ClawHub
Back to skill

Security audit

PPIO Multimodal Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill's PPIO multimodal purpose is coherent, but it normalizes unsafe API-key handling and sends sensitive media to an external service without adequate privacy guidance.

Review this skill before installing. Use an environment variable or a properly permissioned secret store for the PPIO key, do not paste API keys into chat, and avoid submitting private recordings, faces, documents, confidential prompts, or meeting audio unless you accept PPIO's handling of that data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:33
Finding

API Key Accepted Through User Messages

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:33-35; duplicated in agents/openclaw.yaml:6-10
Vulnerability Type: Sensitive credential exposure through conversation history
Risk Level: Medium

Vulnerable Code

text
### 方式3：直接传参

在请求中直接提供：`请用 API Key sk_xxx 生成一张图片...`

The agent configuration reinforces this behavior:

yaml
API Key 读取顺序：
1. 用户消息中的 Key（sk_ 开头）
2. ~/.ppio/config.json 配置文件
3. PPIO_API_KEY 环境变量

Technical Analysis

The skill explicitly instructs users to submit a PPIO API key in a chat message and gives message contents the highest credential-source priority. Credentials entered into a conversation can be retained in chat history, application logs, telemetry, debugging traces, backups, or other systems that process agent transcripts.

The documented detection criterion only identifies a key by the sk_ prefix. No redaction, key validation, log-suppression, or transcript-retention control is documented. Consequently, a secret supplied for API authentication may become visible outside the minimum component that needs it.

Attack Path

  1. A user follows the documented direct-parameter option and submits a valid sk_... API key in a chat message.
  2. The message is stored or processed by conversation-history, logging, telemetry, support, or debugging infrastructure.
  3. An actor with access to one of those records retrieves the plaintext key.
  4. The actor sends requests to PPIO using Authorization: Bearer <stolen-key>.
  5. Requests execute against the victim's PPIO account until the key is revoked or otherwise expires.

Impact Assessment

An exposed key may permit unauthorized use of the PPIO account within the permissions assigned to that key. This can consume the victim's account balance, submit media-generation or transcription jobs, and access any API operations authorized for the credential. This issue does not, by itself, grant local operating ...[truncated 69 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove user-message API keys from the supported credential sources.
  • Use environment-based secret injection, an operating-system credential store, or a dedicated secret manager.
  • Never reproduce credentials in agent responses, error messages, progress updates, or debug output.
  • Add explicit secret-redaction controls for values matching the expected PPIO key format.
  • Ensure authentication headers and request metadata are excluded from logs and telemetry.
  • If interactive secret entry is unavoidable, use a dedicated masked credential-input channel that is not added to the conversation transcript.
  • Document immediate revocation and rotation procedures for credentials accidentally submitted through chat.
  • Use narrowly scoped keys and account-level spending limits where PPIO supports them.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:13
Finding

Plaintext API Key Written Without Explicit Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-24
Vulnerability Type: Insecure local secret storage and shell-history exposure
Risk Level: Medium

