Security audit

Color Palette Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: extracts colors from user-provided images and optionally creates a swatch image, with no hidden network, persistence, or destructive behavior found.

Install this only in a virtual environment or other isolated Python environment, and consider pinning reviewed dependency versions before use. Treat uploaded images as potentially sensitive, use temporary or OpenClaw media paths for generated swatches, and remove temporary files when they are no longer needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
colorgram.py== matplotlib== ``` 2. Generate and verify cryptographic hashes for all direct and transitive dependencies, then install with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Use a lock-file workflow such as `pip-tools` to resolve and pin the complete transitive dependency graph. 4. Review release notes and vulnerability advisories before updating dependency pins. 5. Perform upgrades through a controlled process with automated tests and dependency scanning. 6. Install dependencies inside an isolated virtual environment under a non-privileged account. 7. Configure pip to use only an approved package index and avoid ad hoc fallback indexes. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill directs the agent to save user-provided images to disk and send generated files back without any warning about retention, sensitive content, or safe temporary-file handling. In a chat-integrated environment, this can expose private images or metadata and normalize disk writes and file forwarding on untrusted input without clear boundaries.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to run directly on user requests involving images and even says not to ask for confirmation. Broad auto-activation combined with shell:exec increases the chance the agent will process untrusted inputs and write files automatically, which can lead to unintended command execution paths or unsafe handling of attacker-supplied content.
Content: No source excerpt is available for this finding.

Lp4

Low

Category: MCP Least Privilege
Confidence: 65% confidence
Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency list uses unpinned package names, so installs may resolve to different versions over time, including vulnerable or breaking releases. In a skill that processes attacker-supplied images and has shell execution permission, uncontrolled dependency drift increases supply-chain and exploitability risk even if this file alone does not prove active compromise.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
Pillow colorgram.py matplotlib

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: Pillow has a history of serious vulnerabilities, including image parsing issues that can lead to denial of service or, in some versions, code execution. Because the version is not pinned, there is no way to verify that deployment avoids affected releases; this is more concerning here because the skill's purpose is to ingest images, directly exercising Pillow's attack surface.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: matplotlib is also unpinned, which makes builds non-reproducible and can pull in newly introduced vulnerabilities or incompatible transitive dependencies. Although this is a common packaging mistake rather than overtly malicious behavior, it weakens the integrity of the deployment and can amplify risk in an environment with image parsing and command execution capability.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
Pillow colorgram.py matplotlib

Static analysis

No suspicious patterns detected.