ClawHub
Back to skill

Security audit

Jiekou Multimodal

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its multimodal API purpose, but it handles API keys unsafely and under-explains third-party data sharing.

Review before installing. Do not paste a real API key into chat, and avoid the copy-run config command unless you also protect the file permissions. Expect your prompts, media URLs, images, audio, or video content to be sent to Jiekou AI for processing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:33
Finding

API Keys Are Accepted Through Chat Messages

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:33-45
Vulnerability Type: Plaintext secret exposure through conversational input
Risk Level: Medium

Vulnerable Code Snippet

markdown
### Method 3: Pass directly as a parameter

Provide it directly in the request: `Please use API Key sk_xxx to generate an image...`

## API Key lookup logic

1. Check whether the user message contains an API Key (starting with sk_)
2. Check the configuration file ~/.jiekou/config.json
3. Check the JIEKOU_API_KEY environment variable
4. If none is available, return configuration guidance

The excerpt above is translated into English for reporting purposes; the source file contains the equivalent instructions in Chinese.

Technical Analysis

The skill explicitly instructs users to place bearer credentials in conversational messages and gives such credentials the highest lookup priority. Chat input is not an appropriate secret-storage or secret-transfer mechanism because prompts may be retained in conversation history, telemetry, debugging traces, exported transcripts, or other platform logs. They may also be exposed to other tools or agents that can access session context.

A key found merely by matching an sk_ prefix may also be captured from quoted material or unrelated text. The documentation does not require explicit secret confirmation, redaction, bounded validation, or removal of the credential from subsequent context.

Attack Path

  1. A user follows the documented direct-parameter method and submits a valid key in a chat message.
  2. The plaintext key becomes part of the session history and may enter platform logs or traces.
  3. A party with access to those records, such as another user of a shared transcript, an operator, a compromised integration, or an overly broad diagnostic system, retrieves the key.
  4. The party uses the bearer key directly against https://api.jiekou.ai.
  5. Requests are charged to the victim and remain possible until th ...[truncated 446 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove support for submitting API keys through chat messages and remove chat-message key scanning from both SKILL.md and agents/openclaw.yaml.
  2. Accept credentials only through a platform-managed secret store or a dedicated masked credential input mechanism.
  3. If conversational submission cannot be eliminated immediately:
    • Require explicit user confirmation before extracting a candidate secret.
    • Never echo the key.
    • Redact matching values from logs, traces, errors, and conversation exports.
    • Validate the complete credential format rather than searching for any sk_ substring.
    • Clear the sensitive value from transient state immediately after constructing the authenticated request.
  4. Document key rotation and revocation procedures for users who previously submitted keys through chat.
  5. Add tests verifying that prompts containing sk_ values are neither treated as credentials nor retained in diagnostic output.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:13
Finding

Configuration Instructions Store API Keys in a Plaintext File Without Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-25
Vulnerability Type: Insecure local credential storage and file permissions
Risk Level: Medium

