Image Recognition

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:36 AM UTC
• Version: 1.1.0

Overview

This is a plausible cloud image-recognition skill, but it embeds and automatically uses a shared API key while sending images to external model services.

Review carefully before installing. This skill uploads images and prompts to remote model APIs, so avoid sensitive screenshots, IDs, private documents, or business data unless you accept that transfer. The embedded API key should be removed and revoked, users should configure their own key with the variable the code actually reads, and dependencies should be installed in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: recognize.py:104
• Finding: Hardcoded API credential exposed and automatically used as a fallback<![CDATA[ ## Vulnerability Details **File Locations**: - `recognize.py:104-107` - `usage-guide.md:43-47` **Vulnerability Type**: Hardcoded secret and insecure fallback credential **Risk Level**: High ### Vulnerable Code `recognize.py:104-107`: ```python # 3. If there is still no API Key, use the default Bailian Key as a fallback if not config["api_key"]: config["api_key"] = "<REDACTED_EXPOSED_API_KEY>" config["headers"]["Authorization"] = f"Bearer {config['api_key']}" ``` The original source contains a complete credential-shaped value in place of `<REDACTED_EXPOSED_API_KEY>`. It is redacted here to avoid further disclosure. `usage-guide.md:43-47`: ```python api_key = "<REDACTED_EXPOSED_API_KEY>" headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" } ``` The same complete credential is present in the original documentation. ### Technical Analysis The project embeds a bearer credential directly in executable source code and duplicates it in public usage documentation. Anyone who obtains the Skill package can retrieve the credential without authentication. The executable does not merely include the credential as an inactive example. `get_model_config()` automatically selects it whenever neither `IMAGE_MODEL_API_KEY` nor a usable credential in `~/.openclaw/openclaw.json` is found. The credential is then placed in the `Authorization` header and sent to the DashScope endpoint. The configuration instructions increase the likelihood of unintended fallback. `README.md:12-17` documents `BAILIAN_API_KEY`, while the implementation reads `IMAGE_MODEL_API_KEY` at `recognize.py:40-41`. A user following the README can therefore believe that a private key has been configured while the application silently uses the embedded shared key instead. Hardcoded credentials violate secret-isolation principles because they cannot be distributed, rotated, audited, or revoked independently of the application package. ### Attack Pat ...[truncated 1606 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed credential immediately through the provider console. 2. Review provider logs for unauthorized requests, unusual usage, unexpected charges, and quota exhaustion. 3. Remove the credential from: - `recognize.py` - `usage-guide.md` - Previous repository revisions, release archives, package registries, and cached artifacts. 4. Do not provide a fallback credential. Stop with a clear error when no credential is configured: ```python if not config["api_key"]: raise RuntimeError( "No image-model API key configured. Set IMAGE_MODEL_API_KEY " "or configure a supported provider in OpenClaw." ) ``` 5. Use one consistently documented environment variable. Either update the README to use `IMAGE_MODEL_API_KEY` or intentionally support both names with a documented precedence order. 6. Store credentials in environment variables, an operating-system key store, or a dedicated secret manager. 7. Apply provider-side restrictions where supported, including API scope restrictions, spending limits, rate limits, and credential expiration. 8. Add automated secret scanning to source-control and release pipelines. 9. Ensure error messages and logs never print authorization headers or credential values. ]]>

T08 · Insecure Dependencies

Note

• Location: README.md:8
• Finding: Runtime dependencies are installed without version or integrity pinning<![CDATA[ ## Vulnerability Details **File Locations**: - `README.md:8` - `SKILL.md:78` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Low ### Vulnerable Code `README.md:8` and `SKILL.md:78` instruct users to run: ```bash pip3 install requests Pillow ``` ### Technical Analysis The installation command resolves the latest available versions of `requests`, `Pillow`, and their transitive dependencies at installation time. No exact versions, lock file, package hashes, or reviewed package source are specified. This does not prove that either named dependency is malicious. Both package names are consistent with the implementation, and no typosquatting or dependency-confusion package was identified. The risk is that installations are not reproducible and can silently acquire future, compromised, or incompatible package releases after the Skill itself has been audited. Python package installation can execute package build and installation logic. Consequently, a compromised dependency or package-distribution channel could execute code under the account running `pip`. ### Attack Path 1. A user follows the documented installation command. 2. `pip` queries its configured package index and resolves mutable current versions and transitive dependencies. 3. If a resolved release or configured package index has been compromised, malicious installation or runtime code is downloaded. 4. Package build or installation logic executes with the privileges of the user running `pip`. 5. The malicious dependency can then access files, environment variables, network resources, and other resources available to that account. This path depends on a future dependency or package-index compromise; the reviewed files do not demonstrate that such a compromise has already occurred. ### Impact Assessment Potential impact is bounded by the privileges of the account running `pip` or the Skill. It could include: - Arbitrary code execution during installation or ru ...[truncated 422 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin dependencies to reviewed versions in a requirements file: ```text requests==<reviewed-version> Pillow==<reviewed-version> ``` 2. Generate and verify cryptographic hashes, for example with a hash-locked requirements file and: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-generation tool that records transitive dependencies and hashes. 4. Install dependencies inside an isolated virtual environment rather than the system Python environment. 5. Regularly scan pinned dependencies for known vulnerabilities and update them through a controlled review process. 6. Document the expected package index and discourage installation from untrusted mirrors. 7. Avoid running `pip` with root or administrator privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond simple image recognition by reading ~/.openclaw/openclaw.json, transmitting image data to third-party endpoints, and the analysis indicates a hard-coded fallback API key may exist but is not disclosed. Hidden credential use and undisclosed local-config access materially change the trust boundary, creating risk of secret exposure, unauthorized billing, and silent exfiltration of user images or metadata.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The guide exposes a hardcoded API key in documentation, which is a direct secret disclosure and enables unauthorized use of the external vision service by anyone who reads the file. In this skill context, the risk is heightened because the example is positioned as copy-pasteable usage guidance, making accidental real-world credential leakage and billing abuse very likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README documents image recognition via a remote DashScope API but does not clearly warn users that supplied images may be uploaded to an external service. This creates a real privacy and data-handling risk because users may submit sensitive screenshots, IDs, or personal photos without informed consent, especially in an Android/Termux context where local processing might be assumed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes behavior that requires reading local files/configuration, accessing environment variables, and sending data over the network, but it declares no corresponding tool scope or permissions. This is dangerous because the agent may access sensitive local configuration and transmit image contents or secrets without explicit least-privilege disclosure and user review.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explains configuration and usage without clearly warning that images are uploaded to third-party model providers for processing. This is dangerous because users may assume analysis is local and unknowingly send sensitive screenshots, personal documents, or other private imagery to external services.

