Skill Trust Decision

nano-banana-pro

OpenClaw workspace configuration with extensive hardcoded credentials and sensitive tokens exposed in plaintext across multiple files

Install decision first Source: Manual upload Scanned: Apr 4, 2026
Files 614
Artifacts 256
Violations 0
Findings 9
Most direct threat evidence
Critical Credential Theft
Hardcoded DASHSCOPE_API_KEY in _meta.json

API key 'sk-1f3847debc3e492e81f64115b20c6d82' hardcoded in _meta.json env section. This is a production credential exposure.

_meta.json:13

Why this conclusion was reached

2/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block
Hidden execution and egress

9 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 4 attack-chain steps and 8 severe findings.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

Attack Chain

01
Attacker discovers workspace repository or file leak

reconnaissance · N/A

02
Attacker extracts hardcoded API keys from _meta.json

Credential Access · _meta.json:13

03
Attacker uses extracted keys for unauthorized API access

Impact · N/A

04
Attacker compromises Feishu integration using exposed credentials

Impact · _meta.json:175

What drove the risk score up

Multiple production API keys hardcoded in plaintext +35

_meta.json, scripts/vectorize-and-store.py, search_knowledge.py, and backup files contain plaintext API keys for DashScope, Xiaomi, GLM

Feishu integration credentials exposed +20

appId, appSecret, verificationToken exposed in _meta.json

Gateway authentication token exposed +10

Gateway auth token '82a4d393848d5ad8cd3d9831b10ef1292074a58b400cb2ff' in _meta.json

API keys in backup/prose files +7

2026-3-10afu的js备份.txt contains hardcoded keys

Most important evidence

Critical Credential Theft

Hardcoded DASHSCOPE_API_KEY in _meta.json

API key 'sk-1f3847debc3e492e81f64115b20c6d82' hardcoded in _meta.json env section. This is a production credential exposure.

_meta.json:13
Move to environment variable. Never commit API keys to configuration files.
Critical Credential Theft

Hardcoded Xiaomi API key in _meta.json

API key 'sk-JPxFOBXYC8ieSrEN9OgCjYJ4V06XqkykhVtma4gw8ONxNuwE' hardcoded in xiaomi provider config.

_meta.json:66
Rotate immediately. Use environment variable.
Critical Credential Theft

Hardcoded GLM API key in _meta.json

API key 'd846dcff984f435ebeb2e67d81138dd9.r4hj85ftxqpD1Nrj' hardcoded.

_meta.json:80
Rotate immediately.
Critical Credential Theft

Hardcoded API key in scripts/vectorize-and-store.py

DASHSCOPE_API_KEY directly assigned in Python file.

scripts/vectorize-and-store.py:19
Use os.getenv('DASHSCOPE_API_KEY') instead.
Critical Credential Theft

Hardcoded API key in search_knowledge.py

API key directly in source file.

search_knowledge.py:22
Use environment variable.
Critical Credential Theft

Feishu app credentials exposed

appId, appSecret, and verificationToken for Feishu integration exposed in _meta.json.

_meta.json:175
Rotate Feishu credentials immediately.
High Credential Theft

Gateway authentication token exposed

Gateway auth token hardcoded in configuration.

_meta.json:193
Rotate gateway token.
High Credential Theft

API keys in backup file

Backup file contains hardcoded API keys.

2026-3-10afu的js备份.txt:9
Delete backup file containing credentials.

1 more findings are not expanded here

Declared capability vs actual capability

Filesystem Pass
Declared NONE
Inferred READ
SKILL.md describes script execution only
Network Pass
Declared READ
Inferred READ
Script makes API calls to Gemini image generation API
Environment Pass
Declared READ
Inferred READ
GEMINI_API_KEY environment variable check in SKILL.md

Suspicious artifacts and egress

Critical API Key
sk-1f3847debc3e492e81f64115b20c6d82

2026-3-10afu的js备份.txt:9

Critical API Key
sk-JPxFOBXYC8ieSrEN9OgCjYJ4V06XqkykhVtma4gw8ONxNuwE

2026-3-10afu的js备份.txt:55

Critical Dangerous Command
rm -rf /

skills/skill-vetting/references/patterns.md:20

High IP Address
120.0.0.0

expert-review-2026-03-09-browser-stealth-explained.md:47

High API Key
accessToken = "your_access_token"

feishu-calendar-integration.md:20

High API Key
api_key='sk-1f3847debc3e492e81f64115b20c6d82'

memory/2026-03-14.md:55

High API Key
API_KEY = "sk-1f3847debc3e492e81f64115b20c6d82"

scripts/vectorize-and-store.py:19

High API Key
API_KEY = 'sk-1f3847debc3e492e81f64115b20c6d82'

search_knowledge.py:22

High API Key
apiKey = "sk-1f3847debc3e492e81f64115b20c6d82"

skills/tts-automation/SKILL.md:96

Medium External URL
http://127.0.0.1:11434/v1

2026-3-10afu的js备份.txt:31

Medium External URL
https://api.xiaomimimo.com/anthropic

2026-3-10afu的js备份.txt:54

Medium External URL
https://open.bigmodel.cn/api/paas/v4

2026-3-10afu的js备份.txt:77

Dependencies and supply chain

There are no structured dependency warnings.

