ClawHub
Back to skill

Security audit

Stella Selfie

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but its avatar-file handling can upload overly broad local files to external image providers if the identity configuration is wrong or influenced.

Install only if you are comfortable sending prompts and avatar/reference images to the selected provider and generated media to the chosen OpenClaw channel. Keep Avatar and AvatarsDir pointed only at a dedicated avatar folder, do not allow untrusted automation to edit ~/.openclaw/workspace/IDENTITY.md, and review provider/API-key settings before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/identity.ts:14
Finding

Unrestricted Avatar Paths Permit Arbitrary Local File Disclosure to External Image Providers

Content
View full analysis
= { ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".webp": "image/webp", }; const mimeType = mimeMap[ext] || "image/jpeg"; const data = fs.readFileSync(filePath).toString("base64"); return { data, mimeType }; } ``` ```ts for (const imgPath of referenceImages) { const { data, mimeType } = readImageAsBase64(imgPath); parts.push({ inlineData: { data, mimeType }, }); } ``` The laozhang.ai provider ...[truncated 3550 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (29)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose presents a full selfie-generation and delivery capability using multiple external providers and channel output. The supplied code chunk does not generate images, call any providers, communicate with channels, or perform network actions. Its sole behavior is local filesystem processing: checking for avatar files, scanning a directory for image references, sorting them by recency, and returning a list of selected avatar paths. While this may support the claimed 'multi-reference avatar blending' workflow as a helper, the actual code chunk materially differs from the declared end-user functionality and omits the primary advertised capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The supplied code does not implement the declared selfie-generation behavior at all. Its sole purpose is filesystem-based configuration parsing: it locates IDENTITY.md under ~/.openclaw/workspace, reads it, parses specific keys, resolves file paths, and filters URL values. This is materially different from generating images or sending them to channels. Additionally, it accesses local files despite the declared permissions being empty, which is an inconsistent resource access relevant to the evaluation criteria.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code is generally related to the declared image-generation purpose and does support laozhang.ai plus multiple reference images. However, the description says the skill generates selfie images and sends them to any OpenClaw channel, while this code chunk only covers provider-side generation and local persistence. It also accesses local filesystem resources by reading reference image files and writing outputs under the user's home directory, despite the declared permissions being empty and the description not mentioning local file access/storage. The omission of channel-sending behavior in this chunk and the undeclared filesystem access constitute a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says the skill generates persona-consistent selfie images using multiple providers and avatar blending, then sends them to OpenClaw channels. The supplied code only implements message/media sending through the OpenClaw CLI. While sending to OpenClaw is consistent with part of the description, the primary advertised capability—image generation and provider-based avatar blending—is absent from this code chunk. Therefore the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: stella-selfie
description: Generate persona-consistent selfie images and send to any OpenClaw channel. Supports Gemini, fal, and laozhang.ai providers, multi-reference avatar blending.
allowed-tools: Bash(npm:*) Bash(node:*) Bash(openclaw:*) Read Write
metadata:
  openclaw:
    always: true
    requires:
      env:
        - GEMINI_API_KEY
        - FAL_KEY
        - LAOZHANG_API_KEY
      bins:
        - node
    install:
      - kind: node
        package: "@google/genai"
      - kind: node
        package: "@fal-ai/client"
    primaryEnv: GEMINI_API_KEY
    emoji: "📸"
    homepage:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json
{
  "name": "stella-selfie",
  "version": "1.3.3",
  "description": "Generate persona-consistent selfie images and send to any OpenClaw channel. Supports Gemini and fal providers, multi-reference avatar blending.",
  "keywords": [
    "openclaw",
    "gemini",
    "fal",
    "selfie",
    "ai-agent",
    "image-generation",
    "messaging"
  ],
  "author": "",
  "license": "MIT-0",
  "repository": {
    "type": "git",
    "url": "https://github.com/tower1229/Stella"
  },
  "homepage": "https://github.com/tower1229/Stella#readme",
  "engines": {
    "node": ">=18.0.0"
  },
  "scripts": {
    "build": "tsc -p tsconfig.json",

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/timeline-integration.md (reported line 14)May include surrounding context.

md
- `timeline_resolve` is optional. Stella must work normally without it.
- Timeline enhancement is best-effort only.
- Never refuse, delay, or noticeably degrade image generation because timeline context is missing.
- Never introduce a hard dependency on timeline-specific env vars, install steps, or internal field paths.

