OpenClaw NovelAI Free

• Outcome: Review
• Latest audit: Sep 24, 2026 · 12:38 PM UTC
• Version: 0.1.2

Overview

The skill is mostly coherent and protective, but its same-session cost-verification reuse could let image generation proceed on stale billing information.

Review the same-session lease behavior before installing. The skill is not trying to steal credentials or run hidden code, but for the strongest zero-cost protection you would want every image request to run a fresh cost estimate immediately before generation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:71

Finding

Indefinitely Cached Cost Verification Can Authorize a Chargeable Image Request

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71–101
Vulnerability Type: Stale authorization and cost-verification reuse
Risk Level: Medium

Relevant snippets:

text

For a later request, reuse the verified profile indefinitely when the operation type, model, dimensions, Steps, image count, sampler/scale/noise, and other billing-affecting fields remain unchanged. A prompt change alone may reuse it when the provider does not price prompt text separately. Do not call the account or estimator tools again for a matching request; briefly state that the verified zero-Anlas profile is being reused.

text

`generate_image` is allowed only when a matching lease exists or a fresh gate satisfies **all** conditions below:

text

When a later request matches a valid lease, do not narrate another account check or estimator call. Reuse the verified profile and call only the one allowed image tool.

Technical Analysis

The Skill permits a previous zero-Anlas estimate and account check to be cached indefinitely within a conversation. For matching local parameters, it explicitly instructs the agent not to query the account or cost estimator again and to invoke generate_image directly.

This treats a historical remote-service response as current spending authorization. Matching request parameters do not prove that mutable external conditions remain unchanged. Account entitlement, service pricing, model behavior, usage-limit status, and whether prompt text affects pricing can change after the original verification.

The cached lease therefore bypasses the fresh cost check that protects the user's zero-Anlas authorization boundary. It also conflicts with the earlier hard-policy requirement in SKILL.md that an estimate be obtained before every image generation.

Attack Path

1. An initial image request passes the account check and receives an explicit zero-Anlas estimate.
2. The Skill st ...[truncated 1056 chars]

Remediation

View remediation

Remediation Suggestions

• Call estimate_anlas_cost with the exact final parameters immediately before every invocation of generate_image.
• Recheck the account entitlement before generation when the provider does not supply an atomic, provider-backed zero-cost authorization.
• Remove the instruction to reuse a verified billing profile indefinitely.
• If caching is necessary, use a short-lived lease issued or validated by the provider, bound to the account, model version, exact billing-affecting parameters, pricing revision, and entitlement state.
• Invalidate cached verification on any pricing or model-version change, account-state change, usage warning, provider reconnect, or inability to prove freshness.
• Fail closed when freshness cannot be established: do not call generate_image.
• Retain post-operation auditing as a secondary safeguard, but do not use it as a substitute for current pre-operation authorization.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill description is written only in Simplified Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking region or compliance context. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file includes natural-language directives and user request examples in Chinese, such as the example trigger/instruction at L105 and the sample requests at L112-L125. Because the skill does not state that the user can choose language or that Chinese is required for a justified regional context, this creates a locale/language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.