Skills
Navigate
skills/meitu/meitu-skills/text-code-edit/Gen Agent Trust Hub

text-code-edit

Fail

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: HIGHCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill interpolates user-controlled strings directly into shell commands for the meitu CLI. An attacker could craft a malicious modification description or URL containing shell metacharacters to execute arbitrary code on the host system.
  • Evidence: The skill uses shell templates such as meitu text-code-edit --prompt "{modification_description}" --source_code_url "{code_url}" where the variables are filled by potentially untrusted user input.
  • [CREDENTIALS_UNSAFE]: The skill is configured to read sensitive local files to extract authentication secrets.
  • Evidence: The skill explicitly requests permissions to read ~/.meitu/credentials.json and ~/.meitu/tool-registry.json to source MEITU_OPENAPI_ACCESS_KEY and MEITU_OPENAPI_SECRET_KEY.
  • [EXTERNAL_DOWNLOADS]: The skill downloads modified source code from an external vendor-controlled service to the local file system.
  • Evidence: Use of the --download-dir flag in the execution step to save output to ./output/ or ~/.openclaw/workspace/visual/.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 15, 2026, 06:03 AM
Security Audit — agent-trust-hub — text-code-edit