BigModel Image Video Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate BigModel image and video generator, but it handles an API key in ways users should review before installing.

Review this before installing if you will use a real BigModel API key. Keep the default BigModel endpoint, avoid passing user-controlled base_url values, store the API key in a proper secret manager or temporary environment instead of committed or synced shell files, and expect prompts and image URLs to be sent to BigModel for generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/image_video.py:20

Finding

Bearer API Key Can Be Forwarded to an Arbitrary Network Endpoint

Content

View full analysis

Vulnerability Details

File Location: lib/image_video.py:20-56
Additional Request Sinks: lib/image_video.py:100-116
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

Vulnerable Code

python

def __init__(
    self,
    api_key: Optional[str] = None,
    base_url: str = "https://open.bigmodel.cn/api",
    timeout: int = 60,
):
    self.api_key = api_key or os.environ.get("BIGMODEL_API_KEY")
    if not self.api_key:
        raise ValueError("需要设置 BIGMODEL_API_KEY 环境变量")
    self.base_url = base_url
    self.timeout = timeout
    self._headers = {
        "Authorization": f"Bearer {self.api_key}",
        "Content-Type": "application/json",
    }

def generate_image(
    self,
    prompt: str,
    model: str = "cogview-3-flash",
    quality: str = "standard",
    size: str = "1024x1024",
    watermark_enabled: bool = True,
) -> dict:
    """生成单张图片"""
    resp = requests.post(
        f"{self.base_url}/paas/v4/images/generations",
        headers=self._headers,
        json={
            "model": model,
            "prompt": prompt,
            "quality": quality,
            "size": size,
            "watermark_enabled": watermark_enabled,
        },
        timeout=self.timeout,
    )
    resp.raise_for_status()
    return resp.json()

The same unvalidated self.base_url and authorization headers are used by the video-generation and task-status requests:

python

resp = requests.post(
    f"{self.base_url}/paas/v4/videos/generations",
    headers=self._headers,
    json=payload,
    timeout=self.timeout,
)

resp = requests.get(
    f"{self.base_url}/paas/v4/async-result/{task_id}",
    headers=self._headers,
    timeout=30,
)

Technical Analysis

BigModelClient permits callers to replace the documented BigModel API endpoint with an arbitrary base_url. The value is not res ...[truncated 2072 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the configurable base_url parameter if custom endpoints are not required.
2. If endpoint customization is necessary, parse the URL and enforce:
   • The https scheme.
   • An explicit hostname allowlist, such as open.bigmodel.cn.
   • The expected port and API path.
   • Rejection of embedded credentials, fragments, and malformed hostnames.
3. Keep authentication headers scoped to the approved origin rather than storing them in a reusable header dictionary for arbitrary destinations.
4. Disable automatic redirects for authenticated requests or validate every redirect target before following it.
5. Separate custom or test endpoints from production credentials. Require an explicitly supplied test credential for non-production hosts.
6. Add tests confirming that HTTP URLs, look-alike domains, IP addresses, and unapproved redirect targets are rejected.

T08 · Insecure Dependencies

Note

• Location: README.md:32

Finding

Third-Party Dependency Is Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: README.md:32-39
Additional Location: lib/image_video.py:5
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

markdown

### 2. 安装依赖

```bash
pip install requests

或使用 uv：

bash

uv add requests

text

The core module repeats the unpinned installation instruction:

```python
"""
BigModel 图片与视频生成模块
使用智谱 AI CogView 和 CogVideoX API

安装依赖: pip install requests
环境变量: export BIGMODEL_API_KEY=your_key
"""

Technical Analysis

The project instructs users to install requests without selecting a reviewed version, providing a lockfile, or verifying package hashes. Consequently, installation results can vary over time and depend on the package indexes configured in the user's environment.

The dependency name is the legitimate requests package, and the reviewed project does not specify a malicious package or an untrusted package index. The concern is therefore supply-chain hardening rather than evidence of an intentionally malicious dependency.

