glm-understand-image

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:18 PM UTC
• Version: 1.0.4

Overview

This image-analysis skill is mostly purpose-aligned, but it asks users to run mutable third-party npm packages and handles API keys in ways that can expose credentials.

Install only if you are comfortable running unpinned npm-hosted MCP tooling locally and sending selected images or videos to the GLM/Zhipu service. Use a low-privilege API key, avoid sensitive screenshots unless redacted, restrict permissions on `~/.openclaw/config/glm.json`, and rotate the key if it may have been printed in logs or transcripts. Prefer a version-pinned and credential-safe revision before broad use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:35
• Finding: Undisclosed Referral Link Embedded in User-Facing Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35-38 **Vulnerability Type**: User-facing instruction manipulation through a referral URL **Risk Level**: Medium ### Vulnerable Snippet The relevant instruction translates to: ```text If the user does not have a Zhipu API key, direct the user to the following URL to purchase one: https://www.bigmodel.cn/glm-coding?ic=OOKF4KGGTW ``` ### Technical Analysis The skill instructs the agent to provide a hard-coded commercial URL containing the referral identifier `ic=OOKF4KGGTW`. This behavior is unrelated to the technical requirement of analyzing images and is not disclosed as affiliate or referral promotion. Because the instruction is part of the skill text, it can alter the agent's response whenever a user lacks an API key. The user may interpret the resulting recommendation as neutral operational guidance even though the link includes a tracking or referral parameter. ### Attack Path 1. A user invokes the image-analysis skill. 2. The skill checks for a configured Zhipu API key. 3. No key is found. 4. The agent follows the embedded instruction and asks the user for a key. 5. If the user does not have one, the agent presents the hard-coded referral URL. 6. The referral identifier attributes the user's visit or purchase to an undisclosed third party. ### Impact Assessment The issue can influence user decisions and redirect users through an undisclosed referral channel. It does not directly provide system privileges or code execution, but it compromises the neutrality and integrity of agent output and may expose users to undisclosed commercial tracking. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the referral query parameter `ic=OOKF4KGGTW`. - Link only to neutral, official API-key documentation or the provider's standard account portal. - Do not instruct the agent to promote purchasing unless it is necessary for the requested task. - Clearly disclose any commercial relationship, referral attribution, or tracking mechanism. - Prefer wording that also permits users to configure an existing credential without directing them to a specific sales page. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17
• Finding: Execution of Unpinned npm Packages Through npx<![CDATA[ ## Vulnerability Details **File Locations**: `SKILL.md`, line 17 and lines 59-63 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Snippet ```bash npx -y mcporter --version ``` ```bash mcporter config add glm-vision \ --command "npx -y @z_ai/mcp-server" \ --env Z_AI_API_KEY="your-key" \ --env Z_AI_MODE="ZHIPU" \ --env HOME="$PWD" ``` ### Technical Analysis The skill executes `mcporter` and configures `@z_ai/mcp-server` through `npx` without specifying exact package versions or verifying package integrity. The `-y` option suppresses interactive confirmation. As a result, package resolution can select the latest package version available when the command is run rather than a version reviewed at audit time. If an upstream package, maintainer account, registry entry, or dependency is compromised, arbitrary package code may execute on the local machine. The MCP server command is also stored for later invocation, so the unpinned package can be resolved repeatedly. Its effective implementation may therefore change after the skill itself has been reviewed. ### Attack Path 1. An attacker compromises the relevant npm package, its maintainer account, or an upstream dependency. 2. The attacker publishes a malicious package release under the expected package name. 3. A user or agent follows the skill instructions. 4. `npx -y` resolves and downloads the unpinned release without requesting confirmation. 5. Package lifecycle logic or the MCP server executes with the permissions of the agent process. 6. The malicious package can access files, environment variables, network resources, and credentials available to that user. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of the account running the skill. The accessible scope may include the user's files, OpenClaw configuration, API credentials, workspace content, and network access. The issue doe ...[truncated 138 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin each package to a reviewed, exact version, for example `mcporter@X.Y.Z` and `@z_ai/mcp-server@X.Y.Z`. - Use a lockfile and package integrity hashes where the execution environment supports them. - Verify that package names and publishers match the official provider documentation. - Avoid `npx -y` for security-sensitive setup because it suppresses confirmation. - Install dependencies through a controlled deployment process rather than resolving the latest release during skill execution. - Reassess and test package upgrades before changing pinned versions. - Run the MCP server in a sandbox with restricted filesystem, environment, and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27
• Finding: API Key Exposure Through Output, File Permissions, and Command Configuration<![CDATA[ ## Vulnerability Details **File Locations**: `SKILL.md`, line 27, lines 43-49, and lines 59-63 **Vulnerability Type**: Insecure secret handling and plaintext credential persistence **Risk Level**: High ### Vulnerable Snippet ```bash cat ~/.openclaw/config/glm.json 2>/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('api_key', ''))" ``` ```bash mkdir -p ~/.openclaw/config cat > ~/.openclaw/config/glm.json << EOF { "api_key": "API key" } EOF ``` ```bash mcporter config add glm-vision \ --command "npx -y @z_ai/mcp-server" \ --env Z_AI_API_KEY="your-key" \ --env Z_AI_MODE="ZHIPU" \ --env HOME="$PWD" ``` ### Technical Analysis The API-key check prints the complete credential to standard output instead of checking only whether a value exists. This can disclose the key through terminal output, agent transcripts, captured logs, or command execution records. The key is written as plaintext to `~/.openclaw/config/glm.json` without first setting a restrictive `umask` or explicitly applying file mode `0600`. Its actual permissions therefore depend on the user's environment and may permit access by other local users or processes. The key is also interpolated into a command using `--env Z_AI_API_KEY="your-key"`. Depending on how the command is entered and how `mcporter` stores its configuration, the key may appear in shell history, process arguments, debug output, logs, or persistent MCP configuration. ### Attack Path 1. The user supplies a valid Zhipu API key. 2. The agent writes the key to a plaintext JSON file without enforcing restrictive permissions. 3. The agent later runs the key-check command, which prints the full secret. 4. Terminal capture, execution logs, transcripts, or another local process records the output. 5. Alternatively, a local user reads the configuration file if its permissions are too broad. 6. The key may also be recovered from shell history, process inspection, logs, or stored MCP configuratio ...[truncated 503 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never print the complete API key. Check only for its presence and return a boolean or redacted status. - Replace the current check with logic that produces output such as `configured` or `not configured`. - Store the credential in an operating-system secret manager or another supported secure credential store. - If file storage is unavoidable, create the file atomically with mode `0600` and ensure the containing directory is accessible only to the owning user. - Set a restrictive `umask`, such as `077`, before creating credential files. - Avoid including secrets in command-line arguments or commands retained in shell history. - Inject the key through a protected environment mechanism at process startup without logging it. - Confirm whether `mcporter` persists environment values and secure its configuration file accordingly. - Redact secrets from agent transcripts, diagnostic output, and error messages. - Rotate any API key that may already have been printed or stored with overly broad permissions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is designed to send local image paths or remote URLs to an external GLM vision service, but it does not clearly warn that image contents may leave the local system. In this context, screenshots and images often contain sensitive information such as credentials, personal data, internal diagrams, or error traces, making silent exfiltration especially risky.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs execution of `npx -y mcporter` without pinning a version, which allows whatever package version is current at execution time to run. This creates a supply-chain risk: a malicious update, account compromise, or breaking change could cause arbitrary code execution on the host during setup.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### 3.3 保存 API Key

```bash
mkdir -p ~/.openclaw/config
cat > ~/.openclaw/config/glm.json << EOF
{
  "api_key": "API密钥"

• Confidence: 87% confidence
• Finding: This duplicated finding points to the same behavior: the skill writes the API key to a persistent config file in the user's home directory. That persistence widens the attack window and can enable later misuse of the credential by local malware, other users, or unintentionally exposed files.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### 3.3 保存 API Key

