Skills
Navigate
skills/xdrshjr/jr-openclaw-skills/volcengine-image-gen/Gen Agent Trust Hub

volcengine-image-gen

Fail

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The .env file contains a hardcoded API key (0fe6efc8-43fb-49be-a358-bdadec962207) for the VOLCENGINE_IMAGE_API_KEY configuration. This credential is used by the generate_image function in scripts/generate.py to authenticate requests to the remote image generation service.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-provided descriptions and forward them to a remote image generation model, presenting a risk of indirect prompt injection.
  • Ingestion points: The prompt argument passed to scripts/generate.py via CLI or the generate_image function.
  • Boundary markers: None; the prompt is placed directly into the request payload without delimiters or instructions to the model to ignore embedded commands.
  • Capability inventory: The skill performs network POST requests using the requests library to an external API endpoint.
  • Sanitization: No escaping, filtering, or validation is performed on the user prompt before it is included in the JSON payload sent to the Volcengine Ark API.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 7, 2026, 05:12 PM