wangyi-banana2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:28 AM UTC
• Version: 1.0.0

Overview

This media-generation skill appears to do what it claims, but it unsafely asks users to share API keys in chat and handles credentials and saved outputs in ways users should review before installing.

Before installing, do not paste an API key into chat. Use a restricted environment variable or local OpenClaw config instead, rotate any key already shared conversationally, avoid confidential prompts or personal media unless you trust the WangYi Banana service, and keep outputs in the default temporary directory unless you intentionally choose another path.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wangyi-banana.py:153
• Finding: API Key Exposure Through Command-Line Arguments and Insecure Setup Guidance<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wangyi-banana.py:153-177` **Additional Locations**: `scripts/wangyi-banana.py:637`, `install.md:46`, `references/api-key-setup.md:82-84` **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium ### Vulnerable Code ```python url = f"{DEFAULT_HOST}{endpoint_suffix}" headers = { "Authorization": f"Bearer {api_key}", } if not is_form_data: headers["Content-Type"] = "application/json" max_retries = 3 last_error: dict | None = None for retry in range(max_retries): try: if is_form_data: result = curl_post_form_data(url, payload, headers, timeout) else: if method == "POST": result = curl_post_json(url, payload, headers, timeout) else: # GET cmd = [ "curl", "-s", "-S", "--fail-with-body", "-X", "GET", url, "--max-time", str(timeout), ] for k, v in headers.items(): cmd += ["-H", f"{k}: {v}"] result = subprocess.run(cmd, capture_output=True, text=True) ``` The command-line API-key option is also declared as follows: ```python parser.add_argument("--api-key", "-k", help="API key (optional, resolved from config)") ``` The setup documentation additionally advises users that they may provide an API key directly in a conversation. ### Technical Analysis The bearer token is incorporated into the argument vector of each spawned `curl` process through the `Authorization` header. Depending on the operating system and execution environment, command arguments may be visible through process inspection interfaces, monitoring agents, diagnostic tooling, crash collection, or audit logs. A local actor with sufficient process-observation access could recover the complete API key while a request is active. The `--api-key` option creates a second exposure path because command-line invocations m ...[truncated 1860 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove guidance that asks users to send API keys through chat. Direct users to a trusted secret-management interface or a permission-restricted environment configuration instead. 2. Deprecate and remove the `--api-key` command-line option. If temporary credential input is necessary, read it from a protected file descriptor, secret store, or non-echoing interactive prompt. 3. Avoid placing authorization headers in child-process arguments. Prefer an in-process HTTPS client so credentials remain within process memory. 4. If `curl` must be retained, provide sensitive configuration through standard input or a temporary configuration file with mode `0600`, and securely delete that file immediately after use. 5. Ensure temporary files are created in a private directory with restrictive permissions and are never included in diagnostics. 6. Redact authorization headers and API-key values from application logs, subprocess errors, telemetry, and exception reports. 7. Restrict the API key to only the endpoints and spending limits required for image and video generation. 8. Add credential rotation and revocation instructions for users who previously supplied keys through chat or command-line arguments. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (31)

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Telling users to paste an API key directly into chat creates a clear secret-handling vulnerability. In the context of an agent skill, chat content may be retained, inspected, replayed, or accessible to plugins and operators, turning a convenience step into a credential exposure path.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The instruction to paste the API key into the assistant directly is a classic secret-disclosure anti-pattern. Because this skill already relies on multiple remote services, exposing the key through chat increases the chance of account abuse, billing fraud, and downstream compromise if the credential is reused elsewhere.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The guide explicitly tells users they can provide their API key directly in chat, which encourages secret disclosure through a conversational channel that may be logged, retained, displayed to other components, or exposed in transcripts. In the context of an agent skill, this is especially risky because users may assume the chat is a safe secret-input mechanism when it often is not.

Credential Access

High

• Category: Privilege Escalation

Content

"error": "NO_API_KEY",
        "message": "No API key configured",
        "steps": [
            "1. Get API key from your WangYi Banana service provider",
            "2. Send the key in chat or add to ~/.openclaw/openclaw.json: skills.entries.wangyi-banana.apiKey",
        ],
    }

• Confidence: 95% confidence
• Finding: The credential-handling flow prompts the user toward sharing an API key in chat, which is an unsafe credential acquisition pattern. Even though the code does not exfiltrate secrets programmatically, the skill design solicits sensitive data through a potentially monitored interface.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The script explicitly instructs users to send the API key in chat, encouraging disclosure of sensitive credentials through natural-language channels that may be logged, retained, or exposed to other tools. In an agent ecosystem, this materially increases the chance of credential leakage beyond the local machine.