Vulnerable Code Snippet

markdown
Create the file `~/.jiekou/config.json`:

```json
{
  "api_key": "your_API_Key"
}

Configure with one command:

bash
mkdir -p ~/.jiekou && echo '{"api_key": "your_API_Key"}' > ~/.jiekou/config.json
text

The excerpt above is translated into English for reporting purposes; the source file contains the equivalent instructions in Chinese.

### Technical Analysis

The recommended command writes a bearer API key as plaintext but does not establish restrictive permissions on either `~/.jiekou` or `config.json`. The resulting mode depends on the caller's current `umask`. Under permissive settings, the credential file may be readable by other local accounts or processes.

The command also places the secret directly in a shell command. Depending on how the user substitutes and executes it, the command can be retained in shell history, terminal capture, process auditing, or automation logs. The instructions provide no permission check, atomic file creation, secret-store integration, or warning against committing or backing up the file.

### Attack Path

1. A user substitutes a real API key into the documented `echo` command and executes it.
2. The key is written to `~/.jiekou/config.json` with permissions inherited from the environment's `umask`; the command may also remain in shell history.
3. On a shared or compromised host, another local account or process reads the file or command history if permissions permit.
4. The attacker extracts the bearer token.
5. The attacker submits authenticated, billable requests to the documented external API until the credential is rotated or its limits are reached.

Exploitation requires local access to readable configuration data, shell history, logs, or backups; the reviewed project does not itself create that access.


...[truncated 366 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer an operating-system keychain or platform-managed secret store instead of a plaintext JSON file.
  2. If file-based storage is required, create the directory and file with explicit owner-only permissions:
bash
install -d -m 700 "$HOME/.jiekou"
umask 077
printf '%s\n' '{"api_key":"REPLACE_INTERACTIVELY"}' > "$HOME/.jiekou/config.json"
chmod 600 "$HOME/.jiekou/config.json"
  1. Do not instruct users to type the real key directly into a shell command. Provide a setup utility that reads it silently, for example through a non-echoing prompt, and writes it without exposing it in process arguments or shell history.
  2. Refuse to use the file if it is not a regular file, is owned by another user, or is accessible by group or other users.
  3. Avoid following symbolic links when creating or reading the credential file, and use atomic creation to reduce replacement and race risks.
  4. Add automated tests that assert directory mode 0700 and credential-file mode 0600.
  5. Document credential rotation and advise users to remove any historical commands containing keys from logs and shell history.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (30)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly tells users to place an API key directly in the prompt, which causes the credential to be embedded in chat content and potentially exposed to logs, transcripts, model context, analytics, or downstream tooling. Because API keys are bearer secrets, disclosure can enable unauthorized use, billing abuse, and reuse across sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The natural-language instructions, prompts, and operational guidance are presented only in Chinese, which effectively forces a specific language experience. There is no user opt-in, alternative language option, or documented reason that the skill must be Chinese-only.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

一条命令完成配置：

bash
mkdir -p ~/.jiekou && echo '{"api_key": "你的API_Key"}' > ~/.jiekou/config.json

方式2：环境变量

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

一条命令完成配置:

bash
mkdir -p ~/.jiekou && echo '{"api_key": "你的API_Key"}' > ~/.jiekou/config.json

方式2:环境变量

Ssd 3

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill normalizes passing API keys in conversational text and even prioritizes reading a key from the user message first, increasing the chance that sensitive credentials are captured and retained in chat history. In this context, the danger is elevated because the skill is designed to send authenticated requests to an external service, so a leaked key can be immediately abused for paid API access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

文生图

bash
curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The interface display name, description, and operational prompt are entirely in Chinese and direct behavior in that language, with no indication that users may choose another language. This creates a language/locale policy concern because it imposes a specific language without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest says to use the skill for 'multimodal tasks' without defining specific trigger phrases, scope limits, or exclusion conditions. Because multimodal tasks are a very broad class of requests, this can cause unintended invocation overlap with other general-purpose skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to obtain API keys from user messages, a local config file, and environment variables without any warning or safeguards around sensitive credential handling. In a conversational system, this increases the chance that secrets are solicited, echoed back, logged, or mishandled during normal operation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Prioritizing API keys supplied directly in user messages normalizes sending secrets through natural-language chat, which is a high-risk pattern. This can cause credential exposure through prompt history, model retention layers, logs, debugging tools, or accidental reflection back to the user, especially in a skill that is designed to act on user requests immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The API reference instructs use of external endpoints for images, audio, video, and text but does not warn that user-provided content will be transmitted to a third-party service. This creates a meaningful privacy and data-handling risk, especially for sensitive media or confidential prompts, because users may not realize their content leaves the local environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes the skill as handling text-to-image, image-to-image, text-to-video, image-to-video, TTS, and STT. However, this reference file also documents a separate '多模态理解' capability via chat completions for analyzing image, audio, and video inputs, which is a distinct understanding/inference function not claimed in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

All user prompts, status messages, and examples are presented exclusively in Chinese, and the file does not indicate that language selection is configurable or that the skill is intentionally limited to a Chinese-speaking context. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The examples instruct sending user-supplied media URLs to third-party APIs without any privacy notice, consent step, or data-handling disclosure. In a multimodal skill, attached images, audio, and video often contain sensitive personal or proprietary data, so silent external transmission can expose user content unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

技能清单描述仅声明“文生图、图生图、文生视频、图生视频、TTS、STT”，并说明适用于生成图片、生成视频、文字转语音、语音识别。该示例文档却进一步指导调用视觉理解聊天接口进行图片描述、OCR、视频内容理解和风格分析，这些属于额外的理解/分析能力，而非已声明的生成或语音转换范围。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The natural-language content in the test cases, including expected user-visible error and guidance messages, is consistently written in Chinese. Because the file does not indicate that the skill is region-specific or that users can opt into this locale, it appears to impose a specific language without user choice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

文档建议用户通过 shell 命令将 API Key 明文写入 ~/.jiekou/config.json，属于持久化敏感凭据的做法；如果文件权限未严格限制，其他本地用户、备份系统或意外上传都可能暴露密钥。测试文档还鼓励“复制运行”，会放大不安全默认配置被直接采纳的风险。

Content

Scanner excerpt · references/test-cases.md (reported line 12)May include surrounding context.

"您还没有配置接口AI的 API Key。

快速配置（复制运行）： mkdir -p ~/.jiekou && echo '{"api_key": "你的Key"}' > ~/.jiekou/config.json

获取 Key：https://jiekou.ai/settings/key-management"

text

Static analysis

No suspicious patterns detected.