Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its stated AlphaShop image-processing purpose, but users should know it sends image URLs and related parameters to AlphaShop using configured credentials.
Install this only if you intend to use AlphaShop's remote image-processing service. Treat submitted image URLs as content shared with AlphaShop, avoid sensitive or regulated images unless your organization approves, prefer short-lived public URLs, protect the AlphaShop keys, and lock/audit the Python dependencies for production use.
The README promotes remote image-processing features but does not clearly disclose that user-supplied image URLs and image content are transmitted to AlphaShop’s external service. This can lead users to unknowingly send sensitive images, embedded text, or metadata to a third party, creating privacy, confidentiality, and compliance risks.
The skill documents use of environment variables and outbound API calls, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens execution boundaries and reviewability, increasing the chance the skill can access secrets or perform network actions without clear policy constraints.
The trigger phrases are broad and loosely bounded, covering generic image-editing requests such as translation, enlargement, background removal, and watermark detection/removal. This can cause accidental invocation in contexts the user did not intend, leading to unreviewed transmission of images and use of third-party processing.
The documentation instructs users to provide image URLs and API keys to send content to a third-party AlphaShop service, but it does not warn that images may contain personal, proprietary, or regulated data that will leave the local environment. Without a privacy notice and data-handling disclosure, users may unknowingly expose sensitive content or credentials-related metadata to an external processor.
The example defaults to a specific race-based model transformation ('WHITE') rather than presenting neutral, user-selected options. In context this is not a classic code-execution flaw, but it creates a harmful default for a sensitive biometric/appearance-changing feature and can normalize biased or inappropriate use.
The documentation instructs clients to send externally hosted image URLs and bearer tokens to a third-party API but provides no warning that user images, embedded metadata, and credentials are being shared outside the local system. In an image-processing skill, this omission can lead operators to unknowingly expose sensitive or proprietary images to an external service, increasing privacy, compliance, and data-handling risk.
This endpoint documentation explicitly requires publicly accessible image URLs but does not warn users that making images public or retrievable by a third-party service may expose private content. Given the skill's purpose is bulk image manipulation, users may submit customer, catalog, or internal assets and unintentionally disclose them to external infrastructure.
This code posts user-supplied image URLs and related request data to the AlphaShop remote service, which is a privacy-relevant network operation. Although the module docstring names the API and auth mechanism, there is no explicit warning or disclosure in the command help or runtime output that user data will be sent to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
url = f"{BASE_URL}{path}"
headers = {"Content-Type": "application/json", "Authorization": f"Bearer {get_token()}"}
try:
r = requests.post(url, json=body, headers=headers, timeout=120)
r.raise_for_status()
return r.json()
except requests.exceptions.HTTPError as e:
The README instructs users to place API credentials in configuration but does not warn them to protect those secrets, avoid committing them to source control, or rotate them if exposed. This increases the chance of accidental credential leakage and unauthorized use of the AlphaShop account.
The file is entirely written in Chinese and does not indicate any language choice or opt-in for users who may expect documentation in another locale. Per SQP-3, forcing a specific language without user choice can be a natural-language policy concern when no regional limitation or justification is documented.
The dependency specifier requests>=2.20.0 is unpinned, so builds may resolve to different versions over time and can unexpectedly include vulnerable or incompatible releases. In a skill that performs image-processing API calls, requests is likely security-relevant because it handles outbound HTTP and may process attacker-influenced URLs, tokens, or credentials.
requests>=2.20.0
PyJWT>=2.0.0
requests has multiple known advisories, and because the manifest does not pin a version, there is no way to verify that deployment will avoid affected releases. This is particularly relevant for an image-processing integration skill, where HTTP client behavior can affect credential handling, TLS verification, redirects, and SSRF-adjacent request flows.
The dependency specifier PyJWT>=2.0.0 is unpinned, which makes the installed version non-deterministic and prevents verifying whether a vulnerable release may be selected. Because this skill likely authenticates to external APIs, JWT handling is security-sensitive and version drift can expose token-validation or key-handling flaws.
requests>=2.20.0
PyJWT>=2.0.0
PyJWT has known security advisories, and the lack of pinning means the runtime may resolve to a vulnerable version without visibility or reproducibility. In a skill that likely signs or validates authentication tokens for API access, JWT library flaws can have direct security consequences such as improper issuer validation, SSRF via key retrieval helpers, or acceptance of malformed tokens.
The code reads ALPHASHOP_ACCESS_KEY and ALPHASHOP_SECRET_KEY from the environment and uses them to generate authentication tokens for outbound API calls. While the top-level docstring mentions the env vars, it does not clearly warn users that credentials are being consumed for remote authentication, which is the kind of sensitive operation this rule targets.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"noobj_qrcode": "noobjRemoveQrcode",
}
for attr, key in flag_map.items():
val = getattr(args, attr, None)
if val:
body[key] = val
print(json.dumps(call_api("/ai.image.imageElementRemove/1.0", body), ensure_ascii=False, indent=2))
No suspicious patterns detected.