Wavespeed Nanobanana2

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:42 AM UTC
• Version: 1.0.3

Overview

The skill has a valid image-generation purpose, but its package includes unsafe automatic API execution, an exposed API key, and a malformed manifest that can write persistent OpenClaw configuration.

Review this skill before installing. It should not be used until the publisher removes the hard-coded API key, deletes or properly guards the auto-running test block, replaces skill.json with a valid manifest, and updates vulnerable dependencies. If installed as-is, loading the skill may make an unintended external API request and the malformed manifest can confuse or modify user-level skill configuration if executed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:54

Finding

Hard-Coded Wavespeed API Credential in Distributed Source Code

Content

View full analysis

" } }; ``` The original source contains a complete Wavespeed API key at the redacted location. ### Technical Analysis A production API credential is embedded directly in the distributed JavaScript source. Environment-variable authentication is used by the exported function, but the local test block bypasses that control by constructing a context containing a fixed credential. Source code and packaged skill files are not suitable secret-storage mechanisms. Anyone who can download, inspect, cache, or obtain a copy of the package can recover the credential without needing access to the legitimate deployment environment. ### Attack Path 1. An attacker downloads or otherwise obtains the skill package. 2. The attacker opens `index.js` and extracts the hard-coded value assigned to `WAVESPEED_API_KEY`. 3. The attacker supplies that value as a bearer token in requests to the Wavespeed API. 4. Requests are charged to or processed under the account associated with the exposed credential. 5. The attacker can continue using the credential until it is revoked, rotated, or otherwise invalidated. ### Impact Assessment Successful exploitation does not grant local operating-system privileges, but it may grant the attacker the Wavespeed API privileges associated with the exposed key. Potential consequences include: - Unauthorized image-generation requests. - Consumption of API quotas or paid credits. - Rate-limit exhaustion and denial of service to the legitimate user. - Access to any additional Wavespeed resources authorized for the same credential. - Reputational or account consequences arising from abusive requests. The exact account-level scope depends on the permissions assigned to the exposed API key. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:48

Finding

Unconditional Authenticated Network Request During Module Import

Content

View full analysis

{ const testParams = { prompt: "\u84dd\u8272\u6d77\u6d0b", resolution: "1k" }; const testContext = { env: { WAVESPEED_API_KEY: "" } }; try { const result = await module.exports(testParams, testContext); console.log("\nTest result:", JSON.stringify(result, null, 2)); } catch (err) { console.error("\nTest failed:", err); } })(); ``` The credential is redacted in this report. The original source contains the complete value. The Unicode escape sequence in the reproduced prompt represents the original test prompt without changing its runtime value. ### Technical Analysis The immediately invoked asynchronous function executes whenever Node.js evaluates the module. Importing or registering the skill therefore invokes the exported function without an explicit user request. The exported function sends an authenticated POST request to: ```text https://api.wavespeed.ai/api/v2/wavespeed-ai/z-image/turbo ``` Consequently, ordinary discovery, validation, registration, or startup behavior that imports `index.js` can trigger an external API operation. The returned API data is also serialized into process logs. This violates the expectation that importing a module only defines its interface and that network actions occur only after an authorized skill invocation. ### Attack Path 1. A host process installs, validates, registers, or loads the skill. 2. Node.js evaluates `index.js`. 3. The immediately invoked function runs automatically. 4. It calls the exported function with the embedded test prompt and credential. 5. The exported function sends an authenticated external request to the Wavespeed API. 6. The response is serialized and written to standard output, or the error is written to standar ...[truncated 911 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.json:1

