Security audit

Phosor AI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Phosor media-generation client, but it needs Review because it silently reads a local API key fallback and supports dev HTTP for credentialed uploads.

Install only if you are comfortable sending prompts, selected media, LoRA files, product/model attributes, and generated job metadata to Phosor. Prefer PHOSOR_API_KEY or --api-key explicitly, avoid storing keys in ~/.openclaw/workspace/TOOLS.md, and do not use --allow-http except on trusted local/dev networks.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (63)

Ae1

High

Category: analysis-evasion
Content: For detailed API endpoints, parameters, pricing, and limits, see [references/api.md](references/api.md).
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: For detailed API endpoints, parameters, pricing, and limits, see [references/api.md](references/api.md).
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: For detailed API endpoints, parameters, pricing, and limits, see [references/api.md](references/api.md).
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: The CLI script is at `scripts/phosor_client.py`. All commands output JSON to stdout.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Static analysis

No suspicious patterns detected.