Picgo Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 0.1.0

Overview

This skill is a small, disclosed helper for uploading local images through a local PicGo service, with low-risk supply-chain and packaging caveats.

Before installing, confirm that the missing picgo_skill.py implementation is supplied by the package or otherwise trusted, and prefer pinned dependency installation if you want reproducible installs. Only set PICGO_SERVER_URL to a PicGo server you control because uploaded image contents will be sent there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:13

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned dependency retrieved from an external package index
Risk Level: Low

Vulnerable Code

bash

pip install requests

Technical Analysis

The installation instruction retrieves requests and its dependency set without specifying reviewed versions or verifying package hashes. As a result, the installed code depends on the mutable state of the configured Python package index at installation time.

This does not establish that the legitimate requests package is malicious. However, the absence of version constraints and integrity verification increases supply-chain exposure. A compromised package-index account, malicious index mirror, altered artifact, or unexpectedly incompatible future release could cause users to install code that was not reviewed as part of this skill.

The referenced runtime script, ~/.openclaw/skills/picgo-skill/picgo_skill.py, is absent from the audited project, so its imports and runtime behavior could not be verified.

Attack Path

1. A user follows the dependency-installation instruction in SKILL.md.
2. pip connects to the user's configured package index or mirror.
3. Because no version or artifact hash is specified, pip resolves the dependency from the index state available at that time.
4. If the selected package artifact or configured index has been compromised, attacker-controlled package code may be installed.
5. Malicious package code could execute during installation if the package includes an applicable build process, or later when imported by the missing skill script.

This path requires compromise or malicious control of an upstream package source, configured mirror, or resolved artifact; the audited file alone does not perform such a compromise.

Impact Assessment

Potential impact is limited by the privileges of the user running pip or importing the package. Under a compromised-dependency scenario ...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to versions that have been reviewed and tested.
• Maintain dependencies in a lock file generated through a controlled build process.
• Require artifact hashes, for example by using pip install --require-hashes -r requirements.txt.
• Configure an explicitly trusted package index and avoid untrusted or undocumented mirrors.
• Regularly scan locked dependencies for known vulnerabilities and update them through a reviewed process.
• Include the referenced picgo_skill.py implementation in the project so its dependency use and image-upload behavior can be audited.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep