ClawHub
Back to skill

Security audit

Beauty Image

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed image-generation skill whose API-key use and provider network calls fit its purpose, though users should understand prompts are sent to third-party image services.

Install only if you are comfortable sending image prompts and any included personal or business text to DashScope, Volcengine Ark, and optionally DeepSeek. Prefer dedicated API keys, avoid putting secrets or regulated data in prompts, pin dependencies if operating in a sensitive environment, and avoid the legacy --no-verify-ssl option.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/generate_image.py:2
Finding

Runtime Installation of an Unpinned Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/generate_image.py:2-6
  • scripts/generate_image_v2.py:2-6
  • scripts/generate_image_v3.py:2-6

Vulnerability Type: Supply-chain exposure through an open-ended dependency constraint
Risk Level: Medium

Vulnerable Code

The following dependency declaration is present in all three affected scripts:

python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2.31.0",
# ]
# ///

Technical Analysis

The scripts use PEP 723 inline metadata interpreted by uv run. The constraint requests>=2.31.0 does not identify a specific audited release and permits installation of any future version satisfying the minimum version.

The documented execution workflow invokes the scripts through uv run, which may resolve and install dependencies dynamically. The repository does not include an observed lockfile, artifact hashes, or another mechanism that guarantees installation of the exact dependency version reviewed by the Skill publisher.

This does not demonstrate that the current requests package is malicious. However, it creates a mutable supply-chain trust boundary: a future compromised package release, compromised package-index account, or manipulated dependency resolution source could introduce code that was not part of this audit.

Imported Python package code executes inside the image-generation process. That process may have access to:

  • DASHSCOPE_API_KEY
  • ARK_API_KEY or VOLC_API_KEY
  • DEEPSEEK_API_KEY
  • ~/.openclaw/openclaw.json
  • User image prompts and generated image URLs
  • Files readable or writable by the invoking operating-system account
  • Outbound network access

Attack Path

  1. An attacker compromises a future compatible requests release, its publication account, or a package source used by uv.
  2. The malicious release retains a version number satisfying requests>=2.31.0.

...[truncated 974 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the open-ended constraint with an exact, reviewed version:

    python
    # dependencies = [
#     "requests==2.32.5",
# ]

  2. Use a committed lockfile where supported and require locked or frozen dependency resolution in documented execution commands.

  3. Record and verify cryptographic hashes for approved distributions.

  4. Configure uv to use a trusted package index and prevent fallback to untrusted or unintended indexes.

  5. Add automated dependency review and vulnerability scanning before changing pinned versions.

  6. Reproduce the same hardened declaration in all three scripts so legacy entry points cannot bypass the dependency policy.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_image.py:118
Finding

Optional TLS Certificate Verification Bypass During Image Download

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/generate_image.py:118-122
  • scripts/generate_image.py:314-322

Vulnerability Type: Improper certificate validation and unvalidated remote file content
Risk Level: Low

Vulnerable Code

The legacy script exposes a command-line option that disables TLS certificate verification:

python
parser.add_argument(
    "--no-verify-ssl",
    action="store_true",
    help="Disable SSL certificate verification (use with caution)"
)

The option is applied when downloading the provider-returned image:

python
if args.filename:
    output_path = Path(args.filename)
    output_path.parent.mkdir(parents=True, exist_ok=True)
    
    print("Downloading image...")
    img_response = requests.get(
        image_url,
        timeout=30,
        verify=not args.no_verify_ssl
    )
    img_response.raise_for_status()

    with open(output_path, "wb") as f:
        f.write(img_response.content)

Technical Analysis

When --no-verify-ssl is supplied, requests does not authenticate the certificate presented by the image host. An active network attacker can therefore impersonate that host or interfere with the TLS connection.

The response body is written directly to the requested path without validating:

  • Whether the final URL still uses HTTPS
  • Whether redirects lead to an expected image-storage domain
  • The response Content-Type
  • The response size
  • The file signature or actual image format
  • Whether the returned content can be safely decoded as an image

The primary DashScope API calls and task polling calls still use certificate verification, and the image-download request does not attach the DashScope authorization header. Consequently, this issue does not directly expose the API key. Its scope is limited to the downloaded content and resulting local file.

Attack Path

  1. A user invokes `scripts/generat ...[truncated 1152 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --no-verify-ssl option and always require normal certificate validation.
  2. Reject non-HTTPS image URLs and non-HTTPS redirect destinations.
  3. Consider restricting downloads to documented provider-controlled image-storage domains.
  4. Set an explicit maximum response size and stream the download rather than loading an unrestricted body into memory.
  5. Require an expected image media type such as image/png, image/jpeg, or image/webp.
  6. Validate the downloaded file signature and decode it with a maintained image library before accepting it.
  7. Write to a temporary file first and atomically move it to the requested destination only after validation succeeds.
  8. If a certificate problem occurs, fail closed and provide troubleshooting guidance rather than allowing verification to be bypassed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (43)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

声明描述的是一个功能较丰富的商业化图片生成助手，重点在模板库、风格词典、意图识别、结构化提示词和多引擎路由。但代码并未实现这些高层能力；它只是接受用户提供的 prompt 和参数，调用 DashScope 的万相图片生成 API。虽然“AI图片生成”这一大方向一致，但声明中的核心卖点基本都没有在代码中出现，且所谓三引擎路由与实际仅支持 wan2.x 系列明显不符，因此属于实质性描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

代码确实实现了AI图片生成，并支持Wanx、Seedream4/5之间的自动/手动路由，这与声明中的‘三引擎智能路由’大体一致。它还包含基础的prompt质量增强、负面词、尺寸预设、顺序出图、多图返回、文件保存等功能。但声明中的多项核心卖点——‘40+场景模板’、‘30+风格词典’、‘智能意图识别’、‘结构化Prompt’——在提供的代码中没有看到对应实现。实际行为更像是通用的多供应商图片生成CLI，而不是一个具备丰富模板与意图理解的商业化助手。因此描述对能力范围有明显夸大，属于描述与行为不完全一致，且是实质性不匹配。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The script performs credential discovery across CLI args, environment variables, and another application's config, broadening access to secrets beyond the minimum needed. In an agent/skill context, this is more dangerous because users may invoke the skill without realizing it can harvest credentials from local state and use them automatically for external requests.

Content

Scanner excerpt · scripts/generate_image.py (reported line 43)May include surrounding context.

python
def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from provided arg, env var, or openclaw config.
    
    查找顺序:
      1. --api-key 参数 (跳过 sk-sp- 前缀的百炼 Key)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_image_v2.py (reported line 141)May include surrounding context.

python
suffix = enhancer["suffix_zh"] if has_chinese else enhancer["suffix_en"]
    # 避免重复追加
    if "8K" in prompt or "高清" in prompt or "UHD" in prompt:
        return prompt
    return prompt + suffix

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_image_v2.py (reported line 142)May include surrounding context.

python
suffix = enhancer["suffix_zh"] if has_chinese else enhancer["suffix_en"]
    # 避免重复追加
    if "8K" in prompt or "高清" in prompt or "UHD" in prompt:
        return prompt
    return prompt + suffix

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description and all user-facing instructions in this README are presented exclusively in Chinese, with no indication that other languages are supported or that Chinese is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents use of environment variables and external image-generation providers, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization transparency gap: a user or platform may not realize the skill can access secrets and make network requests, increasing the chance of unintended secret exposure or unreviewed outbound calls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description and the full markdown instructions are Chinese-only, and the file does not provide an English alternative, a user language selection mechanism, or a stated region-specific justification. This can violate language/locale policy where skills must not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README instructs users to configure third-party API keys for external image-generation services but does not warn that prompts, business-card fields, and related metadata may be transmitted to those providers. In this skill’s context, users may submit personal or commercial content, so the omission can lead to unintentional disclosure of sensitive data to external vendors and poor informed-consent practices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code file contains user-facing natural-language messages entirely in Chinese, including the docstring and all printed status/warning text. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes a commercial AI image generation assistant with templates, style dictionaries, intent recognition, and engine routing. This script additionally inspects credential material from environment variables and ~/.openclaw/openclaw.json, which is an operational diagnostics capability rather than an obvious part of the assistant's stated end-user purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script reads API credentials from ~/.openclaw/openclaw.json, which belongs to another application context. Cross-application credential reuse can violate least privilege and user expectations, and may cause this tool to silently access or transmit secrets the user did not intend to expose to it.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 201)May include surrounding context.

