusion, or a currently malicious package in the audited files. The risk arises from unconstrained future resolution rather than a confirmed malicious dependency. ### Attack Path 1. A user follows the documented installation procedure. 2. pip queries the configured package index and resolves the newest version satisfying `requests>=2.28.0`, together with its transitive dependencies. 3. If a future eligible release or dependency is compromised, pip downloads and installs that unreviewed code. 4. The code executes when imported by the Skill or may execute through packaging and installation mechanisms. 5. It runs with the permissions of the user performing installation or invoking the Skill. Successful exploitation depends on an upstream release, package index, mirror, or dependency being compromised. No such compromise was established during this audit. ### Impact Assessment A compromised resolved dependency could potentially execute code with the installing or ...[truncated 419 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Navigate to skills directory cd ~/.openclaw/workspace/skills

Clone or copy this skill

(or install via clawhub when published)

Install dependencies

pip3 install requests

Ensure the script is executable

chmod +x xai-image-gen/xai-gen

text

**Set your xAI API key:**

```bash
export XAI_API_KEY="your-api-key-here"

Add to your shell profile (~/.bashrc, ~/.zshrc) to persist:

bash

echo 'export XAI_API_KEY="your-api-key-here"' >> ~/.bashrc

Usage

Basic Usage

bash

# Generate with simple prompt
xai-gen "sunset over mountains"

# Custom filename
xai-gen "cyberpunk city" --filename city.png

# Generate multiple images
xai-gen "futuristic vehicle" --n 3

# Base64 output (no download)
xai-gen "logo design" --format b64

# Verbose mode
xai-gen "space station" --verbose

Options

text

positional arguments:
  prompt                Text description of the image to generate

options:
  -h, --help            Show help message
  --model MODEL         Model name

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 69)May include surrounding context.

md

## API Details

- Endpoint: https://api.x.ai/v1/images/generations
- Model: grok-imagine-image
- Authentication: Bearer token (XAI_API_KEY)
- Output: JPEG images via URL or base64

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SUMMARY.md (reported line 85)May include surrounding context.

md

## API Details

- Endpoint: https://api.x.ai/v1/images/generations
- Model: grok-imagine-image
- Authentication: Bearer token (XAI_API_KEY)
- Output: JPEG images via URL or base64

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The instruction to store the API key in ~/.bashrc or ~/.zshrc encourages long-lived credential persistence in shell startup files, which increases the chance of accidental disclosure through backups, dotfile sync, over-broad file permissions, or shell/config sharing. While common, this practice weakens secret hygiene because the token remains available across future sessions and unrelated shell usage.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 79)May include surrounding context.

API Key Error:

bash

export XAI_API_KEY="xai-your-key-here"
# Add to ~/.bashrc or ~/.zshrc for persistence

Permission Error:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill clearly sends user prompts and receives generated images from an external xAI service, but the description does not prominently warn users that their content is transmitted off-host. This creates a privacy and data-handling risk because users may submit sensitive prompts or expect purely local processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The documented endpoint confirms that this skill transmits user-supplied prompts and authentication data to a third-party API over the network. External transmission is expected for this functionality, but it still represents a real security/privacy concern if users are not clearly informed or if sensitive data is entered.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

## API Details

- **Endpoint:** `https://api.x.ai/v1/images/generations`
- **Model:** `grok-imagine-image`
- **Authentication:** Bearer token via `XAI_API_KEY`
- **Rate Limits:** Subject to xAI API limits (check xAI docs)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.28.0, which allows any future version and does not guarantee reproducible or reviewed installs. This can introduce vulnerable or breaking releases into deployments and makes it difficult to verify exactly which package version is in use.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The manifest references requests without pinning an exact version, while known advisories exist for some releases of that package. Because the installed version is not fixed, the environment may resolve to a vulnerable release or may change over time, preventing reliable assessment of exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.