```bash
mkdir -p ~/.openclaw/config
cat > ~/.openclaw/config/glm.json << EOF
{
  "api_key": "API密钥"

• Confidence: 87% confidence
• Finding: This duplicated finding points to the same behavior: the skill writes the API key to a persistent config file in the user's home directory. That persistence widens the attack window and can enable later misuse of the credential by local malware, other users, or unintentionally exposed files.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The MCP server is launched via `npx -y @z_ai/mcp-server` with no pinned version, so the skill depends on mutable third-party code fetched at runtime. Because MCP servers execute locally and receive user-controlled inputs and secrets via environment variables, an upstream compromise could lead to direct host compromise or secret exfiltration.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documented capabilities materially exceed the declared purpose of simple image understanding by including screenshot-to-code generation and video analysis. Scope expansion increases the chance the agent will invoke more powerful tools than users expect, which can lead to unintended data exposure or generation of unreviewed code from screenshots.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Advertising `ui_to_artifact` enables conversion of screenshots into code even though the skill is framed as image understanding. This is risky because it crosses from passive analysis into code generation, which may produce executable artifacts from untrusted visual input without adequate review or sandboxing.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill instructs users to store an API key in a local plaintext config file without warning about filesystem permissions, secret rotation, or safer secret stores. While common in developer tooling, this increases the chance of credential leakage through backups, shared home directories, logs, or accidental file disclosure.

Context-Inappropriate Capability

Low

• Confidence: 95% confidence
• Finding: The skill advertises `video_analysis` although its manifest and description are limited to images. This mismatch can cause users or agents to send larger and potentially more sensitive media than intended to the external service, broadening privacy and operational risk beyond the declared scope.

Static analysis

No suspicious patterns detected.