Credential Access

High

• Category: Privilege Escalation

Content

"status": "no_key",
            "message": "No API key configured",
            "steps": [
                "1. Get API key from your WangYi Banana service provider",
                "2. Send the key in chat or add to ~/.openclaw/openclaw.json: skills.entries.wangyi-banana.apiKey",
            ],
        }, ensure_ascii=False))

• Confidence: 95% confidence
• Finding: This health-check messaging participates in insecure credential collection by telling the user to provide a secret via chat. In context, a skill that asks for API keys conversationally is more dangerous because users may trust the tool and unknowingly expose reusable credentials.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The health-check path repeats the instruction to send API keys in chat, reinforcing insecure behavior at the exact point where users are troubleshooting credentials. Repetition makes accidental secret disclosure more likely, especially when users follow tool guidance verbatim.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares shell, file read/write, and environment-variable-dependent behavior but does not scope or constrain tool permissions in metadata. This increases the chance that an agent can execute broader-than-necessary actions, making misuse, prompt-injection chaining, or accidental access to sensitive files and secrets more likely.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: Forcing all responses to be in Chinese without user opt-in can mislead or exclude users and may cause them to miss important safety, billing, or data-transfer disclosures. In this skill, that risk is amplified because users need to understand API-key usage, external network transmission, and media handling details clearly.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill discloses backup hosts only deep in the file and does not clearly warn users that prompts, images, videos, and API-key-authenticated requests may be sent to third-party endpoints, including a plain-HTTP host. This creates material confidentiality and integrity risk because sensitive user content and credentials could be transmitted to unexpected infrastructure without informed consent, and HTTP permits interception or modification in transit.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill asks users to use API keys with named third-party endpoints and generate images/videos, but does not clearly warn that prompts, images, and video inputs may be transmitted to external services. This can lead users to disclose sensitive text or media without informed consent, especially since the service appears to be a reseller or unofficial provider rather than a clearly identified first-party platform.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documentation explicitly instructs users to send their API key through chat to another agent for configuration. This is dangerous because chat channels, agent memory, logs, telemetry, or prompt history may expose the credential to unintended parties or systems, enabling unauthorized use of the paid third-party API.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The file forces a specific language for all setup instructions, and there is no indication that the skill is region-specific or that users can opt into another language. Under the stated policy, a fixed language without user choice or documented justification is a natural-language policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown file presents all user-facing instructions in a single language and does not indicate that the skill is intentionally limited to Chinese-speaking users or a region-specific context. Under the policy rule, forcing a specific language without user opt-in or justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The file presents all instructions in Chinese and later mandates specific Chinese response wording, which can amount to forcing a language without user opt-in. The policy allows locale constraints only when clearly documented and justified or when users are offered a language choice.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guidance directs the skill to persist all generated outputs in a fixed local directory, but it does not disclose this storage behavior to users or define retention and cleanup expectations. This can create unintended data-at-rest exposure for user-provided or generated media, especially if outputs are sensitive and remain accessible on the host after task completion.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The line explicitly says the response should include `花了 ¥X.XX`, which enforces Chinese output. This is a natural-language policy concern because it mandates a specific language rather than letting the user choose or documenting a justified locale restriction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to upload reference images and character videos to generate content, but it does not disclose that these files will be transmitted to an external third-party video generation service. This creates a real privacy and data handling risk because users may submit sensitive or copyrighted media without informed consent about where the data is sent or processed.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--max-time", str(timeout), "-d", f"@{tmp_path}"]
        for k, v in headers.items():
            cmd += ["-H", f"{k}: {v}"]
        return subprocess.run(cmd, capture_output=True, text=True)
    finally:
        os.unlink(tmp_path)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--max-time", str(timeout), "-d", f"@{tmp_path}"]
        for k, v in headers.items():
            cmd += ["-H", f"{k}: {v}"]
        return subprocess.run(cmd, capture_output=True, text=True)
    finally:
        os.unlink(tmp_path)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]
                    for k, v in headers.items():
                        cmd += ["-H", f"{k}: {v}"]
                    result = subprocess.run(cmd, capture_output=True, text=True)

            if result.returncode == 0:
                try:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill automatically downloads generated media and writes it to local storage without a clear user-facing disclosure or confirmation. In an agent setting, silent file creation increases the risk of unexpected disk writes, privacy issues, and abuse of arbitrary output paths supplied by the caller.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

output_path = args.output or f"/tmp/openclaw/wangyi-output/image_{int(time.time())}.png"
        Path(output_path).parent.mkdir(parents=True, exist_ok=True)
        cmd = ["curl", "-s", "-S", "-L", "-o", output_path, "--max-time", "300", image_url]
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"Download failed: {result.stderr}", file=sys.stderr)
            sys.exit(1)

• Confidence: 77% confidence
• Finding: The code retrieves an image URL from model output and downloads it directly to disk without trust checks on the URL or destination path. Because the source URL can be indirectly influenced by external services, this creates a file-write and untrusted-download risk in an agent skill that may run unattended.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

output_path = args.output or f"/tmp/openclaw/wangyi-output/image_{int(time.time())}.png"
    Path(output_path).parent.mkdir(parents=True, exist_ok=True)
    cmd = ["curl", "-s", "-S", "-L", "-o", output_path, "--max-time", "300", image_url]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Download failed: {result.stderr}", file=sys.stderr)
        sys.exit(1)

• Confidence: 77% confidence
• Finding: The script downloads a URL returned by a remote API directly to a user-chosen local path with curl, without validating the scheme, host, content type, or destination safety. In a skill context, this can overwrite arbitrary files writable by the current user or fetch unexpected content from attacker-controlled URLs if the upstream service is compromised or abused.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Video generation results are saved to disk automatically, which can surprise users and create persistent local artifacts without warning. This is especially relevant for agent skills because they may be triggered indirectly and write large files to locations chosen by inputs.

Static analysis

No suspicious patterns detected.