T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/doubao.sh:90- Finding
Unescaped User Input Allows JSON Request-Body Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Doubao Image Video Skill V2
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it says, but it promotes watermark removal and gives unsafe API-key handling instructions that could expose the user's Volcengine account.
Install only after review. Use a restricted, rotatable Volcengine ARK key, do not paste or share full ARK_API_KEY values, avoid storing the key in common shell startup files when a safer secret store is available, and assume prompts, image URLs, task metadata, and generated media URLs are sent to Volcengine. Do not use the watermark-removal examples unless you own the content or have explicit authorization, and avoid exposing this wrapper to untrusted prompts until JSON encoding is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:444- Finding
Troubleshooting Guidance Encourages Disclosure of the Complete API Key
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
README.md:65- Finding
API Key Verification Commands Print the Secret in Plaintext
- Content
View full analysis
> ~/.bashrc source ~/.bashrc # 验证 echo $ARK_API_KEY ``` The troubleshooting section repeats the same unsafe verification pattern: ```bash # 方式 1: 直接设置 export ARK_API_KEY="your_api_key_here" # 方式 2: 从配置文件 source source ~/.basic # 方式 3: 添加到 ~/.bashrc echo 'export ARK_API_KEY="your_api_key"' >> ~/.bashrc source ~/.bashrc # 验证 echo $ARK_API_KEY ``` ### Technical Analysis The verification command expands and prints the complete API key. Terminal output may be captured by shell-session recording, CI logs, remote support tools, screenshots, screen sharing, or copied command transcripts. Although printing a local environment variable requires the user to run the command, secure documentation should not normalize displaying secret material when a presence check is sufficient. The unquoted expansion also provides no security benefit and is unnecessary for verification. ### Attack Path 1. A user configures a real `ARK_API_KEY`. 2. The user follows the documented verification command. 3. `echo $ARK_API_KEY` writes the complete key to standard output. 4. Terminal output is recorded, shared, copied into diagnostics, or viewed by another person. 5. The observer retrieves and reuses the bearer credential against the Volcengine API. ### Impact Assessment A party who obtains the displayed value may perform remote API operations permitted by the key, consume quotas, and generate account charges. The impact is restricted to the authorization scope of the credential and does not directly provide local system privileges. The risk is lower than an automatic exfiltration flaw because ...[truncated 72 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (43)
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
HTTP客户端）
- jq（JSON处理，可选）
- ARK_API_KEY (从 https://console.volcengine.com/ark 获取)
安装步骤
bash # 1. 进入 skill 目录 cd ~/.openclaw/workspace/skills/doubao-skill-v2 # 2. 安装依赖 sudo apt-get install curl jq # Ubuntu/Debian # 或 brew install curl jq # macOS # 3. 设置环境变量 export ARK_API_KEY="your_api_key_here" # 或添加到 ~/.bashrc echo 'export ARK_API_KEY="your_api_key"' >> ~/.bashrc source ~/.bashrc # 4. 验证安装 cd scripts ./doubao.sh help
📚 使用方法
使用建议
- 优先使用方法1
- 视频生成任务优先使用同步方法,避免浪费token到监控步骤
方式 1(优先使用): Shell 脚本直接调用
bash cd ~/.openclaw/workspace/skills/doubao-skill-v2/scripts # 生成图片 ./doubao.sh img "一只可爱的小猫" # 编辑图片（去除水印） ./doubao.sh edit "https://..." "remove watermark" # 生成视频（异步） ./doubao.sh vid "一个人在跳舞" async '
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
HTTP客户端）
- jq（JSON处理，可选）
- ARK_API_KEY (从 https://console.volcengine.com/ark 获取)
安装步骤
bash # 1. 进入 skill 目录 cd ~/.openclaw/workspace/skills/doubao-skill-v2 # 2. 安装依赖 sudo apt-get install curl jq # Ubuntu/Debian # 或 brew install curl jq # macOS # 3. 设置环境变量 export ARK_API_KEY="your_api_key_here" # 或添加到 ~/.bashrc echo 'export ARK_API_KEY="your_api_key"' >> ~/.bashrc source ~/.bashrc # 4. 验证安装 cd scripts ./doubao.sh help
📚 使用方法
使用建议
- 优先使用方法1
- 视频生成任务优先使用同步方法,避免浪费token到监控步骤
方式 1(优先使用): Shell 脚本直接调用
bash cd ~/.openclaw/workspace/skills/doubao-skill-v2/scripts # 生成图片 ./doubao.sh img "一只可爱的小猫" # 编辑图片（去除水印） ./doubao.sh edit "https://..." "remove watermark" # 生成视频（异步） ./doubao.sh vid "一个人在跳舞" async '
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly implements watermark-removal assistance, which facilitates removal of provenance, branding, or copyright indicators from third-party images. In the context of a general image/video API wrapper, this adds a high-risk misuse capability unrelated to core functionality and can enable IP infringement or deceptive redistribution.
- Content
Ssd 2
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The default edit prompt automatically instructs the model to remove watermarks while preserving the original content, directly enabling attribution stripping with no extra user intent required. This lowers the barrier to misuse and creates a built-in circumvention behavior in the skill itself.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install curl jq # macOS brew install curl jq
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation advises users to persist the API key in ~/.bashrc, which stores a sensitive credential in a broadly readable and routinely sourced startup file without discussing exposure risks. This increases the chance of accidental disclosure through backups, screenshots, shell-history-adjacent troubleshooting, or access by other local processes/users.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Telling users to verify setup by running 'echo $ARK_API_KEY' encourages printing the full secret directly to the terminal, where it may be visible to shoulder-surfing, terminal logging, screen recording, or copied support transcripts. Exposing secrets in plaintext materially raises the risk of credential theft.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README demonstrates sending remote image URLs and prompts to an external API but does not clearly warn that user content is transmitted to a third-party service for processing. This omission can cause users to unknowingly upload sensitive media or confidential prompts, creating privacy and compliance risks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The troubleshooting section asks users to share 'env | grep ARK_API_KEY', which can disclose the full API key in issue reports, chats, logs, or tickets. This is a direct secret-leak pattern and could allow unauthorized API use if the credential is exposed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents and relies on shell execution but does not declare any explicit tool scope such as permissions or allowed-tools. This creates a security governance gap: an agent or platform may permit broader execution than intended, making review, sandboxing, and user consent harder for a skill that installs packages, edits shell startup files, and runs scripts.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md cd ~/.openclaw/workspace/skills/doubao-skill-v2 # 2. 安装依赖 sudo apt-get install curl jq # Ubuntu/Debian # 或 brew install curl jq # macOS
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation presents watermark/logo removal as a standard feature without any warning about copyright, ownership, authorization, or misuse. That normalizes a potentially abusive workflow and can facilitate unauthorized removal of attribution, licensing marks, or provenance indicators from third-party content.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly promotes watermark removal as a normal use case, which increases the likelihood of misuse for copyright evasion, attribution stripping, or fraudulent content reuse. In this context, the issue is more serious because the examples and default prompts directly steer users toward that behavior instead of presenting a general-purpose edit capability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest advertises text/image/video generation via the Doubao/Volcengine API but does not clearly warn that prompts, image URLs, and possibly related metadata will be transmitted to an external third-party service. This can lead users to submit sensitive data under the false assumption that processing is local, creating privacy, confidentiality, and compliance risks.
- Content
Static analysis
No suspicious patterns detected.