ClawHub
Back to skill

Security audit

sudocode-nano-banana2

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed remote image-generation skill, but it can send the user's API key and image/prompt content to any endpoint set in the environment.

Install only if you trust Sudocode and the endpoint configured in SUDOCODE_BASE_URL. Leave the base URL at the default unless you intentionally control the alternative, protect ~/.openclaw/.env, use a revocable API key, and avoid sending sensitive images or prompts.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'url' from os.getenv (line 94, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}

        try:
            resp = requests.post(url, headers=headers, json=payload, timeout=300)
        except Exception as e:
            print(f"请求失败: {e}")
            sys.exit(1)
Confidence
94% confidence
Finding
The request URL is derived from the environment variable SUDOCODE_BASE_URL and is used directly in requests.post while also attaching the API key header and user-supplied prompt/image content. If an attacker can influence the environment, they can redirect requests to an arbitrary host and exfiltrate credentials and sensitive image/prompt data; in a skill context this is more dangerous because the script is explicitly designed to transmit user content to a remote service.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill describes capabilities to read environment variables, write credential material to ~/.openclaw/.env, read and write local files, and send prompts/images to a remote network endpoint, yet no explicit permissions are declared. This creates a transparency and policy-enforcement gap: an agent or reviewer may underestimate what the skill can access or transmit, increasing the chance of unintended secret exposure, local file misuse, or unsanctioned network egress.

Static analysis

No suspicious patterns detected.