Finding

Executable Shell Command Stored in the Skill Manifest File

Content

View full analysis

~/.openclaw/skills/wavespeed-nanobanana2/skill.json ``` The excerpt preserves the complete executable shell structure responsible for the issue. Nonessential descriptive metadata has been omitted from the displayed object. ### Technical Analysis A file named `skill.json` is expected to contain a JSON document. Instead, this file contains a shell command that uses output redirection to write a new manifest into the user's OpenClaw skill directory. A strict JSON parser will reject the file immediately. Conversely, a user or installer that attempts to “run” the malformed manifest as a shell script will cause a write outside the project directory. The destination is a persistent path under the user's home directory: ```text ~/.openclaw/skills/wavespeed-nanobanana2/skill.json ``` The command can overwrite an existing manifest without validation, confirmation, backup, or ownership checks. The audit evidence does not establish that the project automatically executes this file, so automatic persistence or arbitrary code execution is not claimed. The risk arises if a user or integration interprets the disguised shell content as executable installation instructions. ### Attack Path 1. An installer or user encounters `skill.json` and discovers that it is not valid JSON. 2. The file is executed or copied into a shell under the assumption that it is an installa ...[truncated 1092 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins axios 1.13.6, and the supplied advisory set includes multiple high-severity issues such as SSRF/proxy bypass and prototype-pollution-related request manipulation. In a skill context, axios is typically used for outbound HTTP calls, so vulnerable request handling can directly affect confidentiality and integrity of network interactions, especially if attacker-controlled URLs, headers, proxies, or redirect behavior are involved.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names/filenames. If any part names or filenames are influenced by external input, an attacker may be able to inject or smuggle additional multipart headers or alter request structure, which can enable request tampering or downstream parser exploitation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The package.json includes axios 1.13.6, which the scanner reports as having multiple known advisories, including SSRF-related and prototype-pollution-enabled man-in-the-middle/credential theft issues. If this skill makes outbound HTTP requests, these flaws could let an attacker bypass proxy protections, tamper with requests or responses, or exfiltrate sensitive data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Comments and user-visible error messages are written only in Chinese, which imposes a specific language without offering user opt-in or documenting a justified locale restriction. Under the language/locale policy, this is a natural-language policy issue unless the skill explicitly offers a language choice or is clearly scoped to a Chinese-language context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill reads an API key from the environment and performs an outbound request to a third-party service, but there is no manifest metadata or scope declaration here to justify that sensitive capability. In this file’s context, the risk is increased because the module also contains auto-executing test code and a hardcoded credential, showing weak operational hygiene around secrets and network use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The code is configured to send data to an external third-party endpoint, which is a real security-relevant behavior because user input and authenticated requests leave the local trust boundary. In this specific skill, that behavior appears aligned with image-generation functionality, so the concern is not the mere existence of the endpoint but the lack of surrounding controls, disclosure, and safe testing practices.

Content

Scanner excerpt · index.js (reported line 26)May include surrounding context.

js

}

    // 3. 构造 Wavespeed API 请求（正确的 v2 接口）
const apiUrl = "https://api.wavespeed.ai/api/v2/wavespeed-ai/z-image/turbo";
const requestBody = {
  prompt: prompt,
  width: 1024,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code transmits the user-provided prompt and an authorization token to an external service without any disclosure, consent flow, or visible notice in the skill. This creates privacy and trust risks, especially if prompts may contain sensitive user data and the service handling is undocumented.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The supposedly local-only test block actually runs immediately when the module is loaded, not only during manual debugging. That means importing the skill can trigger an external API call and use the embedded API key without user intent, causing unauthorized secret use, unintended billing, and data transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This manifest's description only says "Wavespeed 图像生成" (Wavespeed image generation), which describes a broad capability rather than specific activation conditions or trigger scope. Without narrower invocation guidance or exclusion conditions, the skill may overlap with many ordinary image-generation requests and be selected unintentionally.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this library for redirect handling, a malicious or compromised endpoint could redirect requests to another host and cause sensitive Authorization or other custom headers to be disclosed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is version-ranged with a caret, which allows automatic installation of newer minor and patch releases instead of a fully fixed version. In a security-sensitive skill, this weakens supply-chain reproducibility and can unexpectedly introduce vulnerable or malicious upstream code, especially when combined with an already flagged risky package.

Content

Scanner excerpt · package.json (reported line 3)May include surrounding context.

json

{
  "dependencies": {
    "axios": "^1.13.6"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The user-facing manifest strings are written only in Chinese, including the description and parameter descriptions, with no indication that language is user-selectable or that the skill is intended only for a Chinese-speaking context. This can violate language/locale policy when a skill implicitly forces one language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.