openclaw-sogni-gen
What this skill does
AI image and video generation using Sogni AI's decentralized GPU network. Acts as an MCP server for Claude Code and Claude Desktop, and as an OpenClaw plugin.
github/leoyeai - Credential Exfiltration - 2.1k stars
Threat analysis
Skill info
pkg:github/LeoYeAI/openclaw-master-skills@e5199b5?skill=openclaw-sogni-genAssessments (3)
Credential Exfiltration
Credential Exfiltration via local-llm-review
sogni-gen.mjs
The skill reads credentials from the file system (~/.config/sogni/credentials) and uses them to authenticate with Sogni AI. If the credentials are not properly secured, they could be exfiltrated or miEnvironment Variable Usage
Environment Variable Usage via local-llm-review
mcp-server.mjs
The skill uses environment variables to override default file paths. This could be exploited to redirect file operations to unexpected locations.File System Access
File System Access via local-llm-review
sogni-gen.mjs
The skill has the ability to read and write files to the file system, including the ability to save generated images to arbitrary locations. This could be used to exfiltrate data or overwrite files.Badge
Add the Anomity scan badge for openclaw-sogni-gen to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of openclaw-sogni-gen? Report an issue or request a rescan.
