ClawHub
Back to skill

Security audit

Openclaw-X-article-cover-generator

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent image-cover generator, but users should know it sends titles and reference images to a third-party API and saves the returned image locally.

Install only if you are comfortable sending the cover title, subtitle, and any reference image to the BLT image-generation API. Do not use sensitive or proprietary reference images unless you are authorized to share them, and choose the output path carefully because the script can create directories and overwrite files at that path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tainted flow: 'api_key' from os.environ.get (line 101, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
def get_task(api_key: str, task_id: str):
    r = requests.get(
        f"{BASE_URL}/images/tasks/{task_id}",
        headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
        timeout=60,
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'url' from os.environ.get (line 140, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
def save_from_url(url: str, out: Path):
    data = requests.get(url, timeout=120).content
    out.parent.mkdir(parents=True, exist_ok=True)
    out.write_bytes(data)
Confidence
91% confidence
Finding
The script performs a secondary fetch to whatever URL is returned in the API response, with no host validation or scheme restrictions. This creates a trust boundary issue: a compromised or malicious upstream service could cause the client to retrieve attacker-controlled content, enabling unexpected outbound requests and unsafe content ingestion.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly depends on an external API and accepts user-provided titles and reference images or URLs, but the documentation does not warn users that this content will be transmitted off-platform. This creates a privacy and data-handling risk because users may unknowingly submit sensitive text, internal file paths, or proprietary images to a third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
from pathlib import Path
import requests

BASE_URL = "https://api.bltcy.ai/v1"
MODEL = "gemini-3.1-flash-image-preview"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
"Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
    }
    r = requests.post(url, headers=headers, json=payload, timeout=180)
    r.raise_for_status()
    return r.json()
Confidence
80% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Tainted flow: 'data' from requests.get (line 81, network input) → pathlib.Path.write_bytes (file write)

Medium
Category
Data Flow
Content
def save_from_url(url: str, out: Path):
    data = requests.get(url, timeout=120).content
    out.parent.mkdir(parents=True, exist_ok=True)
    out.write_bytes(data)


def main():
Confidence
88% confidence
Finding
The script downloads arbitrary content from a URL returned by the remote API and writes it directly to a user-chosen path without validating content type, size, or destination safety. If the remote service is compromised or returns an unexpected URL or payload, this can lead to untrusted file writes, disk exhaustion, or saving non-image data under a trusted filename.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
When a local file path is provided as the reference, the script base64-encodes the image and transmits it to an external image-generation API, but it does not clearly disclose this behavior to the user at runtime. In a skill context, this matters because local images may contain sensitive or proprietary content, and silent exfiltration to a third-party service can violate user expectations or policy.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The natural-language instructions for using the skill are presented exclusively in Chinese, including rules, dependency notes, and usage guidance. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the restriction is clearly documented and justified.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The script creates parent directories and writes downloaded image bytes to the path provided by --output. While it prints a success message after saving, there is no prior warning or explanatory comment/docstring disclosing that the command will create directories and overwrite or create files on disk.

Static analysis

No suspicious patterns detected.