图像生成 / Image Generation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:15 PM UTC
• Version: 1.1.4

Overview

The skill’s image-generation purpose is coherent, but it tells the agent to send a Coze API key and prompts to a configurable endpoint and to download returned URLs without validation.

Install only if you trust the Coze configuration source and understand that your prompts and Coze API token will be used for external API calls. Pin the endpoint to an official HTTPS Coze domain, protect the credential config file, and validate downloaded image URLs before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66
• Finding: Bearer Credential Forwarded to an Unvalidated Configurable Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–78 **Vulnerability Type**: Unvalidated API endpoint and credential disclosure **Risk Level**: Medium ### Vulnerable Code ```bash # 1. 读取配置 / Read config WORKFLOW_ID=$(jq -r '.workflow_id' ~/.openclaw/skills/image_gen_coze/config.json) COZE_CONFIG=~/.openclaw/skills/coze_workflow/config.json API_KEY=$(jq -r '.api_key' "$COZE_CONFIG") BASE_URL=$(jq -r '.base_url // "https://api.coze.cn"' "$COZE_CONFIG") # 2. 构建 prompt / Build prompt PROMPT="一只可爱的橘猫在窗台上晒太阳，温暖的光线，写实摄影风格 --ar 1:1" # 3. 调用 coze_workflow 执行 / Execute result=$(curl -s -X POST "${BASE_URL}/v1/workflow/stream_run" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ ``` ### Technical Analysis The documented implementation obtains both `api_key` and `base_url` from the dependency configuration. It then sends the API key in an `Authorization: Bearer` header to the configured endpoint without validating its scheme or hostname. This creates a credential-forwarding weakness. Any party capable of modifying `~/.openclaw/skills/coze_workflow/config.json` can replace `base_url` with an attacker-controlled URL. The next invocation will disclose the bearer credential and submitted prompt to that server. A non-HTTPS endpoint could also expose these values to network interception. This issue does not independently grant configuration-file modification privileges. Exploitation requires influence over the dependency configuration or another mechanism that controls `base_url`. ### Attack Path 1. An attacker obtains the ability to alter the Coze dependency configuration. 2. The attacker sets `base_url` to an endpoint under their control, such as `https://attacker.example`. 3. A user or agent invokes the image-generation workflow. 4. The Skill constructs a request to `https://attacker.example/v1/workflow/stream_run`. 5. The request includes the victim's Coze API key in the bearer authorization header. 6. The ...[truncated 647 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject endpoint values that do not use HTTPS. 2. Parse the endpoint and enforce an explicit hostname allowlist, such as `api.coze.cn`. 3. Do not send credentials to arbitrary endpoints selected from a mutable configuration file. 4. Associate each credential with a fixed approved service origin. 5. Reject URLs containing user information, unexpected ports, malformed hosts, or IP-address literals unless explicitly required. 6. Configure redirects conservatively and ensure authorization headers are never forwarded to a different origin. 7. Restrict dependency-configuration permissions so only the owning user can read or modify the file. 8. Fail closed when the endpoint is missing or invalid instead of silently accepting an untrusted value. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:88
• Finding: Unvalidated Workflow URL Download Permits Unintended Network Requests and Unbounded File Writes<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 88–100 **Vulnerability Type**: Unvalidated remote URL download and resource exhaustion **Risk Level**: Medium ### Vulnerable Code ```bash # 4. 解析结果 / Parse result data=$(echo "$result" | sed 's/^data: //') content=$(echo "$data" | jq -r '.content') image_url=$(echo "$content" | jq -r '.output // empty') # 5. 下载并保存 / Download and save if [ -n "$image_url" ]; then SAVE_DIR="./generated_images" mkdir -p "$SAVE_DIR" TIMESTAMP=$(date +%Y%m%d_%H%M%S) PREFIX=$(echo "$PROMPT" | sed 's/[^a-zA-Z0-9\u4e00-\u9fa5]//g' | cut -c1-10) FILENAME="${TIMESTAMP}_${PREFIX}.png" FILEPATH="${SAVE_DIR}/${FILENAME}" curl -s -L "$image_url" -o "$FILEPATH" fi ``` ### Technical Analysis The value of `image_url` is derived from the remote workflow response and passed directly to `curl`. The command follows redirects with `-L` but does not validate the URL scheme, destination hostname, redirect targets, content type, response size, or file signature. It also lacks explicit connection and transfer timeouts. A compromised or malicious workflow endpoint can therefore induce the host to request unintended URLs. Depending on the protocols supported by the installed `curl` build and local network accessibility, this can expose internal HTTP services or other reachable resources to blind requests. Redirect following expands the issue because an initially approved-looking URL can redirect to a private or otherwise prohibited destination. The response is written without a maximum-size constraint. A malicious server can return an extremely large or endless response, consuming available disk space and keeping the process active. Furthermore, arbitrary non-image data is saved with a `.png` extension without validating that the response is a genuine image. The output path itself is constructed locally and is not taken from the response, so the demonstrated code does not directly permit an attacker to choos ...[truncated 1423 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse `image_url` before use and permit only HTTPS. 2. Enforce an allowlist of trusted image-delivery hostnames. 3. Resolve the hostname and reject loopback, link-local, private, multicast, and other prohibited address ranges. 4. Revalidate the destination after every redirect, or disable redirects unless they are required. 5. Restrict `curl` protocols explicitly, for example with `--proto '=https'` and `--proto-redir '=https'`. 6. Apply strict connection and operation timeouts using options such as `--connect-timeout` and `--max-time`. 7. Enforce a maximum download size before and during transfer. 8. Download into a securely created temporary file, validate the MIME type and image signature, and move it to the final path only after validation succeeds. 9. Reject responses that are not an expected image format or that exceed supported image dimensions. 10. Run the downloader with minimal network and filesystem permissions and ensure sufficient storage quotas are in place. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documentation explicitly instructs reading an API key from local config and sending both the user prompt and credentials to an external Coze endpoint, but it does not provide a clear user-facing warning about third-party data transmission. This creates a real privacy and trust issue because users may unknowingly send sensitive prompts or metadata to an external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

PROMPT="一只可爱的橘猫在窗台上晒太阳，温暖的光线，写实摄影风格 --ar 1:1"

# 3. 调用 coze_workflow 执行 / Execute
result=$(curl -s -X POST "${BASE_URL}/v1/workflow/stream_run" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d "{

• Confidence: 87% confidence
• Finding: The documented workflow performs a direct outbound HTTP request to an external API using a bearer token and user-supplied prompt content. In context, this is expected functionality for an image generation integration, but it is still a real security/privacy concern because unredacted user input is transmitted off-host and the skill does not emphasize consent, destination validation, or safe handling of returned URLs.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The placeholder value is written only in Chinese ("你的扣子工作流id"), which imposes a specific language in the configuration without offering a language choice or documenting why a Chinese locale is required. This matches the language/locale policy concern for natural-language content in config files.

Static analysis

No suspicious patterns detected.