ClawHub
Back to skill

Security audit

Precision Coral Metrics API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward coral-image analysis integration that uploads user-selected images to the OpenClaw API and does not show hidden persistence or deceptive behavior.

Install only if you are comfortable sending selected reef images and an OpenClaw token to the OpenClaw API Gateway. When using the example script, pass non-sensitive filenames and run it from a directory where overwriting coral_inference_result.jpg would not matter.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Note
Location
usage_example.py:29
Finding

Local File Path Disclosure Through Multipart Filename

Content
View full analysis

Vulnerability Details

File Location: usage_example.py, lines 29-32
Vulnerability Type: Local path information disclosure
Risk Level: Low

Vulnerable Code:

python
with open(image_path, 'rb') as f:
    files = {'file': (image_path, f, 'image/jpeg')}
    print(f"Uploading image to the OpenClaw Gateway...")
    response = requests.post(target_url, files=files, headers=headers, timeout=60)

Technical Analysis

The caller-controlled image_path is used both to open the local image and as the filename in the multipart upload. The requests library includes the supplied filename in the multipart Content-Disposition metadata.

If image_path is an absolute path or contains directory components, this may disclose local environment information to the remote OpenClaw API, including usernames, directory structures, project names, mount points, or organizational naming conventions. The remote service only requires the image contents and does not need the complete local path.

Attack Path

  1. A caller invokes call_coral_ai_skill() with a path such as /home/alice/confidential-project/reef.jpg.
  2. The function opens the image locally.
  3. The complete path is assigned as the multipart filename.
  4. requests.post() transmits this filename in the multipart request metadata.
  5. The remote API or its request logs receive and may retain the local path.

Impact Assessment

Exploitation does not grant additional privileges or code execution. It can disclose low-sensitivity workstation or server metadata to the configured remote service. This information may support reconnaissance by revealing usernames, project identifiers, filesystem organization, or deployment details. The scope is limited to path information supplied through image_path.

Remediation
View remediation

Remediation Suggestions

Use only a sanitized basename as the multipart filename, or use a fixed generic filename:

python
import os

with open(image_path, "rb") as f:
    upload_name = os.path.basename(image_path)
    files = {"file": (upload_name, f, "image/jpeg")}
    response = requests.post(
        target_url,
        files=files,
        headers=headers,
        timeout=60,
    )

For stronger metadata minimization, use a constant such as upload.jpg. Validate that the source path refers to an expected regular file before opening it.

T09 · Insecure Skill Coding Practices

Warning
Location
usage_example.py:40
Finding

Unconditional Overwrite of Fixed Local Output File

Content
View full analysis

Vulnerability Details

File Location: usage_example.py, lines 40-44
Vulnerability Type: Unsafe fixed output path and file overwrite
Risk Level: Medium

Vulnerable Code:

python
if 'result_image' in res:
    img_data = base64.b64decode(res['result_image'])
    with open("coral_inference_result.jpg", "wb") as f:
        f.write(img_data)
    print("🖼️ Visual output saved: coral_inference_result.jpg")

Technical Analysis

Whenever the API response contains result_image, the function writes decoded response data to the fixed relative path coral_inference_result.jpg. Opening the file with mode wb silently truncates any existing file at that location.

The destination depends on the process working directory rather than an explicit caller-approved output location. The code performs no collision check, does not require confirmation before replacement, and does not reject symbolic links. In an environment where another local user or process can manipulate the working directory, a pre-created symbolic link named coral_inference_result.jpg may redirect the write to another file writable by the process.

Attack Path

Existing-file overwrite path:

  1. A file named coral_inference_result.jpg already exists in the working directory.
  2. The remote API returns a successful JSON response containing result_image.
  3. The client Base64-decodes the remote value.
  4. The file is opened using wb, immediately truncating its previous contents.
  5. The decoded API response replaces the original data.

Symbolic-link redirection path:

  1. An attacker with write access to the working directory creates coral_inference_result.jpg as a symbolic link to another file writable by the skill process.
  2. The user runs the example from that directory.
  3. A successful API response includes result_image.
  4. Python follows the symbolic link when opening the fixed output path.
  5. The linked f ...[truncated 630 chars]
Remediation
View remediation

Remediation Suggestions

Require an explicit output path and refuse to overwrite existing files by default. Use exclusive creation mode and place output in a trusted directory:

python
from pathlib import Path

output_path = Path(output_file).resolve()
output_path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)

img_data = base64.b64decode(res["result_image"], validate=True)
with output_path.open("xb") as f:
    f.write(img_data)

Additional hardening should include:

  • Generate a unique filename when the caller does not provide one.
  • Verify that the destination directory is trusted and not writable by untrusted users.
  • Reject symbolic-link destinations and avoid check-then-open races by using secure OS-level file-opening flags where necessary.
  • Impose a maximum decoded image size before writing to prevent excessive disk or memory consumption.
  • Use base64.b64decode(..., validate=True) to reject malformed Base64 input.
  • If overwriting is required, make it an explicit caller-selected option.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
# ================= Integration Guide for OpenClaw Developers =================
# Skill: Precision Coral Metrics API (YOLO+SAM)
# Endpoint: https://api.openclaw.io/v1/skills/coral-precise-coverage-ai/predict
# Authentication: Access must be routed via OpenClaw Gateway with valid Tokens
# ============================================================================

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · usage_example.py (reported line 7)May include surrounding context.

python
# ================= Integration Guide for OpenClaw Developers =================
# Skill: Precision Coral Metrics API (YOLO+SAM)
# Endpoint: https://api.openclaw.io/v1/skills/coral-precise-coverage-ai/predict
# Authentication: Access must be routed via OpenClaw Gateway with valid Tokens
# ============================================================================

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · usage_example.py (reported line 20)May include surrounding context.

python
# ================= Integration Guide for OpenClaw Developers =================
# Skill: Precision Coral Metrics API (YOLO+SAM)
# Endpoint: https://api.openclaw.io/v1/skills/coral-precise-coverage-ai/predict
# Authentication: Access must be routed via OpenClaw Gateway with valid Tokens
# ============================================================================

Static analysis

No suspicious patterns detected.