Security audit

Gemini Image Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Gemini image generator, but it has review-worthy risks from unverified installer commands and broad automatic loading of shared .env secrets.

Review this skill before installing. Use only a dedicated Gemini API key, prefer explicit command-line or skill-local configuration, avoid storing unrelated secrets in shared .env files, avoid the curl-to-shell installer paths, and only configure base URLs you trust to receive your prompts and images.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:62
Finding: Unverified Remote Installers Are Piped Directly into Shells
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/generate_image.py:2
Finding: Executable Dependencies and Installers Are Not Pinned to Immutable Versions
Content: View full analysis
=3.10" # dependencies = [ # "httpx>=0.27.0", # "pillow>=10.0.0", # "google-genai>=1.0.0", # ] # /// ``` ### Technical Analysis The installation commands resolve mutable repository branches or the explicitly mutable `latest` package version. The inline Python dependency metadata also uses open-ended lower bounds instead of exact versions and hashes. Consequently, `uv run` or an installation command can retrieve code that differs from the code evaluated during this audit. Third-party Python packages execute in the Skill process and can access its environment, API key, input images, output files, and network connection. This is a supply-chain exposure rather than evidence that the named dependencies are currently malicious. The project does not provide a lockfile or integrity hashes sufficient to reproduce a reviewed dependency set. ### Attack Path 1. An upstream package, package publisher, source repository, distribution account, or dependency release pipeline is compromised. 2. A malicious release is published under a version satisfying an open-ended constraint, or mutable `latest`/branch content is changed. 3. A user installs or runs the Skill after the malicious update. 4. `npx` or `uv` resolves and downloads the changed component. 5. The dependency executes during installation, import, or normal Skill operation with the privileges of the Skill process. ### Impact Assessment A compromised dependency could execute arbitrary code as the invoking user. It could read `GE ...[truncated 303 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_image.py:657
Finding: API-Controlled Image URLs Can Trigger Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/generate_image.py:50
Finding: Skill Loads All Variables from Shared Credential Files Instead of Required Gemini Settings
Content: View full analysis
= 2: if (value[0] == value[-1]) and value[0] in '"\'': value = value[1:-1] value = value.replace('\\n', '\n').replace('\\t', '\t') value = value.replace('\\"', '"').replace("\\'", "'") value = value.replace('\\\\', '\\') os.environ[key] = value ``` ### Technical Analysis Image generation requires a limited set of Gemini-related configuration values. Nevertheless, the script parses every assignment from `/workspace/.env`, `~/.openclaw/.env`, and the Skill-local `.env`, then inserts all of them into `os.environ`. Shared `.env` files may contain unrelated credentials for other Skills, messaging systems, cloud providers, databases, or infrastructure. Loading every entry makes those secrets visible to all subsequently imported modules and dependencies in the process. This exceeds the least-privilege requirements of the declared image-generation functionality. The audit did not find code that intentionally transmits the complete environment or all loaded variables. The primary risk is unnecessary secret ex ...[truncated 1038 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (52)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation text is broad enough to trigger on many ordinary requests related to drawing, logos, posters, editing, or generic image tasks. Over-broad activation can cause the skill to run unexpectedly, increasing the chance of unnecessary data transmission, shell execution, or external API use without clear user intent.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
brew install python3 # Ubuntu/Debian sudo apt update && sudo apt install python3 python3-pip #CentOS/RHEL sudo yum install python3 python3-pip

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The pipe into sh is dangerous command chaining because it turns remote content retrieval directly into code execution. In context, this materially increases risk beyond ordinary installation instructions by removing opportunities for user inspection or integrity checks.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
bash
# macOS/Linux curl -LsSf https://astral.sh/uv/install.sh | sh # 使用 pip pip install uv

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: This command downloads and executes an external install script from a cloud object-storage URL via bash, which is a strong supply-chain risk and provides no visible integrity verification. The use of a less-established mirror endpoint further increases the trust burden and attack surface.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
npx clawhub@latest install wangyan-gemini-image-gen

