glm-understand-image

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:18 PM UTC
• Version: 1.0.4

Overview

This image-analysis skill is mostly purpose-aligned, but it asks users to run mutable third-party npm packages and handles API keys in ways that can expose credentials.

Install only if you are comfortable running unpinned npm-hosted MCP tooling locally and sending selected images or videos to the GLM/Zhipu service. Use a low-privilege API key, avoid sensitive screenshots unless redacted, restrict permissions on `~/.openclaw/config/glm.json`, and rotate the key if it may have been printed in logs or transcripts. Prefer a version-pinned and credential-safe revision before broad use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:35

Finding

Undisclosed Referral Link Embedded in User-Facing Instructions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17

Finding

Execution of Unpinned npm Packages Through npx

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27

Finding

API Key Exposure Through Output, File Permissions, and Command Configuration

Content

View full analysis

/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('api_key', ''))" ``` ```bash mkdir -p ~/.openclaw/config cat > ~/.openclaw/config/glm.json << EOF { "api_key": "API key" } EOF ``` ```bash mcporter config add glm-vision \ --command "npx -y @z_ai/mcp-server" \ --env Z_AI_API_KEY="your-key" \ --env Z_AI_MODE="ZHIPU" \ --env HOME="$PWD" ``` ### Technical Analysis The API-key check prints the complete credential to standard output instead of checking only whether a value exists. This can disclose the key through terminal output, agent transcripts, captured logs, or command execution records. The key is written as plaintext to `~/.openclaw/config/glm.json` without first setting a restrictive `umask` or explicitly applying file mode `0600`. Its actual permissions therefore depend on the user's environment and may permit access by other local users or processes. The key is also interpolated into a command using `--env Z_AI_API_KEY="your-key"`. Depending on how the command is entered and how `mcporter` stores its configuration, the key may appear in shell history, process arguments, debug output, logs, or persistent MCP configuration. ### Attack Path 1. The user supplies a valid Zhipu API key. 2. The agent writes the key to a plaintext JSON file without enforcing restrictive permissions. 3. The agent later runs the key-check command, which prints the full secret. 4. Terminal capture, execution logs, transcripts, or another local process records the output. 5. Alternatively, a local user reads the configuration file if its permissions are too broad. 6. The key may also be recovered from shell history, process inspection, logs, or stored MCP configuratio ...[truncated 503 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is designed to send local image paths or remote URLs to an external GLM vision service, but it does not clearly warn that image contents may leave the local system. In this context, screenshots and images often contain sensitive information such as credentials, personal data, internal diagrams, or error traces, making silent exfiltration especially risky.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs execution of npx -y mcporter without pinning a version, which allows whatever package version is current at execution time to run. This creates a supply-chain risk: a malicious update, account compromise, or breaking change could cause arbitrary code execution on the host during setup.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

This duplicated finding points to the same behavior: the skill writes the API key to a persistent config file in the user's home directory. That persistence widens the attack window and can enable later misuse of the credential by local malware, other users, or unintentionally exposed files.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

3.3 保存 API Key

bash

mkdir -p ~/.openclaw/config
cat > ~/.openclaw/config/glm.json << EOF
{
  "api_key": "API密钥"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

This duplicated finding points to the same behavior: the skill writes the API key to a persistent config file in the user's home directory. That persistence widens the attack window and can enable later misuse of the credential by local malware, other users, or unintentionally exposed files.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

3.3 保存 API Key

bash

mkdir -p ~/.openclaw/config
cat > ~/.openclaw/config/glm.json << EOF
{
  "api_key": "API密钥"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The MCP server is launched via npx -y @z_ai/mcp-server with no pinned version, so the skill depends on mutable third-party code fetched at runtime. Because MCP servers execute locally and receive user-controlled inputs and secrets via environment variables, an upstream compromise could lead to direct host compromise or secret exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented capabilities materially exceed the declared purpose of simple image understanding by including screenshot-to-code generation and video analysis. Scope expansion increases the chance the agent will invoke more powerful tools than users expect, which can lead to unintended data exposure or generation of unreviewed code from screenshots.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Advertising ui_to_artifact enables conversion of screenshots into code even though the skill is framed as image understanding. This is risky because it crosses from passive analysis into code generation, which may produce executable artifacts from untrusted visual input without adequate review or sandboxing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to store an API key in a local plaintext config file without warning about filesystem permissions, secret rotation, or safer secret stores. While common in developer tooling, this increases the chance of credential leakage through backups, shared home directories, logs, or accidental file disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises video_analysis although its manifest and description are limited to images. This mismatch can cause users or agents to send larger and potentially more sensitive media than intended to the external service, broadening privacy and operational risk beyond the declared scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.