Security audit

MFlux Skill for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local image-generation guide, but users should expect external package/model downloads and large local cache use on first run.

Before installing, make sure you trust the upstream mflux package and Hugging Face model repositories, have enough disk space for 8-32GB model downloads, and understand that first use will contact external download sources even though generation itself is described as local.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:21
Finding: Unpinned Prerelease Dependencies and Mutable Model Artifacts
Content: View full analysis
Remediation: View remediation
" pip install "mflux==" ``` 2. Remove `--prerelease=allow` from the default installation workflow. If prerelease functionality is necessary, isolate it in an explicitly experimental section and pin a specific prerelease version. 3. Pin optional packages such as `hf_transfer` to reviewed versions and maintain a lockfile containing resolved transitive dependencies. 4. Require package hashes where supported, such as a hash-locked requirements file installed with: ```bash pip install --require-hashes -r requirements.txt ``` 5. Pin each Hugging Face model to an immutable commit revision rather than only a mutable repository name. Record expected file names, sizes, and SHA-256 hashes. 6. Verify model artifacts before loading them. Prefer non-executable data formats such as `safetensors`, and configure loaders to reject formats capable of arbitrary object deserialization where possible. 7. Document all network access clearly, including package registries and model-hosting endpoints. Clarify that model and dependency downloads leave the local machine even though image generation itself is local. 8. Test dependency updates in an isolated environment and repeat security review before changing pinned versions or model revisions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states that models are automatically downloaded on first use and may consume ~8-32GB, but it does not clearly warn users that invoking the skill triggers network activity and substantial disk usage. In an agent context, this can lead to unexpected external connections, bandwidth consumption, storage exhaustion, and operational surprises, especially in environments expecting fully local-only behavior after installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly states that model weights are downloaded automatically on first use and cached under the user's home directory, but it does not prominently warn users about the large disk footprint or that running the tool will modify the local filesystem. While this is not an RCE-style issue, it can lead to unexpected multi-gigabyte downloads, storage exhaustion, and unanticipated writes in environments where local state changes must be approved.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.