使用腾讯 skillhub 安装 (推荐国内用户使用)

curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/install.sh | bash -s -- --no-skills skillhub install wangyan-gemini-image-gen

text

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Allowing arbitrary --base-url provider selection means the skill can be pointed at any external endpoint, including untrusted or attacker-controlled services, while sending API keys, prompts, and input images. In an image-editing skill, this context makes the issue more dangerous because user-supplied images may contain sensitive personal or business data.
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
bash
uv run {baseDir}/scripts/generate_image.py --prompt "描述" --filename "output.png" \ --base-url "https://example.com/v1" --api-key "sk-xxx" --model "gemini-3.1-flash-image-preview"

使用 Google 原生格式

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The credential-access finding is substantiated because the script defines logic to enumerate and parse multiple .env files, including global and workspace scopes. In this skill context, that behavior can pull in secrets unrelated to the current task and make them available to subsequent network operations.
Content: Scanner excerpt · scripts/generate_image.py (reported line 54)May include surrounding context.
python
# 检查 uv 是否存在 check_uv() # 加载 .env 文件（在导入其他模块之前） def load_env_files(verbose: bool = False) -> list[Path]: """ 从多个位置加载 .env 文件，优先级从低到高：

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: This line documents the multi-scope .env loading behavior that expands credential reach beyond the immediate skill directory. In an agent environment, broad secret discovery materially increases the chance of unintended credential use or leakage.
Content: Scanner excerpt · scripts/generate_image.py (reported line 57)May include surrounding context.
python
# 加载 .env 文件（在导入其他模块之前） def load_env_files(verbose: bool = False) -> list[Path]: """ 从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置)

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The declared loading of ~/.openclaw/.env shows the skill is intended to read global user-level configuration, which may contain unrelated secrets. That broadens the blast radius if the skill is invoked in a shared or multi-purpose environment.
Content: Scanner excerpt · scripts/generate_image.py (reported line 58)May include surrounding context.
python
def load_env_files(verbose: bool = False) -> list[Path]: """ 从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置)

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: Reading a skill-local .env is a common and generally acceptable way to supply configuration. Unlike the global/workspace .env behavior, this source is task-adjacent and does not by itself imply excessive credential access.
Content: Scanner excerpt · scripts/generate_image.py (reported line 59)May include surrounding context.
python
""" 从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
md
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 60)May include surrounding context.
python
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 62)May include surrounding context.
python
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 730)May include surrounding context.
python
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 731)May include surrounding context.
python
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 732)May include surrounding context.
python
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 740)May include surrounding context.
python
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 741)May include surrounding context.
python
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 742)May include surrounding context.
python
从多个位置加载 .env 文件，优先级从低到高： 1. /workspace/.env (沙箱环境) 2. ~/.openclaw/.env (全局配置) 3. 技能目录下的 .env (技能本地配置) 返回实际加载的 .env 文件路径列表 """

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: Referencing /workspace/.env explicitly causes the skill to inspect a workspace-wide secret store, which may include credentials unrelated to this skill. In an agent runtime, that violates least-privilege expectations and can enable unintended secret consumption.
Content: Scanner excerpt · scripts/generate_image.py (reported line 72)May include surrounding context.
python
env_paths: list[Path] = [] loaded_paths: list[Path] = [] # 1. 沙箱环境 /workspace/.env sandbox_env = Path("/workspace/.env") if sandbox_env.exists(): env_paths.append(sandbox_env)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The existence check on /workspace/.env is part of the unauthorized credential discovery path. Even passive discovery of workspace secrets is risky when followed by automatic loading into process environment.
Content: Scanner excerpt · scripts/generate_image.py (reported line 73)May include surrounding context.
python
loaded_paths: list[Path] = [] # 1. 沙箱环境 /workspace/.env sandbox_env = Path("/workspace/.env") if sandbox_env.exists(): env_paths.append(sandbox_env)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The code targets ~/.openclaw/.env, a user-global configuration location that can hold sensitive credentials for unrelated tasks. Accessing it by default broadens credential exposure and can cause accidental cross-task secret reuse.
Content: Scanner excerpt · scripts/generate_image.py (reported line 77)May include surrounding context.
python
if sandbox_env.exists(): env_paths.append(sandbox_env) # 2. 全局配置 ~/.openclaw/.env home = Path.home() global_env = home / ".openclaw" / ".env" if global_env.exists():

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Vague Triggers

Chaining Abuse

Chaining Abuse

External Script Fetching

使用腾讯 skillhub 安装 (推荐国内用户使用)

External Model or Provider Selection

使用 Google 原生格式

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis