Novita AI Multimodal

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:58 AM UTC
• Version: 0.2.0

Overview

The skill is a coherent Novita AI integration, but it asks users to expose API keys in chat and sends sensitive media to a third party without enough disclosure.

Review before installing. Use only a scoped Novita API key, prefer environment or managed secret storage, do not paste keys into chat, and avoid sending private images, voice recordings, documents, or confidential prompts unless you accept third-party Novita processing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:15

Finding

Insecure Plaintext and Chat-Based API Key Handling

Content

View full analysis

~/.novita/config.json ``` ### Method 2: Environment Variable ``` From `SKILL.md:29-38`: ```markdown ```bash export NOVITA_API_KEY="YOUR_API_KEY" ``` ### Method 3: Direct Parameter Include in request: `Please use API Key sk_xxx to generate an image...` --- ## API Key Reading Logic ``` 1. Check if user message contains API Key (starts with sk_) 2. Check config file ~/.novita/config.json 3. Check environment variable NOVITA_API_KEY ``` The same insecure message-based precedence is reinforced in `agents/openclaw.yaml:6-10`: ```yaml API Key reading order: 1. Key in user message (starts with sk_) 2. Config file ~/.novita/config.json 3. Environment variable NOVITA_API_KEY ``` ### Technical Analysis The recommended setup writes a long-lived bearer credential into `~/.novita/config.json` without explicitly setting secure directory or file permissions. The resulting permissions depend on the user's current `umask`; in an inadequately configured environment, the credential may be readable by other local users or processes. The Skill also explicitly encourages users to place API keys directly into chat messages. Such credentials can consequently enter conversation histories, agent traces, telemetry, debugging output, backups, or other systems that process and retain messages. Giving message-provided credentials the highest precedence also increases the likelihood that sensitive keys will be handled as ordinary prompt conte ...[truncated 1643 chars]

Remediation

View remediation

~/.novita/config.json chmod 600 ~/.novita/config.json ``` 4. Validate file ownership and permissions before reading the configuration. Reject or warn about files accessible to group or other users. 5. Redact API-key patterns from logs, traces, error messages, and progress output. 6. Never include the bearer token in command output, URLs, diagnostic messages, or completion responses. 7. Update both `SKILL.md` and `agents/openclaw.yaml` so that secure secret storage is the only recommended credential source. 8. Document key rotation and immediate revocation procedures for credentials that have already been submitted through chat. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly tells users to place an API key directly into the chat request, which encourages disclosure of credentials into conversational logs, transcripts, or other systems not intended for secret storage. If the chat platform, agent runtime, or monitoring tooling stores messages, the key could be exposed and then abused for unauthorized API usage and billing fraud.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises image, video, TTS, and STT functionality that necessarily sends user prompts, images, audio, or other media to Novita's external API, but it does not clearly warn users that their content will leave the local system. This creates a privacy and data-handling risk, especially for sensitive prompts or uploaded media, because users may not realize third-party transmission is part of normal operation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The recommended setup stores the API key persistently in a plaintext file under the user's home directory, increasing the chance of credential exposure through local compromise, backups, filesystem sharing, or accidental disclosure. Although common, recommending persistent plaintext secret storage without file-permission guidance or safer alternatives is a real security weakness.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Method 1: Config File (Recommended)

Create file ~/.novita/config.json:

json

{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The hardcoded Novita API endpoint confirms third-party network transmission. While external connectivity is required for this capability, the absence of trust-boundary warnings or privacy controls makes the transmission path a real risk when users assume local-only processing.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

Text-to-Image

bash

curl -X POST "https://api.novita.ai/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "description"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The hardcoded Novita API endpoint confirms third-party network transmission. While external connectivity is required for this capability, the absence of trust-boundary warnings or privacy controls makes the transmission path a real risk when users assume local-only processing.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

