SkillSpector · openclaw-media-gen

independent scanner by NVIDIA · skill by baofeng-tech · how it works ↗

FAILmax severity: CRITICALrisk score: 100

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.; Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.; Without declared permissions the skill's intent is opaque and cannot be validated.; +2 more

scanned 2026-08-23

Findings (14)

CRITICALData Flowconfidence: 0.9

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

scripts/media_gen_client.py

CRITICALData Flowconfidence: 0.9

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

scripts/media_gen_client.py

MEDIUMData Flowconfidence: 0.65

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

scripts/media_gen_client.py

MEDIUMData Flowconfidence: 0.65

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

scripts/media_gen_client.py

MEDIUMData Flowconfidence: 0.65

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

scripts/media_gen_client.py

MEDIUMMCP Least Privilegeconfidence: 0.7

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

MEDIUMData Exfiltrationconfidence: 0.5