Stable Image Ultra

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:31 AM UTC
• Version: 2.0.0

Overview

This skill appears to generate images through AWS Bedrock as advertised, but it overreaches by trying to become the default image tool, encouraging unlimited paid use, and supporting unsafe credential entry patterns.

Install only if you intentionally want this skill to use your AWS account for Bedrock image generation. Prefer an AWS profile, SSO, role, or tightly scoped temporary credentials, avoid passing secrets on the command line, and set your own cost controls because the skill's instructions push default high-quality paid generation broadly.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Global Agent Behavior and Cost-Policy Hijacking

Content

View full analysis

" - Negative: "" - Output: <输出路径> - Aspect Ratio: <比例> ## 完成后 生成完毕后，报告文件路径、分辨率和文件大小。`, label: "生图-<简述>", runTimeoutSeconds: 180 }) // 派发后必须 yield 等待结果 sessions_yield({ message: "等待生图完成" }) ``` subagent 返回后，由调用方负责将图片发送给用户（根据当前 channel 选择合适方式）。 ### 例外（可以内联执行） - 调用方本身就是 subagent（不需要再嵌套） - 用户明确要求「直接生成」且愿意等待 ``` ### Technical Analysis The Skill does not merely document how to invoke its image-generation functionality. It instructs every agent to treat the Skill as the mandatory default, remove an alternative tool from consideration, use the highest-quality paid model without a cost limit, and employ a specific subagent orchestration pattern. These instructions exceed the minimum authority needed to provide optional AWS Bedrock image generation. A legitimate Skill can describe its capabilities and invocation requirements without redefining global tool-selection, cost, or orchestration policies. If the host agent follows the instructions when the Skill is loaded, they can alter behavior for re ...[truncated 1486 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.py:131

Finding

AWS Secrets Accepted Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tainted flow: 'req' from os.environ.get (line 37, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 39)May include surrounding context.

python

}
    req = urllib.request.Request(url, data=body.encode(), headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=180) as resp:
            return json.loads(resp.read())
    except urllib.error.HTTPError as e:
        err_body = e.read().decode() if e.fp else ""

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list contains very broad phrases such as generic image-generation requests, making this skill likely to auto-invoke in many routine conversations. Because the skill is also marked as the default for all agents and can consume paid AWS resources, overbroad triggering can cause unintended execution, cost exposure, and credentialed network actions without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill explicitly instructs use of multiple credential sources, including direct keys, bearer tokens, environment variables, and ~/.aws/credentials, and it advertises auto-detection across them. In a skill context, this encourages access to sensitive authentication material and increases the risk of credential exposure, misuse, or accidental transmission to subprocesses and logs.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

|--------|------------|
| **Bearer token** | `AWS_BEARER_TOKEN_BEDROCK` env var or `--bearer-token` |
| **Environment variables** | Set `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` |
| **Credentials file** | Configure `~/.aws/credentials` |
| **Named profile** | `--profile my-profile` or `AWS_PROFILE` env var |
| **Direct keys** | `--access-key AKIA... --secret-key ...` |
| **Temporary credentials** | Add `--session-token` with direct keys |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 110)May include surrounding context.

python

AWS auth methods (auto-detected):
  AWS_BEARER_TOKEN_BEDROCK      Bearer token (OpenClaw managed)
  --access-key + --secret-key   Direct IAM credentials
  --profile / AWS_PROFILE       Named profile (~/.aws/credentials)
  AWS_ACCESS_KEY_ID env var     Environment variables
  ~/.aws/credentials            Shared credentials file
  IAM instance role             EC2/ECS/Lambda

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 112)May include surrounding context.

python

AWS auth methods (auto-detected):
  AWS_BEARER_TOKEN_BEDROCK      Bearer token (OpenClaw managed)
  --access-key + --secret-key   Direct IAM credentials
  --profile / AWS_PROFILE       Named profile (~/.aws/credentials)
  AWS_ACCESS_KEY_ID env var     Environment variables
  ~/.aws/credentials            Shared credentials file
  IAM instance role             EC2/ECS/Lambda

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 151)May include surrounding context.

python

AWS auth methods (auto-detected):
  AWS_BEARER_TOKEN_BEDROCK      Bearer token (OpenClaw managed)
  --access-key + --secret-key   Direct IAM credentials
  --profile / AWS_PROFILE       Named profile (~/.aws/credentials)
  AWS_ACCESS_KEY_ID env var     Environment variables
  ~/.aws/credentials            Shared credentials file
  IAM instance role             EC2/ECS/Lambda

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes operational capabilities involving environment access and network use but does not declare any explicit tool scope or permission boundaries. This weakens least-privilege controls and increases the chance that an invoking agent can access credentials or make external calls beyond what users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The policy states "Prompt: 永远用英文" (always use English), which forces a specific language regardless of user preference. This is a natural-language policy issue because the file does not offer opt-in, alternatives, or a documented compliance reason for requiring English.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The statement "不用中文 prompt" forbids Chinese prompts outright rather than presenting English as a recommendation. This imposes a language/locale constraint on users without offering a choice or a narrowly documented justification.

Content

No source excerpt is available for this finding.