Vulnerable Code

markdown
### 方式1：配置文件（推荐）

创建文件 `~/.ppio/config.json`：

```json
{
  "api_key": "你的API_Key"
}

一条命令完成配置：

bash
mkdir -p ~/.ppio && echo '{"api_key": "你的API_Key"}' > ~/.ppio/config.json
text

### Technical Analysis

The recommended setup command writes the API key as plaintext without explicitly setting restrictive permissions on either `~/.ppio` or `~/.ppio/config.json`. The resulting permissions depend on the user's current `umask` and any pre-existing directory permissions. In an environment with permissive defaults, another local account may be able to read the credential.

The command also places the literal API key in the shell command line. Interactive shells commonly retain entered commands in history files, creating an additional persistent copy of the credential. No permission verification, atomic secret-file creation, history-safe input method, or rotation guidance is provided.

### Attack Path

1. A user replaces the placeholder with a valid API key and runs the documented command.
2. The key is written in plaintext to `~/.ppio/config.json` and may also be retained in shell history.
3. If the user's `umask`, home-directory permissions, configuration-directory permissions, history permissions, backups, or host access controls are permissive, another local actor or process reads the key.
4. The actor authenticates to PPIO with the recovered key.
5. The actor consumes API resources under the victim's account until the credential is revoked.

Exploitation is conditional on local read access or access to shell-history or backup data; the documentation does not itself create privilege escalation.

### Impact Assessment

Successful exploitation exposes the PPIO credential and permits operatio
...[truncated 293 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer an operating-system credential store or dedicated secret manager instead of a plaintext JSON file.

  • If file storage is required, create the directory and file with explicit owner-only permissions:

    bash
    install -d -m 700 "$HOME/.ppio"
umask 077
read -rsp "PPIO API key: " PPIO_API_KEY
printf '\n'
printf '{"api_key":"%s"}\n' "$PPIO_API_KEY" > "$HOME/.ppio/config.json"
chmod 600 "$HOME/.ppio/config.json"
unset PPIO_API_KEY

  • Avoid embedding the key directly in a command that may be saved to shell history.

  • Reject configuration files not owned by the current user or accessible by group or other users.

  • Do not print the loaded key or include it in logs and error messages.

  • Document credential rotation and revocation procedures.

  • Recommend narrowly scoped keys and spending limits where supported.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (62)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs users to place the API key directly in the request text, which can expose credentials in chat history, logs, analytics pipelines, screenshots, or downstream model context. Because the documented key lookup logic prioritizes extracting a key from the user message, the skill normalizes insecure credential handling rather than treating it as sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The STT examples send audio and meeting recordings to an external service without warning that they may contain highly sensitive personal, biometric, or confidential business information. This creates a meaningful privacy and compliance risk if users submit recordings without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

一条命令完成配置：

bash
mkdir -p ~/.ppio && echo '{"api_key": "你的API_Key"}' > ~/.ppio/config.json

方式2：环境变量

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

一条命令完成配置:

bash
mkdir -p ~/.ppio && echo '{"api_key": "你的API_Key"}' > ~/.ppio/config.json

方式2:环境变量

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples send prompts, images, audio, or Base64 media to a third-party API without warning users that their content leaves the local environment. This is especially sensitive for STT and image/video tasks, where user data may contain private speech, faces, documents, or proprietary content and could be retained or processed by the external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
68% confidence
Finding

The documented endpoint indicates that prompt data and bearer credentials are sent to api.ppio.com, which constitutes third-party data transmission. While core to the multimodal service, the risk remains because the skill does not pair this with adequate privacy and secret-handling guidance.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

文生图

bash
curl -X POST "https://api.ppio.com/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
68% confidence
Finding

The documented endpoint indicates that prompt data and bearer credentials are sent to api.ppio.com, which constitutes third-party data transmission. While core to the multimodal service, the risk remains because the skill does not pair this with adequate privacy and secret-handling guidance.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

文生图

bash
curl -X POST "https://api.ppio.com/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
76% confidence
Finding

The image editing example transmits editing instructions and reference image URLs to an external API, potentially exposing personal images or proprietary assets. In a multimodal editing skill this is expected behavior, but the lack of privacy framing makes inadvertent data disclosure more likely.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

图片编辑

bash
curl -X POST "https://api.ppio.com/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "编辑指令", "reference_images": ["图片URL"]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
75% confidence
Finding

The text-to-video example sends user prompts and parameters to an external API. Although normal for this capability, the skill omits disclosure that creative or proprietary prompts will be processed by an outside provider, which can matter for confidential projects.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

文生视频

bash
curl -X POST "https://api.ppio.com/v3/async/vidu-q3-pro-t2v" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "duration": 4}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

The image-to-video example uploads image URLs and prompt text to a third-party service, potentially disclosing sensitive or personal imagery. The skill's context makes the transmission functional rather than malicious, but lack of warning leaves users uninformed about the exposure boundary.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

图生视频

bash
curl -X POST "https://api.ppio.com/v3/async/vidu-q3-pro-i2v" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "动作描述", "images": ["图片URL"]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

The TTS example transmits text content to a third-party endpoint, which may include sensitive messages or proprietary material. This is expected for cloud TTS, but the missing privacy warning and lack of content sensitivity guidance make accidental disclosure more likely.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

TTS

bash
