Skill Trust Decision

nano-banana-pro

OpenClaw workspace configuration with extensive hardcoded credentials and sensitive tokens exposed in plaintext across multiple files

Install decision first Source: Manual upload Scanned: Apr 4, 2026
Files 614
Artifacts 256
Violations 0
Findings 9
Most direct threat evidence
Critical Credential Theft
Hardcoded DASHSCOPE_API_KEY in _meta.json

API key 'sk-1f3847debc3e492e81f64115b20c6d82' hardcoded in _meta.json env section. This is a production credential exposure.

_meta.json:13

Why this conclusion was reached

2/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block
Hidden execution and egress

9 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 4 attack-chain steps and 8 severe findings.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

Attack Chain

01
Attacker discovers workspace repository or file leak

reconnaissance · N/A

02
Attacker extracts hardcoded API keys from _meta.json

Credential Access · _meta.json:13

03
Attacker uses extracted keys for unauthorized API access

Impact · N/A

04
Attacker compromises Feishu integration using exposed credentials

Impact · _meta.json:175

What drove the risk score up

Multiple production API keys hardcoded in plaintext +35

_meta.json, scripts/vectorize-and-store.py, search_knowledge.py, and backup files contain plaintext API keys for DashScope, Xiaomi, GLM

Feishu integration credentials exposed +20

appId, appSecret, verificationToken exposed in _meta.json

Gateway authentication token exposed +10

Gateway auth token '82a4d393848d5ad8cd3d9831b10ef1292074a58b400cb2ff' in _meta.json

API keys in backup/prose files +7

2026-3-10afu的js备份.txt contains hardcoded keys

Most important evidence

Critical Credential Theft

Hardcoded DASHSCOPE_API_KEY in _meta.json

API key 'sk-1f3847debc3e492e81f64115b20c6d82' hardcoded in _meta.json env section. This is a production credential exposure.

_meta.json:13
Move to environment variable. Never commit API keys to configuration files.
Critical Credential Theft

Hardcoded Xiaomi API key in _meta.json

API key 'sk-JPxFOBXYC8ieSrEN9OgCjYJ4V06XqkykhVtma4gw8ONxNuwE' hardcoded in xiaomi provider config.

_meta.json:66
Rotate immediately. Use environment variable.
Critical Credential Theft

Hardcoded GLM API key in _meta.json

API key 'd846dcff984f435ebeb2e67d81138dd9.r4hj85ftxqpD1Nrj' hardcoded.

_meta.json:80
Rotate immediately.
Critical Credential Theft

Hardcoded API key in scripts/vectorize-and-store.py

DASHSCOPE_API_KEY directly assigned in Python file.

scripts/vectorize-and-store.py:19
Use os.getenv('DASHSCOPE_API_KEY') instead.
Critical Credential Theft

Hardcoded API key in search_knowledge.py

API key directly in source file.

search_knowledge.py:22
Use environment variable.
Critical Credential Theft

Feishu app credentials exposed

appId, appSecret, and verificationToken for Feishu integration exposed in _meta.json.

_meta.json:175
Rotate Feishu credentials immediately.
High Credential Theft

Gateway authentication token exposed

Gateway auth token hardcoded in configuration.

_meta.json:193
Rotate gateway token.
High Credential Theft

API keys in backup file

Backup file contains hardcoded API keys.

2026-3-10afu的js备份.txt:9
Delete backup file containing credentials.

1 more findings are not expanded here

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred READ
SKILL.md describes script execution only
Network Pass
Declared READ
→
Inferred READ
Script makes API calls to Gemini image generation API
Environment Pass
Declared READ
→
Inferred READ
GEMINI_API_KEY environment variable check in SKILL.md

Suspicious artifacts and egress

Critical API Key
sk-1f3847debc3e492e81f64115b20c6d82

2026-3-10afu的js备份.txt:9

Critical API Key
sk-JPxFOBXYC8ieSrEN9OgCjYJ4V06XqkykhVtma4gw8ONxNuwE

2026-3-10afu的js备份.txt:55

Critical Dangerous Command
rm -rf /

skills/skill-vetting/references/patterns.md:20

High IP Address
120.0.0.0

expert-review-2026-03-09-browser-stealth-explained.md:47

High API Key
accessToken = "your_access_token"

feishu-calendar-integration.md:20

High API Key
api_key='sk-1f3847debc3e492e81f64115b20c6d82'

memory/2026-03-14.md:55

High API Key
API_KEY = "sk-1f3847debc3e492e81f64115b20c6d82"

scripts/vectorize-and-store.py:19

High API Key
API_KEY = 'sk-1f3847debc3e492e81f64115b20c6d82'

search_knowledge.py:22

High API Key
apiKey = "sk-1f3847debc3e492e81f64115b20c6d82"

skills/tts-automation/SKILL.md:96

Medium External URL
http://127.0.0.1:11434/v1

2026-3-10afu的js备份.txt:31

Medium External URL
https://api.xiaomimimo.com/anthropic

2026-3-10afu的js备份.txt:54

Medium External URL
https://open.bigmodel.cn/api/paas/v4

2026-3-10afu的js备份.txt:77

Dependencies and supply chain

There are no structured dependency warnings.

