PPIO Multimodal Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:59 AM UTC
• Version: 0.2.1

Overview

The skill's PPIO multimodal purpose is coherent, but it normalizes unsafe API-key handling and sends sensitive media to an external service without adequate privacy guidance.

Review this skill before installing. Use an environment variable or a properly permissioned secret store for the PPIO key, do not paste API keys into chat, and avoid submitting private recordings, faces, documents, confidential prompts, or meeting audio unless you accept PPIO's handling of that data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33
• Finding: API Key Accepted Through User Messages## Vulnerability Details **File Location**: `SKILL.md:33-35`; duplicated in `agents/openclaw.yaml:6-10` **Vulnerability Type**: Sensitive credential exposure through conversation history **Risk Level**: Medium ### Vulnerable Code ```text ### 方式3：直接传参 在请求中直接提供：`请用 API Key sk_xxx 生成一张图片...` ``` The agent configuration reinforces this behavior: ```yaml API Key 读取顺序： 1. 用户消息中的 Key（sk_ 开头） 2. ~/.ppio/config.json 配置文件 3. PPIO_API_KEY 环境变量 ``` ### Technical Analysis The skill explicitly instructs users to submit a PPIO API key in a chat message and gives message contents the highest credential-source priority. Credentials entered into a conversation can be retained in chat history, application logs, telemetry, debugging traces, backups, or other systems that process agent transcripts. The documented detection criterion only identifies a key by the `sk_` prefix. No redaction, key validation, log-suppression, or transcript-retention control is documented. Consequently, a secret supplied for API authentication may become visible outside the minimum component that needs it. ### Attack Path 1. A user follows the documented direct-parameter option and submits a valid `sk_...` API key in a chat message. 2. The message is stored or processed by conversation-history, logging, telemetry, support, or debugging infrastructure. 3. An actor with access to one of those records retrieves the plaintext key. 4. The actor sends requests to PPIO using `Authorization: Bearer <stolen-key>`. 5. Requests execute against the victim's PPIO account until the key is revoked or otherwise expires. ### Impact Assessment An exposed key may permit unauthorized use of the PPIO account within the permissions assigned to that key. This can consume the victim's account balance, submit media-generation or transcription jobs, and access any API operations authorized for the credential. This issue does not, by itself, grant local operating ...[truncated 69 chars]
• Remediation: ## Remediation Suggestions - Remove user-message API keys from the supported credential sources. - Use environment-based secret injection, an operating-system credential store, or a dedicated secret manager. - Never reproduce credentials in agent responses, error messages, progress updates, or debug output. - Add explicit secret-redaction controls for values matching the expected PPIO key format. - Ensure authentication headers and request metadata are excluded from logs and telemetry. - If interactive secret entry is unavoidable, use a dedicated masked credential-input channel that is not added to the conversation transcript. - Document immediate revocation and rotation procedures for credentials accidentally submitted through chat. - Use narrowly scoped keys and account-level spending limits where PPIO supports them.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13
• Finding: Plaintext API Key Written Without Explicit Restrictive Permissions## Vulnerability Details **File Location**: `SKILL.md:13-24` **Vulnerability Type**: Insecure local secret storage and shell-history exposure **Risk Level**: Medium ### Vulnerable Code ```markdown ### 方式1：配置文件（推荐） 创建文件 `~/.ppio/config.json`： ```json { "api_key": "你的API_Key" } ``` **一条命令完成配置：** ```bash mkdir -p ~/.ppio && echo '{"api_key": "你的API_Key"}' > ~/.ppio/config.json ``` ``` ### Technical Analysis The recommended setup command writes the API key as plaintext without explicitly setting restrictive permissions on either `~/.ppio` or `~/.ppio/config.json`. The resulting permissions depend on the user's current `umask` and any pre-existing directory permissions. In an environment with permissive defaults, another local account may be able to read the credential. The command also places the literal API key in the shell command line. Interactive shells commonly retain entered commands in history files, creating an additional persistent copy of the credential. No permission verification, atomic secret-file creation, history-safe input method, or rotation guidance is provided. ### Attack Path 1. A user replaces the placeholder with a valid API key and runs the documented command. 2. The key is written in plaintext to `~/.ppio/config.json` and may also be retained in shell history. 3. If the user's `umask`, home-directory permissions, configuration-directory permissions, history permissions, backups, or host access controls are permissive, another local actor or process reads the key. 4. The actor authenticates to PPIO with the recovered key. 5. The actor consumes API resources under the victim's account until the credential is revoked. Exploitation is conditional on local read access or access to shell-history or backup data; the documentation does not itself create privilege escalation. ### Impact Assessment Successful exploitation exposes the PPIO credential and permits operatio ...[truncated 293 chars]
• Remediation: ## Remediation Suggestions - Prefer an operating-system credential store or dedicated secret manager instead of a plaintext JSON file. - If file storage is required, create the directory and file with explicit owner-only permissions: ```bash install -d -m 700 "$HOME/.ppio" umask 077 read -rsp "PPIO API key: " PPIO_API_KEY printf '\n' printf '{"api_key":"%s"}\n' "$PPIO_API_KEY" > "$HOME/.ppio/config.json" chmod 600 "$HOME/.ppio/config.json" unset PPIO_API_KEY ``` - Avoid embedding the key directly in a command that may be saved to shell history. - Reject configuration files not owned by the current user or accessible by group or other users. - Do not print the loaded key or include it in logs and error messages. - Document credential rotation and revocation procedures. - Recommend narrowly scoped keys and spending limits where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (62)

