sudocode-nano-banana2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:35 AM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but it can send an API key, prompts, and user images to an unvalidated configurable endpoint and stores secrets too loosely.

Install only if you trust the Sudocode service and will keep SUDOCODE_BASE_URL set to the real Sudocode HTTPS endpoint. Avoid using private images or sensitive prompts unless you are comfortable sending them to that endpoint. Protect ~/.openclaw/.env with owner-only permissions, do not enter API keys in recorded or shared terminals, and review or delete generated log files when they may contain sensitive output.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_env.py:34

Finding

API key stored without explicitly restrictive filesystem permissions

Content

View full analysis

None: path.parent.mkdir(parents=True, exist_ok=True) lines = [f'{key}={quote_env_value(env_map[key])}' for key in sorted(env_map.keys())] path.write_text('\n'.join(lines) + '\n', encoding='utf-8') ``` The function is subsequently used to persist the API key: ```python merged['SUDOCODE_BASE_URL'] = base_url or current_base_url write_env_file(ENV_PATH, merged) print(f'已写入环境变量文件: {ENV_PATH}') print('请重新打开会话，或在当前命令前临时 export 后再运行技能脚本。') ``` ### Technical Analysis The initializer writes `SUDOCODE_IMAGE_API_KEY` to `~/.openclaw/.env`, but neither the containing directory nor the resulting file is assigned an explicit restrictive mode. Their effective permissions therefore depend on the user's current umask and any permissions on an existing file. The function reads all entries from the shared environment file into a dictionary and rewrites the entire file. Consequently, weak resulting permissions could expose not only the Sudocode API key but also unrelated credentials previously stored in the same file. The credential persistence itself is disclosed and supports reuse across sessions, but storing it without enforcing owner-only access exceeds the minimum safe implementation required for that functionality. ### Attack Path 1. A user runs `scripts/init_env.py` in an environment with a permissive umask, or with an existing `.env` file that has permissive permissions. 2. The initializer writes the API key and other preserved environment entries to `~/.openclaw/.env`. 3. The resulting file remains readable by another local account or process. 4. That account or process reads the plaintext API key. 5. The stolen key is used to access the remote service under the victim's account and co ...[truncated 445 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_env.py:40

Finding

API key is entered through an echoing terminal prompt

Content

View full analysis

str: suffix = f' [{current}]' if current else '' while True: entered = input(f'{prompt_text}{suffix}: ').strip() if entered: return entered if current: return current print(f'{key} 不能为空，请重试。') ``` The echoing function is used for the secret API key: ```python current_api_key = effective_env.get('SUDOCODE_IMAGE_API_KEY') merged['SUDOCODE_IMAGE_API_KEY'] = prompt_value( 'SUDOCODE_IMAGE_API_KEY', current_api_key if args.force else None, '请输入 SUDOCODE_IMAGE_API_KEY' ) ``` ### Technical Analysis Python's `input()` normally echoes typed characters to the terminal. The API key is therefore visible while the user enters it. This may disclose the credential through shoulder surfing, terminal recording, remote support software, screenshots, or captured console output. When `--force` is used and a current key exists in the process environment or environment file, `prompt_value()` also includes that complete key in the prompt suffix. This exposes the existing credential before the user enters any replacement. Echoing or printing an existing secret is not necessary to initialize the skill and violates standard secret-input handling practices. ### Attack Path 1. A user runs the initializer, potentially with `--force`, in a monitored, shared, or recorded terminal session. 2. The program displays an existing API key in the prompt or echoes the newly typed key. 3. An observer, terminal recorder, screen-capture tool, or support-session participant captures the key. 4. The observer reuses the key against the Sudocode service. 5. Requests are billed to, or consume the quota of, the legitimate credential own ...[truncated 304 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sudocode_nano_banana2.py:84

Finding

Configurable API endpoint can receive the credential and private image data without validation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:63

Finding

Documentation recommends installing an unpinned runtime dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Tainted flow: 'url' from os.getenv (line 94, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The request destination is derived from the environment variable SUDOCODE_BASE_URL with no allowlist or validation, so anyone who can influence the runtime environment can redirect requests to an arbitrary host. Because the request includes the API key in the x-goog-api-key header and user prompt/image content in the body, this becomes an SSRF/exfiltration path for credentials and sensitive user data.

Content

Scanner excerpt · scripts/sudocode_nano_banana2.py (reported line 128)May include surrounding context.

python

}

        try:
            resp = requests.post(url, headers=headers, json=payload, timeout=300)
        except Exception as e:
            print(f"请求失败: {e}")
            sys.exit(1)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

- `SKILL.md`: trigger metadata and operating instructions

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init_env.py (reported line 7)May include surrounding context.

python

import sys
from pathlib import Path

ENV_PATH = Path.home() / '.openclaw' / '.env'
REQUIRED_KEYS = ['SUDOCODE_IMAGE_API_KEY']
OPTIONAL_DEFAULTS = {
    'SUDOCODE_BASE_URL': 'https://sudocode.run',

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init_env.py (reported line 56)May include surrounding context.

python

def main() -> int:
    parser = argparse.ArgumentParser(description='Initialize Sudocode Nano Banana2 environment variables.')
    parser.add_argument('--check-only', action='store_true', help='Only check whether required variables exist.')
    parser.add_argument('--force', action='store_true', help='Prompt even if values already exist in .env or process env.')
    args = parser.parse_args()

    file_env = parse_env_file(ENV_PATH)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/sudocode_nano_banana2.py (reported line 91)May include surrounding context.

python

def main() -> int:
    parser = argparse.ArgumentParser(description='Initialize Sudocode Nano Banana2 environment variables.')
    parser.add_argument('--check-only', action='store_true', help='Only check whether required variables exist.')
    parser.add_argument('--force', action='store_true', help='Prompt even if values already exist in .env or process env.')
    args = parser.parse_args()

    file_env = parse_env_file(ENV_PATH)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation describes capabilities that read environment variables, write files, and make outbound network requests, but it does not declare an explicit tool scope or permissions boundary. That creates a real security governance gap: users and hosts may invoke or install the skill without clear visibility into its required privileges, increasing the chance of overbroad execution and unintended data exposure, especially because it handles API keys and uploads prompts/images to a remote service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown directs operators to relay a specific Chinese-language message to the user on exit code 2. This enforces a locale-specific response without offering a language choice or documenting that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language prompts and status messages in Chinese, such as the validation error at L050 and additional prompts later in the script. The skill does not offer any user opt-in for language selection or explain that it is intended only for a Chinese-speaking audience, which makes it a language policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script emits user-facing status and error messages in Chinese, starting with the log message on L051 and continuing throughout the file. This imposes a specific language on all users without opt-in or any documented region-specific justification, which matches the natural-language locale policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/sudocode_nano_banana2.py (reported line 128)May include surrounding context.

python

}

        try:
            resp = requests.post(url, headers=headers, json=payload, timeout=300)
        except Exception as e:
            print(f"请求失败: {e}")
            sys.exit(1)

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script creates persistent log files and tees stdout/stderr into them, which can capture prompts, model text responses, error payloads, output paths, and stack traces. For an image-generation helper this is broader data retention than necessary and may expose sensitive user content or service responses to other local users or later compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.