Ai Image Cli

• Outcome: Review
• Latest audit: May 28, 2026 · 2:43 PM UTC
• Version: 1.0.0

Overview

The skill does image generation as advertised, but its installer and credential handling create supply-chain and local command-execution risks users should review first.

Review before installing. Use this only if you trust the private package source and the NetEase/AIGW services, avoid sensitive prompts or private image URLs, and prefer a safer install path with HTTPS, no embedded credentials, pinned package versions, and safe parsing of credential files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The activation phrases are broad enough to match ordinary conversation such as requests to modify or create images, which can cause the skill to trigger unexpectedly. In a tool that can install software and send prompts or URLs to external services, over-broad activation increases the chance of unintended execution and data disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill does not clearly warn that prompts and user-supplied image URLs are transmitted to an external API provider for processing. This is a privacy and data-handling issue because users may provide sensitive images or internal URLs without understanding they will leave the local environment.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation instructs users to send prompts and source image URLs to external AIGW APIs, but it does not clearly warn that user-provided text and referenced images will leave the local environment and be processed by remote services. In an image-generation/editing skill, prompts and image URLs may contain sensitive personal, confidential, or internal information, so the missing disclosure can lead to unintended data exposure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The authentication section documents use of sensitive credentials in environment variables and a token exchange flow, but it omits operational security guidance such as avoiding credential leakage in shell history, CI logs, screenshots, shared profiles, or insecure host configuration. This increases the risk of accidental credential exposure and unauthorized API use.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script automatically sources ~/.openclaw/user.env in a non-interactive install path, importing arbitrary shell-defined environment variables into the current process without validation or a clear trust boundary. Because source executes shell syntax rather than merely parsing key=value pairs, a tampered env file could run arbitrary commands during installation and also inject sensitive package index credentials.

Credential Access

High

• Category: Privilege Escalation

Content

done

# ===================== 环境变量加载 =====================
# 与 preflight.sh 相同：非交互式 shell 需要主动 source user.env

USER_ENV_CANDIDATES=(
  "${HOME:+${HOME}/.openclaw/user.env}"

• Confidence: 91% confidence
• Finding: The installer explicitly targets a user env file as a source of credentials and then sources it into the shell context. In this skill context, the installer is designed for AI-driven non-interactive execution, which increases risk because the agent may run it automatically and expose or execute attacker-controlled configuration from a writable per-user file.

Credential Access

High

• Category: Privilege Escalation

Content

USER_ENV_CANDIDATES=(
  "${HOME:+${HOME}/.openclaw/user.env}"
  "/home/appops/.openclaw/user.env"
)

if [[ -z "${PIP_INDEX_URL:-}" ]] || [[ -z "${PIP_TRUSTED_HOST:-}" ]]; then

• Confidence: 90% confidence
• Finding: The alternate hardcoded path /home/appops/.openclaw/user.env broadens the credential-loading surface and may pull secrets from a shared or service account context. Combined with source, this can lead to command execution or unintended credential use across accounts, especially in automation environments where install scripts run with elevated trust.

Credential Access

High

• Category: Privilege Escalation

Content

# shellcheck source=/dev/null
      source "$candidate"
      set +a
      ENV_SOURCE="user.env"
      break
    fi
  done

• Confidence: 94% confidence
• Finding: Sourcing a credentials file executes it as shell code, not merely parses key-value pairs. If ~/.openclaw/user.env or /home/appops/.openclaw/user.env is writable by another user, replaced via symlink, or otherwise tampered with, running preflight.sh can trigger arbitrary command execution in the current user context while loading secrets.

Static analysis

No suspicious patterns detected.