The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines a shell execution pattern for the meitu CLI that directly interpolates the prompt parameter: meitu ... --prompt "<desc>". This parameter is derived from user input and lacks explicit sanitization. If the execution environment does not apply strict shell escaping, a malicious user could provide a prompt containing shell metacharacters (e.g., semicolons, backticks, or command substitutions) to execute arbitrary commands on the host system.
[CREDENTIALS_UNSAFE]: The skill is configured to read sensitive credential files from the host system, specifically ~/.meitu/credentials.json. It extracts MEITU_OPENAPI_ACCESS_KEY and MEITU_OPENAPI_SECRET_KEY from this file. While these are vendor-specific credentials for the Meitu service, providing the agent with direct read access to credential stores increases the risk of accidental exposure or targeted theft via command injection.
[EXTERNAL_DOWNLOADS]: The skill processes an image_list containing URLs for reference images. These external URLs are passed as arguments to the meitu tool, which fetches remote content during the task execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection and parameter manipulation because it processes untrusted user data without sufficient defensive boundaries.
Ingestion points: Untrusted data enters the skill context through the image_list (URLs) and the prompt string (SKILL.md).
Boundary markers: The skill uses standard double quotes in the shell command template, which are insufficient to prevent injection in most shell environments.
Capability inventory: The skill possesses exec permissions for the meitu binary and file_write permissions to the ./output/ and ~/.openclaw/workspace/visual/ directories.
Sanitization: The instructions do not define any validation, escaping, or filtering for the user-provided prompt or image_list before they are processed by the tool.

image-portrait-generate