python
try:
        # Make API request
        response = requests.post(
            api_url,
            headers=headers,
            json=payload,

Tainted flow: 'task_url' from requests.post (line 262, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate_image.py (reported line 263)May include surrounding context.

python
# Query task status
                task_url = f"https://dashscope.aliyuncs.com/api/v1/tasks/{task_id}"
                task_response = requests.get(
                    task_url,
                    headers={"Authorization": f"Bearer {api_key}"},
                    timeout=30,

Tainted flow: 'image_url' from requests.post (line 238, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
91% confidence
Finding

The script downloads a URL returned by the remote image-generation API without validating the hostname, scheme, or content type. If the upstream service is compromised, misconfigured, or attacker-influenced, this can turn the client into an SSRF-like fetcher or cause downloads from unexpected domains, which is especially risky because SSL verification can also be disabled for this download path.

Content

Scanner excerpt · scripts/generate_image.py (reported line 318)May include surrounding context.

python
output_path.parent.mkdir(parents=True, exist_ok=True)
            
            print("Downloading image...")
            img_response = requests.get(image_url, timeout=30, verify=not args.no_verify_ssl)
            img_response.raise_for_status()

            # Save the image

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest describes a commercial AI image generation assistant with prompt structuring and multi-engine routing, but does not indicate any need to inspect local environment variables or read credential material from ~/.openclaw/openclaw.json. While network access is expected for calling image providers, local credential discovery from unrelated user config is an additional capability beyond the stated assistant behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image_v2.py (reported line 204)May include surrounding context.

python
}

    try:
        resp = requests.post(
            "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation",
            headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"},
            json=payload_26, timeout=120,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image_v2.py (reported line 239)May include surrounding context.

python
}

    try:
        resp = requests.post(
            "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation",
            headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"},
            json=payload_26, timeout=120,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image_v2.py (reported line 204)May include surrounding context.

python
}

    try:
        resp = requests.post(
            "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation",
            headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"},
            json=payload_26, timeout=120,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image_v2.py (reported line 239)May include surrounding context.

python
}

    try:
        resp = requests.post(
            "https://dashscope.aliyuncs.com/api/v1/services/aigc/text2image/image-synthesis",
            headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}", "X-DashScope-Async": "enable"},
            json=payload_25, timeout=30,

Tainted flow: 'task_id' from requests.post (line 247, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate_image_v2.py (reported line 254)May include surrounding context.

python
print(f"  任务已提交: {task_id}")
        for i in range(40):
            time.sleep(3)
            r = requests.get(
                f"https://dashscope.aliyuncs.com/api/v1/tasks/{task_id}",
                headers={"Authorization": f"Bearer {api_key}"}, timeout=15,
            )

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image_v2.py (reported line 332)May include surrounding context.

python
print(f"  组图模式: {sequential} (max={max_images})")

    try:
        resp = requests.post(api_url, headers=headers, json=payload, timeout=180)

        if resp.status_code != 200:
            try:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

User-facing natural-language strings throughout the script, including description, help text, status output, and error messages, are hard-coded in Chinese with no option to select another language. This imposes a specific language/locale on all users rather than offering a choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This is a duplicate report of the same DashScope transmission site. The security concern remains that prompts and authorization data are sent to an external provider as part of normal operation, which can expose sensitive input if users are unaware of the remote call.

Content

Scanner excerpt · scripts/generate_image_v3.py (reported line 361)May include surrounding context.

python
}

    try:
        resp = requests.post(
            "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation",
            headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"},
            json=payload_26, timeout=120,

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This is a duplicate report of the same DashScope transmission site. The security concern remains that prompts and authorization data are sent to an external provider as part of normal operation, which can expose sensitive input if users are unaware of the remote call.

Content

Scanner excerpt · scripts/generate_image_v3.py (reported line 361)May include surrounding context.

python
}

    try:
        resp = requests.post(
            "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation",
            headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"},
            json=payload_26, timeout=120,