T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze_image.py:80- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Qwen Vision
Security checks for vulnerabilities and agentic risk
Overview
The skill performs cloud image analysis as advertised, but it should be reviewed because it requires a DashScope API key on the command line and overstates video support.
Review before installing. Do not pass a real DashScope API key directly on the command line unless you accept the exposure risk; prefer a patched version that reads `DASHSCOPE_API_KEY` or secure OpenClaw config. Avoid submitting confidential screenshots, IDs, documents, faces, source code, or business images unless your organization approves uploading them to Alibaba Cloud DashScope.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code clearly matches the image-analysis portion of the description: it reads an image, sends it to the Qwen Vision API, and returns the model response, which could cover general image understanding and visual reasoning. However, the declared description explicitly says it analyzes both images and videos, while the code only accepts an image path and supports common image MIME types. There is no video file handling, no video MIME types, no frame extraction, and no alternate video API path. Therefore the description materially overstates the implemented capability, making this a mismatch.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly instructs users to analyze images and videos via Alibaba Cloud DashScope, which necessarily transmits user-provided media and prompts to an external cloud service. Without a clear privacy/data-handling warning, users may unknowingly submit sensitive screenshots, documents, IDs, or internal visuals, creating a real confidentiality risk in the skill’s normal use.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documentation advertises use of a cloud vision API but does not declare an explicit tool scope such as network permissions. This weakens security review and user consent because the skill can transmit data off-host without a clearly declared capability boundary, which is especially relevant for image inputs that may contain sensitive content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation notes that images are base64-encoded and sent via API, but it does not provide a prominent warning that user images are transmitted to a third-party cloud provider. This creates a privacy and data-handling risk because users may submit sensitive screenshots, IDs, medical images, or proprietary content without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This script sends the full image contents to a third-party cloud API, which can expose sensitive visual data such as documents, screenshots, faces, or embedded secrets if users are unaware of the transfer. In a CLI skill that accepts arbitrary local files, the lack of an explicit disclosure or confirmation increases the risk of accidental data exfiltration.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language content of the skill documentation is presented only in Chinese, which effectively forces a specific language for users reading setup and usage instructions. There is no indication that the skill is region-specific or that alternative language documentation is available.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The user-facing examples and prompt table consistently use Chinese-language prompts, which can implicitly steer or constrain usage to a specific language. Because the documentation does not state that other languages are supported or that Chinese is merely illustrative, this may violate the policy against forcing a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script defaults to a Chinese-language prompt, which imposes a specific language choice on users by default. There is no documented locale selection or opt-in mechanism to justify this behavior.
- Content
Static analysis
No suspicious patterns detected.