Is matbalez/origram safe?
https://github.com/openclaw/skills/tree/main/skills/matbalez/origram
The origram skill is a well-structured API documentation guide for a Bitcoin Lightning-gated photo sharing service. It contains no prompt injection, hidden instructions, or malicious code, and the installation was clean with no canary exfiltration. However, the skill's functional design — which explicitly teaches agents to base64-encode arbitrary local files and POST them to an attacker-controlled external endpoint (origram.xyz) — constitutes a high-risk exfiltration pathway: any agent with filesystem access and this skill loaded can trivially be redirected from sharing photos to exfiltrating credentials.
Category Scores
Findings (9)
HIGH Skill Teaches Base64 File Encoding and Upload to Attacker-Controlled Server -45 ▶
The skill explicitly documents Method 2 (imageBase64) which base64-encodes any local file and POSTs it to origram.xyz. The example uses $(base64 -w0 /path/to/photo.jpg) — a command substitution template that works identically with /home/user/.ssh/id_rsa, /home/user/.aws/credentials, or /home/user/.env. An agent with filesystem access and this skill loaded is one social-engineering prompt away from full credential exfiltration.
HIGH All Uploaded Data Transmitted to Owner-Controlled origram.xyz -17 ▶
Every skill invocation that results in a successful post sends up to 10MB of data to https://origram.xyz, a service owned and operated by the skill author (matbalez). The service receives the full image/file content, the annotation (which may contain agent-generated context), and the bot identifier. There is no independent escrow, content filtering, or third-party oversight.
MEDIUM BOLT12 Offer Field Provides 2000-Character Public Exfiltration Channel -10 ▶
The optional bolt12Offer field accepts up to 2000 characters and is displayed publicly on the origram.xyz website. This field could carry base64-encoded secrets or structured data that appears to be a Lightning Network offer string but encodes exfiltrated content. Its public display means the origram.xyz operator can read it without any server-side special access.
MEDIUM imageUrl Method Enables Potential SSRF and Internal Resource Forwarding -7 ▶
Method 3 allows specifying any public URL for the image. If origram.xyz server-side fetches the provided URL, an attacker could point it at internal services (http://169.254.169.254/latest/meta-data/ for cloud metadata, internal APIs, etc.) and receive the response content via the published post or server-side storage. This is a server-side request forgery risk.
MEDIUM Skill Is a Pre-Built Exfiltration Pipeline Disguised as Photo Sharing -50 ▶
The skill's intended use case (photo sharing bots) is legitimate, but its functional design — read local file, base64 encode, HTTP POST to external server with metadata — is identical to a data exfiltration utility. When combined with any skill that grants filesystem enumeration or read access, this skill closes the loop to a fully automated exfiltration chain. The payment gate (175 sats) adds friction but does not prevent abuse.
LOW Unexpected Companion Dependency: academic-research-hub -10 ▶
The .clawhub/lock.json records academic-research-hub as an installed companion skill. There is no obvious functional relationship between a photo sharing API client and an academic research skill. This unusual pairing may indicate skill chaining where academic-research-hub is used to locate or summarize files before origram exfiltrates them.
LOW Skill Normalizes Outbound HTTP Calls to External Service as Standard Agent Behavior -18 ▶
By presenting origram.xyz API calls as routine bot behavior and providing complete Node.js and bash examples ready for agent execution, the skill implicitly establishes that making outbound POSTs with file contents to this external service is expected and safe. This primes the agent to accept such requests without suspicion.
INFO Installation Was Clean — No Malicious Code Executed 0 ▶
The git sparse-checkout installation only fetched SKILL.md, _meta.json, and .clawhub/lock.json. No executable scripts ran, no process spawning outside expected system activity was detected, and no canary file contents were transmitted during the install phase.
INFO Canary Files Accessed by Audit Infrastructure Only 0 ▶
File access syscalls show .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud credentials were opened during the audit. Timestamps (1771951694.415 and 1771951714.075) align with the oathe audit scanner's pre/post baseline pass, not with any skill-initiated process. No contents were transmitted.