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs users to place the API key directly in the request text, which can expose credentials in chat history, logs, analytics pipelines, screenshots, or downstream model context. Because the documented key lookup logic prioritizes extracting a key from the user message, the skill normalizes insecure credential handling rather than treating it as sensitive data.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The STT examples send audio and meeting recordings to an external service without warning that they may contain highly sensitive personal, biometric, or confidential business information. This creates a meaningful privacy and compliance risk if users submit recordings without informed consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

**一条命令完成配置：**
```bash
mkdir -p ~/.ppio && echo '{"api_key": "你的API_Key"}' > ~/.ppio/config.json
```

### 方式2：环境变量

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**一条命令完成配置:**
```bash
mkdir -p ~/.ppio && echo '{"api_key": "你的API_Key"}' > ~/.ppio/config.json
```

### 方式2:环境变量

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples send prompts, images, audio, or Base64 media to a third-party API without warning users that their content leaves the local environment. This is especially sensitive for STT and image/video tasks, where user data may contain private speech, faces, documents, or proprietary content and could be retained or processed by the external provider.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 文生图

```bash
curl -X POST "https://api.ppio.com/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述"}'

• Confidence: 68% confidence
• Finding: The documented endpoint indicates that prompt data and bearer credentials are sent to api.ppio.com, which constitutes third-party data transmission. While core to the multimodal service, the risk remains because the skill does not pair this with adequate privacy and secret-handling guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 文生图

```bash
curl -X POST "https://api.ppio.com/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述"}'

• Confidence: 68% confidence
• Finding: The documented endpoint indicates that prompt data and bearer credentials are sent to api.ppio.com, which constitutes third-party data transmission. While core to the multimodal service, the risk remains because the skill does not pair this with adequate privacy and secret-handling guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 图片编辑

```bash
curl -X POST "https://api.ppio.com/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "编辑指令", "reference_images": ["图片URL"]}'

• Confidence: 76% confidence
• Finding: The image editing example transmits editing instructions and reference image URLs to an external API, potentially exposing personal images or proprietary assets. In a multimodal editing skill this is expected behavior, but the lack of privacy framing makes inadvertent data disclosure more likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 文生视频

```bash
curl -X POST "https://api.ppio.com/v3/async/vidu-q3-pro-t2v" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "duration": 4}'

• Confidence: 75% confidence
• Finding: The text-to-video example sends user prompts and parameters to an external API. Although normal for this capability, the skill omits disclosure that creative or proprietary prompts will be processed by an outside provider, which can matter for confidential projects.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 图生视频

```bash
curl -X POST "https://api.ppio.com/v3/async/vidu-q3-pro-i2v" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "动作描述", "images": ["图片URL"]}'

• Confidence: 79% confidence
• Finding: The image-to-video example uploads image URLs and prompt text to a third-party service, potentially disclosing sensitive or personal imagery. The skill's context makes the transmission functional rather than malicious, but lack of warning leaves users uninformed about the exposure boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

### TTS

```bash
curl -X POST "https://api.ppio.com/v3/async/minimax-speech-2.8-turbo" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 78% confidence
• Finding: The TTS example transmits text content to a third-party endpoint, which may include sensitive messages or proprietary material. This is expected for cloud TTS, but the missing privacy warning and lack of content sensitivity guidance make accidental disclosure more likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

