ClawHub
Back to skill

Security audit

Drip director

Security checks for vulnerabilities and agentic risk

Overview

This image-production skill is coherent overall, but it needs review because it can send image data to external AI services and has unsafe local file handling that could process or delete the wrong files.

Install only if you are comfortable with your generated images, briefs, and constraints being sent to Google Gemini and with the skill invoking local image-generation scripts. Prefer a version that obtains exact attachment paths from trusted session metadata, uses private temporary directories, pins or verifies the generator, and validates all cleanup paths before deletion.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:122
Finding

Unreliable Reference Image Discovery Can Expose Unrelated Private Media

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:261
Finding

Predictable Shared Temporary Files Permit Symlink Attacks and Sensitive Data Retention

Content
View full analysis
/tmp/sd-brief.txt << 'SD_BRIEF_EOF' [paste current PIPELINE_STATE.CREATIVE_BRIEF content here] SD_BRIEF_EOF # Write CONSTRAINT_HIERARCHY to temp file cat > /tmp/sd-constraints.txt << 'SD_CONSTRAINTS_EOF' [paste current PIPELINE_STATE.CONSTRAINT_HIERARCHY content here] SD_CONSTRAINTS_EOF # Image path from PIPELINE_STATE — use ITERATION_LOG[n].file_path IMAGE_PATH="[PIPELINE_STATE.ITERATION_LOG[n].file_path]" IMAGE_B64=$(base64 -i "$IMAGE_PATH" | tr -d '\n') # Build JSON payload using jq — no manual escaping PAYLOAD=$(jq -n \ --rawfile brief /tmp/sd-brief.txt \ --rawfile constraints /tmp/sd-constraints.txt \ --arg b64 "$IMAGE_B64" \ '{contents:[{parts:[ {text:("You are a forensic image quality critic. Evaluate the generated image against the brief and constraint hierarchy. Identify only concrete, visible deviations. Do not suggest prompt edits. Report only what you observe.\n\nCREATIVE BRIEF:\n"+$brief+"\nCONSTRAINT HIERARCHY:\n"+$constraints+"\n\nOutput in EXACTLY this format:\n\nACCURATE_ELEMENTS:\n- [what matches the brief]\n\nCRITICAL_DEVIATIONS (identity breaks, brand failures):\n- [each deviation]\n\nMAJOR_DEVIATIONS (significant but not identity-breaking):\n- [each deviation]\n\nMINOR_DEVIATIONS (stylistic drift, acceptable variance):\n- [each deviation]\n\nCONFIDENCE_SCORE: [0-100]\n\nSIMILARITY_ESTIMATES:\n face_preservation: [0.0-1.0]\n pose_preservation: [0.0-1.0]\n logo_integrity: [0.0-1.0]")}, {inline_data:{mime_type:"image/png",data:$b64}} ]}]}') # Call Gemini API — capture HTTP status and body separately HTTP_STATUS=$(curl -s -w "%{http_code}" -o /tmp/sd-critique.json \ "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=$GOOG ...[truncated 2342 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:207
Finding

Untrusted Generator Output Is Later Used as Destructive Cleanup Authority

Content
View full analysis
/dev/null | head -1) uv run "$NBP" \ --prompt "[HARDENED PROMPT from Stages 2–3]" \ --api-key "$GOOGLE_API_KEY" \ -i "[CREATIVE_BRIEF.reference_images[0]]" \ -i "[CREATIVE_BRIEF.reference_images[1]]" \ --filename "dd-$(date +%s)" \ --resolution 1K ``` ```markdown - Parse the `MEDIA:` path from script output and record it in `ITERATION_LOG[n].file_path` for cleanup at convergence ``` ```markdown After upscale generation: 1. **Delete all intermediate iteration files** — run `rm` on every file_path in ITERATION_LOG except the upscaled file just generated ``` ```markdown #### If skip: 1. **Delete all intermediate iteration files** — run `rm` on every file_path in ITERATION_LOG except GENERATED_IMAGE_V[n] (the accepted 1K) ``` ### Technical Analysis The skill dynamically discovers `generate_image.py`, prioritizing the user-local OpenClaw skill directory because it is searched first. It then trusts a `MEDIA:` path printed by that executable and stores the value for later deletion. No requirement is provided to authenticate the generator, pin its expected location or digest, canonicalize the returned path, or verify that it belongs to a dedicated output directory. Consequently, a replaced, spoofed, or compromised generator can emit an arbitrary path. The convergence procedure later instructs the agent to invoke `rm` on that path. This creates a trust-boundary violation: output from an executable dependency controls a later destructive filesystem operation. ### Attack Path 1. An attacker who can modify or introduce files under the searched user-local skill directory places a spoofed `generate_image ...[truncated 1058 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
**Question sequence:**

1. **What do you want changed?**
   Examples: "Swap the outfit only — keep everything else identical" / "Change background to outdoor" / "Create entirely new composition"

2. **Where will this image be used? (determines aspect ratio)**
   Examples: Instagram post (1:1) / Instagram Story or TikTok (9:16) / website banner (16:9) / e-commerce product page (4:5) / print / other

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill sends a base64-encoded generated image plus the creative brief and constraints to an external Gemini API endpoint. This is an external data transmission vulnerability when users may not understand that their images and associated content are being exported to a third party, potentially including sensitive or proprietary material.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md
]}]}')

# Call Gemini API — capture HTTP status and body separately
HTTP_STATUS=$(curl -s -w "%{http_code}" -o /tmp/sd-critique.json \
  "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=$GOOGLE_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs automatic deletion of generated files via rm without clearly warning the user beforehand or obtaining explicit confirmation for destructive cleanup. In an agent setting, silent file deletion can cause unexpected data loss, especially if iteration logs or file paths are wrong or broader than intended.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 455)May include surrounding context.

md
**Default (Interactive):** Confirm every stage. Full output at each step.

**Fast Mode (user must explicitly request):**
User says "fast mode" → auto-advance through Stages 2–3 without confirmation.
Generation (Stage 4) and Critique (Stage 5) always require confirmation regardless of mode.

---

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description states that every stage requires explicit user confirmation. Later instructions define a Fast Mode where stages 2–3 proceed automatically, which directly contradicts that blanket claim rather than merely adding implementation detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The termination instruction says to exit drip-director mode completely, but then says pipeline logic should not resume unless the user explicitly invokes 'shot-director' again. That contradicts the skill's own declared name 'drip-director' and creates intent ambiguity about how the mode is re-entered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.