Perstudio Image and Video Generation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:47 PM UTC
• Version: 3.2.1

Overview

The skill appears purpose-aligned for media generation, but it asks users to globally install a mutable third-party npm plugin that was not included for review.

Review the npm package and publisher before installing, prefer a pinned version or isolated install when possible, and configure the API key with least necessary access. Only upload files you intend to send to perstudio.ai.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Global Installation of an Unpinned, Unaudited Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8` and `SKILL.md:89` **Vulnerability Type**: Supply-chain exposure through an unpinned global dependency **Risk Level**: Medium ### Vulnerable Code At `SKILL.md:8`, the metadata instructs OpenClaw to install the package globally: ```yaml metadata: {"openclaw":{"requires":{"env":["PERSTUDIO_API_KEY"],"config":["plugins.entries.perstudio.config.apiKey"]},"primaryEnv":"PERSTUDIO_API_KEY","install":[{"id":"npm","kind":"node","package":"perstudio-openclaw","global":true,"label":"Install perstudio-openclaw"}],"emoji":"🎨"}} ``` The same global installation is explicitly documented at `SKILL.md:89`: ```bash npm install -g perstudio-openclaw ``` ### Technical Analysis The Skill instructs users or the OpenClaw environment to install `perstudio-openclaw` from the npm registry without an exact version, lockfile, or integrity hash. The package is also installed globally rather than being isolated as a project-local dependency. Because the audited artifact contains only `SKILL.md`, the package's source code, transitive dependencies, lifecycle scripts, and correspondence with the referenced GitHub repository cannot be verified. npm packages may execute lifecycle scripts during installation. An unpinned package reference resolves to whatever release the registry currently serves, allowing the effective installed code to change after this Skill has been reviewed. Global installation expands exposure by making the executable available outside an isolated project directory. It does not by itself grant elevated privileges, but package installation scripts execute with the privileges of the account performing the installation. If installation is performed by an administrator or through a privileged automation service, the potential impact increases accordingly. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a dependency used by `perstudio-openclaw`. 2. The ...[truncated 1543 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version instead of resolving the mutable latest release: ```bash npm install --save-exact perstudio-openclaw@3.2.1 ``` 2. Verify the selected package version and record its registry integrity hash in a lockfile or equivalent trusted installation manifest. 3. Include the plugin source, manifest, lockfile, and relevant build artifacts in the audited project so its implementation and transitive dependencies can be reviewed. 4. Prefer a project-local installation over a global installation and invoke the package through an explicitly controlled path. 5. Run installation and execution as a dedicated, least-privileged user without unnecessary access to credentials or sensitive files. 6. Review npm lifecycle scripts before installation and disable them with `--ignore-scripts` when they are not required. 7. Use dependency scanning, package provenance verification, and publisher-account protections such as multi-factor authentication and trusted publishing. 8. Ensure the referenced npm release is verifiably built from the stated source repository and reviewed commit. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says 'Just describe what you want,' which is a very broad natural-language trigger phrase that overlaps with ordinary conversation rather than a narrowly scoped invocation condition. The file does not provide explicit trigger constraints or negative examples that clarify when the skill should or should not activate.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The instruction 'Just describe what you want and perstudio routes it to the right model automatically' suggests the skill may activate on any free-form request without clarifying its boundaries. Because no exclusion conditions or specific trigger list is given, users and orchestrators may have difficulty distinguishing valid invocations from general chat.

Static analysis

No suspicious patterns detected.