Ai Intelligent Image Generation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent image-generation purpose, but its install instructions fetch and run unpinned remote code that was not included in the reviewed package.

Review the remote GitHub repository and dependency list before installing, preferably pin a known commit and use locked dependency hashes. Avoid submitting confidential prompts or private images unless you understand which external AI services receive them and their data policies.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:38

Finding

Mutable Remote Repository and Unverified Dependencies Are Retrieved and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–41
Vulnerability Type: Remote payload retrieval and insecure dependency execution
Risk Level: High

bash

git clone https://github.com/openclaw-skills/ai-intelligent-image-generation
cd ai-intelligent-image-generation
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions clone an external Git repository without pinning it to a reviewed commit hash or signed release. They then install packages from a remote-controlled requirements.txt and execute the repository's app.py.

Neither requirements.txt nor app.py is present in the audited project, which contains only SKILL.md. Consequently, the effective dependency set and executed application cannot be inspected or verified as part of this audit. The remote repository's default branch can change after review, making the executed payload mutable. In addition, pip install may execute package build or installation logic, so an unsafe or compromised dependency could run code even before app.py starts.

Attack Path

1. An attacker compromises the referenced repository, gains control of an upstream dependency, or causes a malicious dependency to be included in requirements.txt.
2. The attacker modifies the remote application, dependency declarations, or package installation logic.
3. A user or agent follows the documented installation commands.
4. git clone retrieves the attacker-controlled content because no immutable commit is specified.
5. pip install -r requirements.txt downloads and may execute unverified dependency installation code.
6. python app.py directly executes the retrieved application with the invoking user's privileges.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running the commands. The accessible scope could include that user's files, environment variable ...[truncated 399 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the implementation and dependency manifests in the reviewed skill package so that all executed content is available for audit.
2. If remote retrieval is necessary, pin the repository to a specific verified commit hash rather than cloning a mutable default branch.
3. Use signed releases or verify downloaded content against a trusted cryptographic digest before installation or execution.
4. Pin every Python dependency to an exact version and use a lock file containing hashes, such as hash-locked requirements installed with pip --require-hashes.
5. Review direct and transitive dependencies, and obtain packages only from explicitly trusted indexes.
6. Avoid executing dependency build scripts where feasible; prefer reviewed, reproducible artifacts.
7. Run installation and application startup in an isolated, least-privileged environment with restricted filesystem access, sanitized credentials, and controlled network egress.
8. Document the expected files, verified revision, dependency versions, and integrity checks directly in SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises integration with external AI image services such as DALL-E API, but the description does not warn users that prompts and uploaded images may be transmitted to third-party providers. This creates a real privacy and data-handling risk because users may unknowingly submit sensitive text or images to external services with separate retention, logging, or training policies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The natural-language content of the skill, including its name/description sections and setup guidance, is presented exclusively in Chinese. This can constitute a language policy issue when the skill does not offer an alternative language, user opt-in, or a documented reason for the locale restriction.

Content

No source excerpt is available for this finding.