Nvidia Sdxl

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:11 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent NVIDIA image generator, but it ships a hardcoded API credential and sends prompts to NVIDIA under that embedded key.

Review before installing. The skill does what it claims at a high level, but the bundled NVIDIA credential should be considered exposed and should be removed, revoked, and replaced with a user-provided secret. Do not send sensitive, confidential, or proprietary prompts through this tool unless you are comfortable sharing them with the NVIDIA image-generation service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: index.py:9

Finding

Hard-Coded NVIDIA API Credential

Content

View full analysis

Vulnerability Details

File Location: index.py, line 9
Vulnerability Type: Hard-coded bearer credential
Risk Level: High

Vulnerable Code

python

API_KEY = "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"

The credential is subsequently placed in the authorization header:

python

headers = {
    "Authorization": f"Bearer {API_KEY}",
    "Accept": "application/json",
}

Technical Analysis

A reusable NVIDIA API bearer credential is embedded directly in distributable source code. Any party with read access to the Skill package, source repository, release artifact, backup, or log containing the file can recover and reuse the credential outside the Skill.

The application performs no additional authorization that binds the credential to a particular user or invocation. Consequently, possession of the source code is sufficient to impersonate the credential owner when accessing API operations permitted by the key.

The static pre-scan's decode-and-execute warning was not confirmed. The Base64 operation at index.py:48 only decodes image data returned by the NVIDIA API and writes it to a PNG file; the decoded content is not executed.

Attack Path

1. An attacker obtains read access to the Skill package or its source.
2. The attacker opens index.py and extracts the plaintext nvapi- credential from line 9.
3. The attacker constructs independent requests to supported NVIDIA API endpoints and supplies the stolen value as a bearer token.
4. NVIDIA attributes accepted requests to the credential owner's account until the key is revoked, expires, or is otherwise restricted.

Impact Assessment

Successful exploitation grants the attacker the NVIDIA API privileges assigned to the exposed key. Potential consequences include unauthorized model requests, consumption of account quotas, financial charges, rate-limit exhaustion, and service disruption for the le ...[truncated 207 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke the exposed credential immediately and issue a replacement, treating the current key as compromised.

2. Remove the credential from source code, version-control history, release archives, build artifacts, and documentation.

3. Load the replacement from a protected environment variable or platform secret manager, and fail safely when it is unavailable. For example:

   python

   API_KEY = os.environ.get("NVIDIA_API_KEY")
   if not API_KEY:
       raise RuntimeError("NVIDIA_API_KEY is not configured")
   

4. Configure the secret through OpenClaw's protected runtime configuration rather than shipping it with the Skill.

5. Restrict the replacement key to the minimum API permissions, endpoints, quotas, and lifetime required for image generation.

6. Review NVIDIA usage and billing logs for unauthorized activity associated with the exposed key.

7. Add automated secret scanning to source-control and release pipelines to prevent future credential publication.

8. Avoid exposing credentials in exceptions, diagnostic output, or request logging.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file hardcodes a live external API credential and uses it to invoke a third-party image-generation service. Embedded secrets can be extracted by anyone with access to the skill, enabling unauthorized use, billing abuse, and uncontrolled outbound data transmission under the developer's account.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The code performs an external HTTP POST containing user-controlled content to a remote service. In the context of an agent skill with no metadata or clear disclosure, this outbound transmission is security-relevant because it can exfiltrate user input and create an undeclared network dependency.

Content

Scanner excerpt · index.py (reported line 34)May include surrounding context.

python

payload["text_prompts"].append({"text": negative_prompt, "weight": -1})

    try:
        response = requests.post(INVOKE_URL, headers=headers, json=payload)
        response.raise_for_status()
        data = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

User-provided prompts and negative prompts are sent directly to an external service without any disclosure or consent mechanism in this skill. Prompts may contain sensitive or proprietary information, so silent transmission to a third party creates a privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill writes generated files directly into the user's workspace without warning, confirmation, or path-safety checks. Unexpected file creation can clutter trusted directories, consume disk space, and create opportunities for downstream misuse if other tools automatically process workspace contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly states that generated images are saved locally and that the tool returns an absolute local file path, but it does not warn users about the privacy and environment-disclosure implications of exposing workspace paths. While this is not direct code execution or data exfiltration, absolute paths can reveal filesystem structure, usernames, workspace layouts, or other operational details that may aid reconnaissance or unintentionally leak sensitive context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.