Security audit

Seedream5

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently generates or edits images through Volcengine, but users should treat prompts, input images, filenames, and API keys carefully.

Install only if you are comfortable sending prompts, reference images, and image URLs to Volcengine. Prefer the OpenClaw credential UI or protected environment variables over passing --api-key on the command line, avoid sensitive/private images unless appropriate, and choose output filenames inside a safe working folder because existing writable files can be overwritten.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_image.py:181
Finding: Unrestricted Output Path Allows Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/generate_image.py:139
Finding: API Key Can Be Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/generate_image.py:3
Finding: Runtime Dependencies Are Not Reproducibly Pinned
Content: View full analysis
=3.10" # dependencies = [ # "requests>=2.28.0", # "pillow>=10.0.0", # ] # /// ``` ### Technical Analysis The inline dependency metadata specifies only minimum versions for `requests` and `pillow`. No reviewed exact versions, lockfile, or artifact hashes are present in the audited project. Consequently, `uv run` may resolve different later-compatible package versions across executions or environments. This makes installations non-reproducible and allows newly published, compromised, or incompatible releases satisfying the version ranges to enter the runtime without a project-level review. The package names refer to the expected libraries and no evidence of dependency confusion or typosquatting was found. The risk arises from broad version constraints and the absence of integrity locking rather than from a currently identified malicious dependency. ### Attack Path 1. A user invokes the Skill through `uv run`. 2. The environment resolves dependencies according to the open-ended minimum-version constraints. 3. A later package release satisfying the constraint is selected. 4. If that release is compromised or contains exploitable behavior, its installation or import executes within the Skill process. 5. The affected dependency receives the same effective local permissions as the Skill and may process API responses, local images, and network traffic used by the script. ### Impact Assessment A compromised dependency would execute with the permissions of the user running the Skill. It could potentially access files available to that account, inspect process environment variables including the API key, alter generated output, or initiate network requests. No currently malicious package or active compromise was establish ...[truncated 112 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 70)May include surrounding context.
python
def get_api_key(provided_key: str | None) -> str | None: """Get API key from argument first, then environment.""" if provided_key: return provided_key return os.environ.get("VOLC_API_KEY") or os.environ.get("ARK_API_KEY")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents execution of a Python script that uses environment variables, writes output files, and calls an external API, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can cause the host agent to grant broader capabilities than users expect, especially for network access and file creation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill supports prompts, local images, multiple reference images, web search, and image URLs, all of which may be transmitted to an external image-generation provider, but the documentation does not warn users about that data flow. Users may unknowingly send sensitive text, private images, or internal URLs to a third-party service, creating confidentiality and privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation recommends storing a long-lived API key in persistent configuration and environment variables but does not include credential-handling guidance. This increases the chance of accidental disclosure through checked-in config files, shared home directories, logs, screenshots, or overbroad file permissions, which could enable unauthorized use of the API key.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/generate_image.py (reported line 244)May include surrounding context.
python
body["tools"] = [{"type": "web_search"}] try: resp = requests.post( f"{API_BASE}/images/generations", headers={ "Content-Type": "application/json",

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file includes setup steps for placing a sensitive credential in environment variables, but it does not warn users that shell history, shared sessions, or process-environment exposure may affect secret safety. Under the markdown-specific warning rule, credential-handling guidance should disclose privacy or security implications when user data or system integrity could be affected.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.