If the configured index is compromised, misconfigured, or replaced by an attacker-controlled mirror, an unexpected distribution could be installed. An unreviewed future release could also introduce incompatible or vulnerable behavior.

Attack Path

1. A user follows the documented pip install requests or uv add requests instruction.
2. The package manager resolves the dependency using the user's configured index and selects a version at installation time.
3. A compromised index, malicious mirror, or compromised package release supplies an unsafe distribution.
4. Package installation or later import executes code from that distribution in the user's Python environment.
5. That code receives the privileges of the user running the installation or Skill.

Exploitation depends on compromise or manipulation of the dependency supply chain; no ma ...[truncated 565 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests to a reviewed version or a deliberately bounded compatible range.
2. Provide a committed lockfile generated by the supported package-management tool.
3. For reproducible deployments, use hash-verified installation through a requirements file containing --hash entries.
4. Document the trusted package index and avoid untrusted or fallback indexes.
5. Install dependencies inside an isolated virtual environment with only the permissions required by the Skill.
6. Add automated dependency vulnerability scanning and a controlled process for reviewing and updating pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose is image/video generation, but the documented behavior also includes environment inspection, local module loading, connectivity self-tests, and diagnostic command execution. Even if operationally useful, this mismatch can mislead users and reviewers about the true capability surface, causing them to approve a skill that can probe configuration state and interact with local resources beyond content generation.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation text is overly broad and instructs proactive use even when the user does not explicitly ask for image or video generation. This can cause the skill to trigger on many general creative tasks, expanding opportunities for unnecessary API calls, secret-dependent execution, and unintended network activity in contexts where the user did not consent to using this external generation service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README instructs users to persistently store the API key in shell startup files without any warning about credential sensitivity or safer secret-handling options. This increases the chance of accidental exposure through dotfile syncing, backups, screen sharing, shared accounts, or committing config files, and normalizes insecure secret management practices.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents capabilities that require environment access, local file modification, and network use, but it does not declare any explicit tool scope or permissions boundaries. This creates an authorization ambiguity where an agent may invoke broader capabilities than a reviewer expects, increasing the risk of unintended secret access, filesystem changes, or outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This JSON file contains natural-language prompts, assertion names, and expected outputs exclusively in Chinese, which effectively constrains the skill's evaluation interface to a specific language. Under the policy, language-specific behavior should either offer user choice or clearly document a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file uses Chinese natural-language strings throughout, including the module docstring, comments, prompts, and printed output, with no indication that language choice is optional. The policy for all file types requires flagging language or locale constraints when the skill effectively forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains user-facing natural-language strings entirely in Chinese, including the module docstring and printed status messages. The file does not offer any language selection or indicate that the skill is intentionally region-specific, which can violate language/locale policy requirements for user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/image_video.py (reported line 44)May include surrounding context.

python

watermark_enabled: bool = True,
    ) -> dict:
        """生成单张图片"""
        resp = requests.post(
            f"{self.base_url}/paas/v4/images/generations",
            headers=self._headers,
            json={

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code sends the user-provided prompt to a remote BigModel service, and the module-level comments only mention dependency installation and API key setup, not that user content is uploaded to a third-party API. Because prompts may contain sensitive user or system data, the absence of an explicit disclosure is a missing warning for a network operation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/image_video.py (reported line 100)May include surrounding context.

python

if image_url:
            payload["image_url"] = image_url

        resp = requests.post(
            f"{self.base_url}/paas/v4/videos/generations",
            headers=self._headers,
            json=payload,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language instructions and CLI output that assume Chinese as the only user language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains user-facing messages and documentation strings entirely in Chinese, including setup instructions and runtime status output. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s natural-language elements are entirely in Chinese, including the docstring, comments, prompt text, and printed output. For a general example skill, this imposes a specific language/locale without offering user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The client reads an API key from the environment and uses it for authentication, but there is no warning or guidance about treating this value as sensitive beyond stating that it must be set. For skills that consume credentials, a brief disclosure helps users understand the sensitivity and scope of the secret being used.

Content

No source excerpt is available for this finding.