File composition

614 files · 140626 lines
Markdown 320 files · 79463 linesHTML 86 files · 34309 linesPython 73 files · 9689 linesJSON 38 files · 7212 linesText 73 files · 6690 linesJavaScript 16 files · 2313 lines
Files of concern · 7
agents/config.json JSON · 50 lines
skills/feishu-multi-agent-manager/package-lock.json JSON · 5324 lines
https://opencollective.com/babel · https://opencollective.com/eslint · https://opencollective.com/typescript-eslint · https://opencollective.com/browserslist · https://tidelift.com/funding/github/npm/browserslist · https://tidelift.com/funding/github/npm/caniuse-lite · https://eslint.org/version-support · https://opencollective.com/fast-check · https://www.patreon.com/feross · https://feross.org/support · [email protected]
memory/2026-03-08.md Markdown · 2415 lines
https://feishu.cn/docx/U9PIdZ5SooMa9TxTXabcv8TGnhb · https://feishu.cn/docx/AafbdknDaoglGpx3RAvcluyUnAM · https://feishu.cn/docx/Mc5td0zf5oKY4bxHNRMc4E6Inyc · https://feishu.cn/docx/B52uds8WLo02Swx5SGdcfClxnSh · https://feishu.cn/docx/BiwWdBiUyoV8XzxrzL6cItginTh · https://feishu.cn/docx/NyVtdMB1NomyooxHnoTcHKw5nRh · https://feishu.cn/docx/NyVtdMB1NomyooxHnoTcHKw5nRh(V1.2,31 · https://feishu.cn/docx/AaC9dkA8QoAmAKx3hQqcLqFznRf(分块写入 · https://feishu.cn/docx/I49YdfIQ8omBxBxtW3Mc3PAWnBc · https://feishu.cn/docx/NTWmdppaWoxzpwxIjpQcZPiFn9f · https://feishu.cn/docx/CEoRdPxG2oiwlzxg9i9c9M1sngf · https://feishu.cn/docx/TNIVdysYHoJ0tex1wTMc5yE8nAc · https://feishu.cn/docx/AaC9dkA8QoAmAKx3hQqcLqFznRf(108 · https://feishu.cn/docx/AaC9dkA8QoAmAKx3hQqcLqFznRf(V1.1,追加 · https://feishu.cn/docx/AaC9dkA8QoAmAKx3hQqcLqFznRf(V1.2,追加 · https://weda.tencentcloudapi.com · https://tcb.cloud.tencent.com/dev · https://cloud.tencent.com/document/product/876 · https://servicewechat.com/wxa-dev-logic/download_redirect?type=win32_x64&from=mpwiki&download_version=2012510280&version_type=1 · https://mp.weixin.qq.com/ · https://mermaid.live/edit#pako:Sy9KLMhQ8AniUgACx+iMktwc3dSKgtSiEt2i1LLM1HKFMCM9g1gFXV07BafoZw1zn+...
memory/triple-line-sync-log.md Markdown · 1963 lines
https://scns3ak4jrto.feishu.cn/docx/GeG0dywMxof8dLx1tcUckSFNndh##
worklog.txt Text · 1784 lines
https://mermaid.live/edit#pako:Sy9KLMhQ8AniUgACx+iMktwc3dSKgtSiEt2i1LLM1HKFMCM9g1gFXV07BafoZw1zn+/e8nT9nqez9ynkZual5CYWxEK0glU4A1Xsfr578rOupU8ndj3tmv+ieS9E3iW6oCg/KzW5RLe4NDc3sagSaHxBflEJkvGu0U92dD7d2PRs3rZn8 · https://scns3ak4jrto.feishu.cn/docx/KaBld2wpyoKL5yxLYuPcSCPOne4 · https://scns3ak4jrto.feishu.cn/docx/GQsbd042WoNdbHxaBbscO9D8nW6 · https://scns3ak4jrto.feishu.cn/base/bascnZQh8v5K6d2m4E7p9Lr1tYw · https://feishu.cn/docx/NQCBdAXzeoBoi0xLJX7cPBHDnm3 · https://feishu.cn/docx/CvCBd5N2co0n02xXPZscQPEsnOL
memory/2026-03-07.md Markdown · 1386 lines
https://scns3ak4jrto.feishu.cn/docx/GeG0dywMxof8dLx1tcUckSFNndh
backups/html-expert-review-v2.0/SKILL.md Markdown · 1046 lines
https://mermaid.live/edit#pako:... · https://mermaid.live/edit · https://mermaid.live/edit#pako: · https://mermaid.live/edit#pako:$base64 · http://www.w3.org/2000/svg
Other files · index.js · people.txt · bom-物料管理规则 - 专家评点-v9-pyramid.html · SKILL.md · expert-review-2026-03-08-voice-redpacket-journey.html

Security positives

The nano-banana-pro SKILL.md describes legitimate image generation functionality
Skill-vetting skill contains good security practices and documentation
No malicious code execution patterns (eval/exec) detected in main skill files
No base64-encoded malicious payloads detected
No network exfiltration detected - all network calls are to documented APIs