Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed LINK42 API helper that uses a user-provided key for model, media, asset, usage, and evaluation workflows with explicit safeguards around paid or mutating actions.
Before installing, configure only a LINK42 key you intend this skill to use, review whether the key has usage-read permission, and run paid generation, asset deletion, cancellation, uploads, or scoring only when you have explicitly requested that action and accepted the cost/scope.
The declared description is narrower than the behavior described in the skill body, which includes usage reporting, export/log retrieval, scoring API access, and diagnostic/model discovery operations. This mismatch can mislead users or policy systems about what the skill is authorized to do, causing overbroad data access or execution of sensitive reporting features that were not clearly disclosed.
Referenced artifact was not completely inspected
Run `python3 scripts/link42_agent.py discover`. This combines authenticated `/v1/models` scope with public capability/price metadata where available. IDs, alias
Referenced artifact was not completely inspected
Run `python3 scripts/link42_agent.py discover`. This combines authenticated `/v1/models` scope with public capability/price metadata where available. IDs, alias
The skill declares access to environment variables and instructs the agent to make authenticated network calls, but it does not explicitly constrain tool scope via permissions or allowed-tools. In a capability-bearing skill, missing scope declarations can let a host agent invoke broader file, env, or network actions than intended, increasing the chance of secret exposure or unintended external requests.
The client exposes usage reporting and request-log retrieval methods even though the skill manifest says it is for LINK42 API model work and not account-administration-style capabilities. In an agent setting, this expands the accessible API surface to potentially sensitive metadata about requests, costs, and usage patterns, which can enable unintended data disclosure or policy bypass if the agent is only supposed to perform generation and asset workflows.
The client provides score creation functionality that is not described in the manifest, creating hidden capability beyond the declared contract of the skill. Undocumented capabilities are risky in agent integrations because they can be invoked unexpectedly, undermine least-privilege assumptions, and interact with backend features operators did not intend to expose through this skill.
The sample system prompt says "Return concise Chinese answers," which imposes a specific language choice. This is a natural-language locale policy issue because the file does not indicate user choice, opt-in, or a justified region-specific constraint.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
## Codex
Use a user-level custom provider (not the reserved `openai` ID), `base_url=https://www.link42.ai/v1`, `env_key=LINK42_API_KEY`, `wire_api=responses`, and select an authorized tool-capable model. Keep `requires_openai_auth=false`/WebSocket support disabled unless that feature is actually implemented. Do not rewrite the user's current provider or security/approval settings just to install the skill. Provide a separate configuration snippet/profile and let the user select it.
## OpenClaw and other skill hosts
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
plans=[plan(client,stage,options) for stage in stages]
total=sum(stage["quote"]["estimated_micro_usd"] for stage in plans)
budget=payload.get("budget_usd")
if budget is not None and (not isinstance(budget,(int,float)) or not __import__('math').isfinite(budget) or budget<0 or total>budget*1_000_000):raise ValueError("Workflow exceeds the estimate budget; nothing submitted")
return {"stages":plans,"estimated_total_micro_usd":total,"submitted":False,"note":"Refresh each quote before execution; key budgets enforce settlement limits. Future assets are not fabricated."}
def wait_with_options(resource,task_id,timeout,options):
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
raise PollTimeoutError(task_id,last)
def run(client,operation,payload,*,resource_id=None,file=None,stream=False,execute=False,idempotency_key=None,max_estimate_usd=None,wait_timeout=600,request_options=None):
if not __import__('math').isfinite(wait_timeout) or wait_timeout<=0: raise ValueError("Invalid wait timeout")
if operation in MUTATIONS and not execute: raise ValueError("Mutation refused: confirm the user's scope/cost, then pass --execute")
if stream and operation not in {"chat","responses","messages","gemini"}:raise ValueError("Streaming is unsupported for this operation")
options={**(request_options or {}),"retries":0}
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
if operation=="video-wait":return wait_with_options(client.videos,resource_id,wait_timeout,options) if request_options else client.videos.wait(resource_id,timeout=wait_timeout)
if operation=="video-cancel":return client.videos.cancel(resource_id,**options)
if operation=="asset-begin":return client.assets.begin(**payload,request_options=options)
if operation=="asset-upload":return client.assets.upload_file(file,**payload,request_options=options)
if operation=="asset-list":return client.assets.list(**payload,request_options=options)
if operation=="asset-get":return client.assets.get(resource_id,**options)
if operation=="asset-delete":return client.assets.delete(resource_id,**options)
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
if not isinstance(payload,dict):raise ValueError("Input must be a JSON object")
request_options=json.loads(Path(args.request_options).read_text()) if args.request_options else {}
if not isinstance(request_options,dict) or set(request_options)-{"headers","timeout","request_id"}:raise ValueError("Unsupported transport options")
if args.max_estimate_usd is not None and (args.max_estimate_usd<0 or not __import__('math').isfinite(args.max_estimate_usd)):raise ValueError("Invalid budget")
if args.operation in {"image-create","video-create"} and not args.idempotency_key:
args.idempotency_key="link42-agent-"+uuid.uuid4().hex
print(json.dumps({"event":"idempotency_key","idempotency_key":args.idempotency_key}),file=sys.stderr)