Text-to-Image

bash

curl -X POST "https://api.novita.ai/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "description"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The image-editing flow sends both the editing prompt and reference image URLs to Novita, which may disclose user media and associated instructions to a third party. This is more sensitive than plain text because images may contain personal, proprietary, or location-bearing information.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

Image Editing

bash

curl -X POST "https://api.novita.ai/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "edit instruction", "reference_images": ["image_url"]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The text-to-video flow sends user prompts to a third-party API. This is expected for the service, but without explicit disclosure and consent, users may unknowingly transmit confidential creative concepts or sensitive text outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

Text-to-Video

bash

curl -X POST "https://api.novita.ai/v3/async/vidu-q3-pro-t2v" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "description", "duration": 4}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The image-to-video flow transmits both prompts and image references to an external provider, exposing potentially sensitive visual content. Because the skill handles media, the privacy impact is elevated compared with ordinary text-only requests.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

Image-to-Video

bash

curl -X POST "https://api.novita.ai/v3/async/vidu-q3-pro-i2v" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "motion description", "images": ["image_url"]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The TTS endpoint sends user text content to Novita for synthesis, creating a third-party data exposure path. Even though TTS is the intended service behavior, the skill does not warn that confidential text may be processed externally.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

TTS

bash

curl -X POST "https://api.novita.ai/v3/async/minimax-speech-2.8-turbo" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The STT flow sends audio content or base64-encoded audio to an external API, which can include highly sensitive voice data, conversations, or biometric-like information. This is more dangerous than generic external transmission because recorded speech often contains personal data and may be subject to stricter privacy expectations.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

STT

bash

curl -X POST "https://api.novita.ai/v3/glm-asr" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"file": "audio_url_or_base64"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The task-result query endpoint performs external transmission to retrieve job status and results. By itself this is lower impact than content upload, but it still expands third-party network interaction and should be disclosed as part of the skill's data flow.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

Task Result Query

bash

curl "https://api.novita.ai/v3/async/task-result?task_id=$TASK_ID" \
  -H "Authorization: Bearer $API_KEY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This API reference documents prompts, images, audio files, and transcription inputs being sent to api.novita.ai, but it does not warn users that their text, media, or potentially sensitive personal/business data will be transmitted to a third-party provider. In a multimodal skill, users may submit private images, voice recordings, or confidential text, so the omission increases the risk of inadvertent data disclosure and non-compliant handling of sensitive content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The examples repeatedly instruct sending attached images, audio, and text to third-party API endpoints but do not warn that user-provided content leaves the local environment. In a multimodal skill, these attachments may contain personal, confidential, biometric, or copyrighted data, so omission of a disclosure materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples introduce workflows for image analysis and text summarization that are not declared in the skill metadata, expanding the apparent scope of what the skill can do. This can mislead users and calling agents into sending additional sensitive content for processing under assumptions that are not documented or governed, increasing the risk of unintended data exposure and unsafe capability chaining.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/test-cases.md (reported line 12)May include surrounding context.

"You have not configured your Novita AI API Key.

Quick setup (copy and run): mkdir -p ~/.novita && echo '{"api_key": "YOUR_KEY"}' > ~/.novita/config.json

Get Key: https://novita.ai/settings/key-management"

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The test cases expect attached images, audio, and text to be sent to third-party API endpoints without any user-facing disclosure that their content leaves the local environment. This creates a privacy and consent risk, especially if users provide sensitive media or documents assuming processing is local or minimally shared.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The test cases extend behavior beyond the declared manifest by introducing image analysis and text summarization. Scope drift is dangerous because it can cause the agent to process additional user data or perform unreviewed actions that were not disclosed, weakening user consent and bypassing security review boundaries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The heading 'Image Analysis + New Image' suggests the skill can analyze image content, even though the documented scope only covers generation and speech tasks. Even without implementation detail, this kind of scope overstatement can cause downstream agents or users to rely on unsupported behavior and route sensitive images into an external workflow without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.