### STT

```bash
curl -X POST "https://api.ppio.com/v3/glm-asr" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"file": "音频URL或Base64"}'

• Confidence: 87% confidence
• Finding: The STT example sends an audio URL or Base64-encoded audio to an external provider, which can expose voiceprints, conversations, and other sensitive spoken content. In this context the transmission is expected, but STT is particularly privacy-sensitive and should not be documented without explicit warning and consent guidance.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The user-facing display name, description, and default prompt are entirely in Chinese, and the prompt instructs the agent how to respond without indicating that other languages are supported. This creates a language/locale policy concern because the skill appears to enforce a specific language without user opt-in or an explicit region-specific justification.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 文生图

**POST** `https://api.ppio.com/v3/seedream-5.0-lite`

### 请求

• Confidence: 94% confidence
• Finding: This endpoint sends user text prompts to an external API at api.ppio.com for image generation. External transmission is expected for this skill's purpose, but it is still security-relevant because potentially sensitive prompts are disclosed to a third party and the documentation does not pair the endpoint with an explicit privacy warning.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The API reference documents multiple endpoints that send user-provided text, images, audio, and media URLs to a third-party service, but it does not warn users that their content leaves the local environment. This creates a real privacy and data-handling risk because users may submit sensitive media or prompts without informed consent, especially in a multimodal skill where uploaded content is likely personal or proprietary.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 图片编辑

**POST** `https://api.ppio.com/v3/seedream-5.0-lite`

### 请求

• Confidence: 96% confidence
• Finding: The image editing endpoint transmits both text prompts and reference image URLs to an external provider. In context, this is more sensitive than plain text generation because images may contain biometric, personal, or proprietary information, making undocumented third-party transfer a meaningful privacy risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 文生视频（异步）

**POST** `https://api.ppio.com/v3/async/vidu-q3-pro-t2v`

### 请求

• Confidence: 93% confidence
• Finding: The text-to-video endpoint sends prompts to an external service and returns an asynchronous task ID. The transmission itself is functionally necessary, but without clear disclosure it can expose sensitive creative, business, or personal text to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 图生视频（异步）

**POST** `https://api.ppio.com/v3/async/vidu-q3-pro-i2v`

### 请求

• Confidence: 96% confidence
• Finding: The image-to-video endpoint sends prompts and source image URLs to an external API. Because source images may reveal individuals, locations, internal documents, or other sensitive material, this endpoint carries real privacy implications in a multimodal skill and is more dangerous without explicit user warning.

External Transmission

Medium

• Category: Data Exfiltration

Content

## TTS - 文字转语音（异步）

**POST** `https://api.ppio.com/v3/async/minimax-speech-2.8-turbo`

### 请求

• Confidence: 95% confidence
• Finding: The TTS endpoint sends user-supplied text to an external provider for synthesis. Although lower risk than raw image/audio upload, the text may still contain sensitive information, and the documentation does not make third-party transmission or privacy implications explicit.

External Transmission

Medium

• Category: Data Exfiltration

Content

## STT - 语音转文字

**POST** `https://api.ppio.com/v3/glm-asr`

### 请求

• Confidence: 98% confidence
• Finding: The STT endpoint transmits audio by URL or Base64 to an external service for transcription. This is particularly sensitive because audio can contain biometric voice data, personal conversations, credentials spoken aloud, or regulated information, so undocumented external processing materially increases privacy and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

使用模型：Seedream 5.0 Lite
预计费用：约 ￥0.245

执行：POST https://api.ppio.com/v3/seedream-5.0-lite
请求：{"prompt": "转换为油画风格", "reference_images": ["图片URL"]}
```

• Confidence: 89% confidence
• Finding: This request sends a user-supplied image URL to an external provider for editing. In the skill context, that is more sensitive than prompt-only generation because images may contain personal data, and the example lacks any privacy or consent warning.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The image-editing examples instruct sending user-provided image URLs to an external API without any warning that the content leaves the local environment. Users may unknowingly transmit sensitive photos or private hosted URLs to a third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

```
用户：把图片背景换成海滩 [附图片]

执行：POST https://api.ppio.com/v3/seedream-5.0-lite
请求：{"prompt": "替换背景为热带海滩", "reference_images": ["图片URL"]}
```

• Confidence: 89% confidence
• Finding: This background-replacement example transmits a user-provided image to a third-party API without clarifying data-sharing implications. Because uploaded images can contain faces, documents, or metadata, the omission increases privacy risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

使用模型：Vidu Q3 Pro
预计费用：约 ￥1.9-4

执行：POST https://api.ppio.com/v3/async/vidu-q3-pro-i2v
请求：{"prompt": "微风轻拂，云朵飘动，草丛摇曳", "images": ["图片URL"]}
```

• Confidence: 90% confidence
• Finding: The image-to-video example uploads user image URLs to a third-party service for animation. In this context, the danger comes from undisclosed sharing of potentially sensitive visual content rather than the mere existence of an external endpoint.

External Transmission

Medium

• Category: Data Exfiltration

Content

```
用户：给这张人像照片添加微动效果 [附图片]

执行：POST https://api.ppio.com/v3/async/vidu-q3-pro-i2v
请求：{"prompt": "轻微的头部转动，眨眼，自然呼吸", "images": ["图片URL"]}
```

• Confidence: 90% confidence
• Finding: Animating a portrait photo involves sending potentially identifiable biometric/personal imagery to an external API. The example omits any warning or consent language, making the transmission materially riskier in context.

Static analysis

No suspicious patterns detected.