File composition

614 files · 140626 lines
Markdown 320 files · 79463 linesHTML 86 files · 34309 linesPython 73 files · 9689 linesJSON 38 files · 7212 linesText 73 files · 6690 linesJavaScript 16 files · 2313 lines
Files of concern · 7
agents/config.json JSON · 50 lines
skills/feishu-multi-agent-manager/package-lock.json JSON · 5324 lines
https://opencollective.com/babel · https://opencollective.com/eslint · https://opencollective.com/typescript-eslint · https://opencollective.com/browserslist · https://tidelift.com/funding/github/npm/browserslist · https://tidelift.com/funding/github/npm/caniuse-lite · https://eslint.org/version-support · https://opencollective.com/fast-check · https://www.patreon.com/feross · https://feross.org/support · [email protected]
memory/2026-03-08.md Markdown · 2415 lines
https://feishu.cn/docx/U9PIdZ5SooMa9TxTXabcv8TGnhb · https://feishu.cn/docx/AafbdknDaoglGpx3RAvcluyUnAM · https://feishu.cn/docx/Mc5td0zf5oKY4bxHNRMc4E6Inyc · https://feishu.cn/docx/B52uds8WLo02Swx5SGdcfClxnSh · https://feishu.cn/docx/BiwWdBiUyoV8XzxrzL6cItginTh · https://feishu.cn/docx/NyVtdMB1NomyooxHnoTcHKw5nRh · https://feishu.cn/docx/NyVtdMB1NomyooxHnoTcHKw5nRh(V1.2,31 · https://feishu.cn/docx/AaC9dkA8QoAmAKx3hQqcLqFznRf(分块写入 · https://feishu.cn/docx/I49YdfIQ8omBxBxtW3Mc3PAWnBc · https://feishu.cn/docx/NTWmdppaWoxzpwxIjpQcZPiFn9f · https://feishu.cn/docx/CEoRdPxG2oiwlzxg9i9c9M1sngf · https://feishu.cn/docx/TNIVdysYHoJ0tex1wTMc5yE8nAc · https://feishu.cn/docx/AaC9dkA8QoAmAKx3hQqcLqFznRf(108 · https://feishu.cn/docx/AaC9dkA8QoAmAKx3hQqcLqFznRf(V1.1,追加 · https://feishu.cn/docx/AaC9dkA8QoAmAKx3hQqcLqFznRf(V1.2,追加 · https://weda.tencentcloudapi.com · https://tcb.cloud.tencent.com/dev · https://cloud.tencent.com/document/product/876 · https://servicewechat.com/wxa-dev-logic/download_redirect?type=win32_x64&from=mpwiki&download_version=2012510280&version_type=1 · https://mp.weixin.qq.com/ · https://mermaid.live/edit#pako:Sy9KLMhQ8AniUgACx+iMktwc3dSKgtSiEt2i1LLM1HKFMCM9g1gFXV07BafoZw1zn+...
memory/triple-line-sync-log.md Markdown · 1963 lines
https://scns3ak4jrto.feishu.cn/docx/GeG0dywMxof8dLx1tcUckSFNndh##
worklog.txt Text · 1784 lines
https://mermaid.live/edit#pako:Sy9KLMhQ8AniUgACx+iMktwc3dSKgtSiEt2i1LLM1HKFMCM9g1gFXV07BafoZw1zn+/e8nT9nqez9ynkZual5CYWxEK0glU4A1Xsfr578rOupU8ndj3tmv+ieS9E3iW6oCg/KzW5RLe4NDc3sagSaHxBflEJkvGu0U92dD7d2PRs3rZn8 · https://scns3ak4jrto.feishu.cn/docx/KaBld2wpyoKL5yxLYuPcSCPOne4 · https://scns3ak4jrto.feishu.cn/docx/GQsbd042WoNdbHxaBbscO9D8nW6 · https://scns3ak4jrto.feishu.cn/base/bascnZQh8v5K6d2m4E7p9Lr1tYw · https://feishu.cn/docx/NQCBdAXzeoBoi0xLJX7cPBHDnm3 · https://feishu.cn/docx/CvCBd5N2co0n02xXPZscQPEsnOL
memory/2026-03-07.md Markdown · 1386 lines
https://scns3ak4jrto.feishu.cn/docx/GeG0dywMxof8dLx1tcUckSFNndh
backups/html-expert-review-v2.0/SKILL.md Markdown · 1046 lines
https://mermaid.live/edit#pako:... · https://mermaid.live/edit · https://mermaid.live/edit#pako: · https://mermaid.live/edit#pako:$base64 · http://www.w3.org/2000/svg
Other files · index.js · people.txt · bom-物料管理规则 - 专家评点-v9-pyramid.html · SKILL.md · expert-review-2026-03-08-voice-redpacket-journey.html

Security positives

The nano-banana-pro SKILL.md describes legitimate image generation functionality
Skill-vetting skill contains good security practices and documentation
No malicious code execution patterns (eval/exec) detected in main skill files
No base64-encoded malicious payloads detected
No network exfiltration detected - all network calls are to documented APIs