curl -X POST "https://api.ppio.com/v3/async/minimax-speech-2.8-turbo" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The STT example sends an audio URL or Base64-encoded audio to an external provider, which can expose voiceprints, conversations, and other sensitive spoken content. In this context the transmission is expected, but STT is particularly privacy-sensitive and should not be documented without explicit warning and consent guidance.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

STT

bash
curl -X POST "https://api.ppio.com/v3/glm-asr" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"file": "音频URL或Base64"}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The user-facing display name, description, and default prompt are entirely in Chinese, and the prompt instructs the agent how to respond without indicating that other languages are supported. This creates a language/locale policy concern because the skill appears to enforce a specific language without user opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This endpoint sends user text prompts to an external API at api.ppio.com for image generation. External transmission is expected for this skill's purpose, but it is still security-relevant because potentially sensitive prompts are disclosed to a third party and the documentation does not pair the endpoint with an explicit privacy warning.

Content

Scanner excerpt · references/api-reference.md (reported line 34)May include surrounding context.

md
## 文生图

**POST** `https://api.ppio.com/v3/seedream-5.0-lite`

### 请求

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The API reference documents multiple endpoints that send user-provided text, images, audio, and media URLs to a third-party service, but it does not warn users that their content leaves the local environment. This creates a real privacy and data-handling risk because users may submit sensitive media or prompts without informed consent, especially in a multimodal skill where uploaded content is likely personal or proprietary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The image editing endpoint transmits both text prompts and reference image URLs to an external provider. In context, this is more sensitive than plain text generation because images may contain biometric, personal, or proprietary information, making undocumented third-party transfer a meaningful privacy risk.

Content

Scanner excerpt · references/api-reference.md (reported line 60)May include surrounding context.

md
## 图片编辑

**POST** `https://api.ppio.com/v3/seedream-5.0-lite`

### 请求

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The text-to-video endpoint sends prompts to an external service and returns an asynchronous task ID. The transmission itself is functionally necessary, but without clear disclosure it can expose sensitive creative, business, or personal text to a third party.

Content

Scanner excerpt · references/api-reference.md (reported line 87)May include surrounding context.

md
## 文生视频（异步）

**POST** `https://api.ppio.com/v3/async/vidu-q3-pro-t2v`

### 请求

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The image-to-video endpoint sends prompts and source image URLs to an external API. Because source images may reveal individuals, locations, internal documents, or other sensitive material, this endpoint carries real privacy implications in a multimodal skill and is more dangerous without explicit user warning.

Content

Scanner excerpt · references/api-reference.md (reported line 110)May include surrounding context.

md
## 图生视频（异步）

**POST** `https://api.ppio.com/v3/async/vidu-q3-pro-i2v`

### 请求

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The TTS endpoint sends user-supplied text to an external provider for synthesis. Although lower risk than raw image/audio upload, the text may still contain sensitive information, and the documentation does not make third-party transmission or privacy implications explicit.

Content

Scanner excerpt · references/api-reference.md (reported line 133)May include surrounding context.

md
## TTS - 文字转语音（异步）

**POST** `https://api.ppio.com/v3/async/minimax-speech-2.8-turbo`

### 请求

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The STT endpoint transmits audio by URL or Base64 to an external service for transcription. This is particularly sensitive because audio can contain biometric voice data, personal conversations, credentials spoken aloud, or regulated information, so undocumented external processing materially increases privacy and compliance risk.

Content

Scanner excerpt · references/api-reference.md (reported line 171)May include surrounding context.

md
## STT - 语音转文字

**POST** `https://api.ppio.com/v3/glm-asr`

### 请求

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This request sends a user-supplied image URL to an external provider for editing. In the skill context, that is more sensitive than prompt-only generation because images may contain personal data, and the example lacks any privacy or consent warning.

Content

Scanner excerpt · references/examples.md (reported line 73)May include surrounding context.

使用模型：Seedream 5.0 Lite 预计费用：约 ￥0.245

执行：POST https://api.ppio.com/v3/seedream-5.0-lite 请求：{"prompt": "转换为油画风格", "reference_images": ["图片URL"]}

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The image-editing examples instruct sending user-provided image URLs to an external API without any warning that the content leaves the local environment. Users may unknowingly transmit sensitive photos or private hosted URLs to a third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This background-replacement example transmits a user-provided image to a third-party API without clarifying data-sharing implications. Because uploaded images can contain faces, documents, or metadata, the omission increases privacy risk.

Content

Scanner excerpt · references/examples.md (reported line 81)May include surrounding context.

text
用户：把图片背景换成海滩 [附图片]

执行：POST https://api.ppio.com/v3/seedream-5.0-lite
请求：{"prompt": "替换背景为热带海滩", "reference_images": ["图片URL"]}

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The image-to-video example uploads user image URLs to a third-party service for animation. In this context, the danger comes from undisclosed sharing of potentially sensitive visual content rather than the mere existence of an external endpoint.

Content

Scanner excerpt · references/examples.md (reported line 123)May include surrounding context.

使用模型：Vidu Q3 Pro 预计费用：约 ￥1.9-4

执行：POST https://api.ppio.com/v3/async/vidu-q3-pro-i2v 请求：{"prompt": "微风轻拂，云朵飘动，草丛摇曳", "images": ["图片URL"]}

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Animating a portrait photo involves sending potentially identifiable biometric/personal imagery to an external API. The example omits any warning or consent language, making the transmission materially riskier in context.

Content

Scanner excerpt · references/examples.md (reported line 131)May include surrounding context.

text
用户：给这张人像照片添加微动效果 [附图片]

执行：POST https://api.ppio.com/v3/async/vidu-q3-pro-i2v
请求：{"prompt": "轻微的头部转动，眨眼，自然呼吸", "images": ["图片URL"]}

Static analysis

No suspicious patterns detected.