## Eligibility

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/providers/fal.ts (reported line 34)May include surrounding context.

ts
const key = provided || process.env.FAL_KEY;
  if (!key) {
    throw new Error(
      "FAL_KEY is not set. Set it in your environment (e.g. OpenClaw skills.entries.*.env) or for local testing use .env.local / --api-key."
    );
  }
  return key;

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/providers/gemini.ts (reported line 35)May include surrounding context.

ts
const key = provided || process.env.FAL_KEY;
  if (!key) {
    throw new Error(
      "FAL_KEY is not set. Set it in your environment (e.g. OpenClaw skills.entries.*.env) or for local testing use .env.local / --api-key."
    );
  }
  return key;

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/providers/laozhang.ts (reported line 47)May include surrounding context.

ts
const key = provided || process.env.FAL_KEY;
  if (!key) {
    throw new Error(
      "FAL_KEY is not set. Set it in your environment (e.g. OpenClaw skills.entries.*.env) or for local testing use .env.local / --api-key."
    );
  }
  return key;

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance includes broad phrases like 'send a pic' or 'send me a photo' that can match ordinary conversation and cause the skill to trigger unexpectedly. In a skill that can send generated media to any OpenClaw channel and use external providers, unintended activation can lead to unwanted message delivery, accidental disclosure of persona/avatar data to third parties, or surprise external API usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This is a manifest file for a skill package, and the description explicitly states that generated images are sent to OpenClaw channels. That behavior can affect user data and privacy, but the visible description provides no warning or disclosure about transmission, destination, or user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This TypeScript file contains hard-coded Chinese userMessage and actionHint strings, and the same pattern continues throughout the normalization functions. That creates a natural-language policy issue if the skill is expected to support users without forcing a specific language or locale, because no opt-in or locale selection mechanism is present in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Reference images supplied to the skill are base64-encoded and sent to the external Gemini API without any indication in this file of consent, warning, or restriction on image source. In a selfie/avatar skill, users may provide sensitive personal photos, so silent third-party transmission creates a real privacy and data-exposure risk even though it is part of intended functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code creates a persistent directory under the user's home directory and later saves generated images there. While file output is part of the function's behavior, this file provides no confirmation prompt, logging, or explicit user-facing warning about where data will be written.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/providers/laozhang.ts (reported line 6)May include surrounding context.

ts
import * as os from "os";
import { asStellaError } from "../errors";

const BASE_URL = "https://api.laozhang.ai/v1beta/models";
const MODEL = "gemini-3.1-flash-image-preview";
const STELLA_SELFIE_DIR = path.join(
  os.homedir(),

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code sends user prompts and all reference images to an external third-party API, including arbitrary remote file URIs and local image contents encoded inline. In a selfie/avatar skill, those images are likely sensitive biometric or personal data, so transmission without explicit user-facing notice and consent creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill emits hard-coded Chinese user-facing guidance strings when reference image configuration fails. For a general runtime skill, forcing a specific language without offering a locale choice or documenting a justified regional constraint violates the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language trigger policy explicitly embeds Chinese phrases such as "发张照片", "发自拍", and "展示你在..." as activation cues, but it does not state how language choice is determined or whether multilingual behavior is user-configurable. This can create an implicit locale/language policy without documented opt-in or clear justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json
"release:clawhub": "node ./scripts/release-clawhub.mjs"
  },
  "dependencies": {
    "@fal-ai/client": "^1.2.0",
    "@google/genai": "^0.7.0"
  },
  "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 34)May include surrounding context.

json
},
  "dependencies": {
    "@fal-ai/client": "^1.2.0",
    "@google/genai": "^0.7.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 37)May include surrounding context.

json
"@google/genai": "^0.7.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.7.0",
    "vitest": "^3.0.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 38)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^22.0.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.7.0",
    "vitest": "^3.0.0"
  }

Static analysis

No suspicious patterns detected.