External Transmission

Medium

• Category: Data Exfiltration

Content

export IMAGE_MODEL_PROVIDER="openai"
export IMAGE_MODEL_API_KEY="sk-xxxxxxxxxxxxx"
export IMAGE_MODEL_NAME="gpt-4o"
export IMAGE_MODEL_ENDPOINT="https://api.openai.com/v1/chat/completions"
```

## 支持的平台

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill reads API credentials from the user's unrelated OpenClaw configuration file, which exceeds the minimal permissions needed for simple image recognition and silently broadens its access to local secrets. Because those credentials are then used to contact external providers, the skill can cause unintended use of the user's paid accounts and creates a secret-handling boundary violation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script transmits the full image contents to a remote model endpoint without an explicit user-facing disclosure at the point of use. Images often contain sensitive personal, financial, or location data, so silent upload to third-party services can create privacy and compliance risks even if the transfer is functionally required.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 发送请求
    try:
        response = requests.post(
            config["endpoint"],
            headers=config["headers"],
            json=payload,

• Confidence: 90% confidence
• Finding: This code performs an outbound network request carrying base64-encoded image data and user prompt content to a configurable external endpoint. External transmission is expected for a cloud vision skill, but it is still security-relevant because the destination can be changed via environment variables and the transfer may expose sensitive content if users are not clearly informed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide demonstrates base64-encoding local images and sending them to a remote API without any warning about external transmission, privacy, or sensitivity of image contents. Because this skill is intended for screenshots, documents, and QR codes, users may unknowingly upload credentials, personal data, or confidential business material to a third party.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation claims the skill automatically uses the user's configured vision model, but the example hardcodes a specific remote model and endpoint. This is security-relevant because it can mislead users into believing processing stays within their configured environment while actually steering data to a fixed third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

]
    }
    
    response = requests.post(
        "https://coding.dashscope.aliyuncs.com/v1/chat/completions",
        headers=headers,
        json=payload,

• Confidence: 90% confidence
• Finding: The example performs an outbound request to a third-party endpoint carrying user-supplied image data. In the context of an image-recognition skill, external transmission can be legitimate, but it is still dangerous when paired with screenshots/documents and absent clear consent and disclosure because sensitive information may leave the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

]
    }
    
    response = requests.post(
        "https://coding.dashscope.aliyuncs.com/v1/chat/completions",
        headers=headers,
        json=payload,

• Confidence: 90% confidence
• Finding: The example performs an outbound request to a third-party endpoint carrying user-supplied image data. In the context of an image-recognition skill, external transmission can be legitimate, but it is still dangerous when paired with screenshots/documents and absent clear consent and disclosure because sensitive information may leave the local environment.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The compression example opens an image and saves it back to the same path, overwriting the original file without warning. This can cause irreversible data loss or destruction of evidentiary or source-quality images if users run the snippet as provided.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The skill documentation forces a specific language for core instructions and usage guidance, which can be a language/locale policy issue when no user opt-in or justification is provided. There is no indication that the skill is region-specific or that alternative language support is available.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The description and example invocations are presented in Chinese, and the file does not indicate that users may use another language or that the Chinese-only presentation is a documented regional constraint. This can be a language/locale policy issue when a skill appears to assume a specific language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The default question text is hard-coded in Chinese, and the CLI help/output is also primarily Chinese. This imposes a specific language preference without explicit user opt-in or a documented reason that the tool is Chinese-only.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The natural-language instructions, examples, and prompts are all presented in Chinese, which effectively forces a specific language for users of the skill. Under the stated policy, language constraints should either be optional for the user or explicitly justified as region-specific.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: recognize.py:66

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:61

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: usage-guide.md:51