Security audit
Security checks for vulnerabilities and agentic risk
This skill’s image generation goal is coherent, but it has review-worthy risks around external sending, broad triggers, mutable installer execution, and credential handling.
Review this skill carefully before installing. Prefer ClawHub or a pinned clone over the curl-to-bash installer, use dedicated low-scope API keys, avoid sensitive prompts or personal reference images, keep HF_API_BASE fixed to the official Hugging Face endpoint, and require explicit confirmation before sending generated images to any channel.
README.md:179Mutable Remote Installer Is Executed Without Integrity Verification
scripts/clawra-selfie.sh:232Hugging Face Bearer Token Can Be Sent to an Arbitrary Configured Origin
scripts/clawra-selfie.sh:191Gemini API Key Is Exposed Through the Process Command Line
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- 不要把私人参考图和训练候选集提交到公开仓库
- 检查 `.gitignore` 是否覆盖生成物、数据集、临时文件
- 在公开演示图前，先确认图中不包含隐私信息
- 对 `curl | bash` 安装方式保持基本审查习惯
## 项目当前安全定位
The script has broad shell execution capability and performs network access, filesystem reads/writes, and message sending, yet the finding indicates those capabilities are not covered by declared permissions. In an agent skill ecosystem, this is a real security issue because users and policy controls may not be able to accurately constrain or review what the skill can do before execution.
The wrapper forwards the full parent process environment to an external shell script, which can expose secrets such as API keys, tokens, proxy settings, or credentials to code outside the declared permission model. In a skill that already invokes another script, undeclared environment access expands the trust boundary and makes accidental or intentional secret leakage more dangerous.
The README instructs users to configure remote image-generation backends and upload a reference face image, but it does not clearly warn that prompts, captions, and potentially sensitive reference images will be transmitted to third-party providers such as Qwen, Hugging Face, or Gemini. In a skill centered on selfie generation and identity-consistent character images, that omission increases privacy and consent risk because users may unknowingly send personal or biometric-like data off-platform.
The skill description does not clearly warn that user prompts may be sent to external image providers and that resulting images may be transmitted to external messaging platforms. That lack of transparency can cause users to unknowingly share sensitive context, personal descriptions, or generated content with third parties, which is particularly relevant here because the workflow explicitly supports multiple external providers and outbound channel delivery.
The trigger phrases are broad enough to fire on ordinary conversation such as 'how are you doing?' or 'where are you?', which can cause the skill to generate and send an image when the user did not clearly request image creation or external sharing. In this skill, that risk is amplified because activation can invoke third-party image backends and OpenClaw messaging channels, creating unintended data disclosure and surprising external actions.
The manifest describes generating Clawra-style selfie images with model backends and sending them via OpenClaw. In addition to that, the script scans fixed local filesystem paths for 'official face reference' images and uses their existence to shape behavior, which is a local file access capability not disclosed in the stated purpose.
This outbound request transmits the fully assembled prompt, which includes user-provided context, to an external DashScope/Qwen service. The risk is contextual privacy leakage and third-party data exposure, not code execution, but it is still a real vulnerability when users are not clearly warned.
QWEN_RESULT_JSON="$WORKDIR/qwen-result.json"
jq -n --arg model "$QWEN_IMAGE_MODEL" --arg prompt "$FINAL_PROMPT" '{model:$model,input:{prompt:$prompt},parameters:{size:"1024*1024"}}' > "$QWEN_REQ_JSON"
log_info "Trying Qwen image model: $QWEN_IMAGE_MODEL"
QWEN_HTTP_CODE=$(curl -sS \
-o "$QWEN_RESP_JSON" \
-w '%{http_code}' \
-X POST "https://dashscope.aliyuncs.com/api/v1/services/aigc/text2image/image-synthesis" \
The script sends user-supplied prompt context and model request data to third-party services (Qwen, Gemini, Hugging Face) without an execution-time disclosure or confirmation. This creates a privacy and data-governance risk, especially if users include sensitive personal or channel-specific information in the prompt.
This request sends prompt content to Google's Gemini API and includes the API key in the request URL query string. Besides normal third-party disclosure risk, query-string secrets are more likely to be captured in logs or intermediaries than header-based secrets.
GEMINI_PAYLOAD="$WORKDIR/gemini-payload.json"
jq -n --arg text "$FINAL_PROMPT" '{contents:[{parts:[{text:$text}]}], generationConfig:{responseModalities:["TEXT","IMAGE"]}}' > "$GEMINI_PAYLOAD"
log_info "Trying Gemini image model: $GEMINI_IMAGE_MODEL"
GEMINI_HTTP_CODE=$(curl -sS \
-o "$GEMINI_RESP_JSON" \
-w '%{http_code}' \
-X POST "https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_IMAGE_MODEL}:generateContent?key=${GEMINI_API_KEY}" \
This request sends prompt content to a Hugging Face inference endpoint, and the base URL is overridable via HF_API_BASE. That means the script can be directed to send prompts and bearer tokens to a nonstandard endpoint if the environment is manipulated, increasing exfiltration risk beyond ordinary third-party processing.
RESP_HEADERS="$WORKDIR/headers.txt"
IMAGE_PATH="$WORKDIR/output.bin"
HF_HTTP_CODE=$(curl -sS \
-D "$RESP_HEADERS" \
-o "$IMAGE_PATH" \
-w '%{http_code}' \
The manifest describes generating selfie images and sending them via OpenClaw, which would naturally involve image/model and messaging operations. In this file, the implementation delegates to an external script using child_process.execFile, introducing process-spawning capability that is not itself justified by the stated purpose and expands execution power beyond what the description suggests.
The script invokes an external shell script via execFileAsync, which is a safety-relevant operation for code files. Although there is basic usage output, there is no confirmation prompt, user-facing disclosure of what the subprocess will do, or inline documentation explaining the execution and its effects.
Passing process.env directly to the child process exposes all inherited environment variables to the shell script, including secrets unrelated to selfie generation. Because the child is a shell script and may call additional tools or services, this broad propagation materially increases the chance of credential leakage, misuse, or exfiltration.
Line L53 instructs contributors to keep new documentation consistent with a Chinese README style, which imposes a language preference in natural-language policy without an explicit opt-in or clear region-specific justification. This matches the policy-violation category for language or locale constraints.
The natural-language content of the README is effectively Chinese-only, including setup, usage, and safety-relevant instructions. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is clearly documented and justified.
This markdown file presents all substantive guidance in Chinese and does not indicate that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a natural-language policy concern.
The primary script example uses a fixed Chinese caption ('Raya 的自拍 ✨'), which may indicate a default language choice not explicitly offered to the user. If the skill defaults to Chinese captions or responses regardless of user preference, that would conflict with language-choice expectations.
The example shell usage hard-codes a Chinese-language caption string (健身房状态 ✨). In a README, this natural-language example can imply a default or expected locale without offering a language choice, which conflicts with the policy against forcing a specific language absent opt-in or justification.
The script reads QWEN_API_KEY, HF_TOKEN, and GEMINI_API_KEY to authenticate outbound requests. While the header comments list these variables as required inputs, there is no explicit warning or disclosure to the user during execution about using stored credentials to contact external services.
The script automatically sends the generated file and caption to the supplied channel through the openclaw CLI with no confirmation step. If invoked with the wrong channel or maliciously supplied arguments, it can cause unintended disclosure or spam in messaging destinations.
The default caption is hardcoded as "Raya 的自拍 ✨", which imposes a Chinese-language output when the user does not provide a caption. This is a natural-language policy issue because the skill does not offer language choice or obtain user opt-in for the locale/language.
No suspicious patterns detected.