Security audit

Tạo ảnh Infographic

Security checks for vulnerabilities and agentic risk

Overview

This skill does create infographics as advertised, but it handles API credentials and prompts in ways users should review before installing.

Review this skill before installing. Use it only in trusted workspaces, set a known HTTPS 9Router endpoint, avoid sensitive prompt content, and be aware that generated images are instructed to include the publisher's footer unless the skill is changed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:43
Finding: Mandatory Branded-Output Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: image-generator.js:32
Finding: Bearer API Credentials Transmitted over Plaintext HTTP by Default
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: image-generator.js:10
Finding: Untrusted Ancestor Configuration Can Redirect Environment Credentials
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description explicitly constrains output to Vietnamese as a built-in behavior. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is clearly justified as region-specific, which is not provided here.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to invoke a script via exec and the static analyzer detected environment and network capabilities, but the skill does not declare any permissions or allowed-tools scope. This creates an under-scoped execution path where a consumer may permit broader tool access than intended, increasing the blast radius if the prompt or script behavior is abused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file states that the skill should be used when the user requests infographic, news, guide, or poster generation 'bằng tiếng Việt', and the rest of the instructions require Vietnamese text content and Vietnamese font handling. This imposes a language constraint in natural-language instructions without an explicit user opt-in or a documented justification for limiting the skill to Vietnamese.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script reads an API key from environment variables or local configuration and automatically transmits it in Authorization headers to a remote service, without notifying the user that credentials from nearby project configuration will be used. This is risky because the code also discovers openclaw.json by walking parent directories, which can unintentionally pick up credentials from an unrelated workspace and send them to a configurable base URL.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-supplied prompt is sent verbatim to a remote image-generation API, but the tool does not disclose that prompt contents leave the local environment. In this skill context, prompts may contain proprietary, personal, or otherwise sensitive content, and the default base URL is plain HTTP, increasing exposure to interception or unintended disclosure.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: image-generator.js:32