Security audit

Story Cover

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed novel-cover generator that calls an image API and saves the generated cover locally, with normal but important API-key and reference-image URL cautions.

Install only if you are comfortable sending cover prompts, book metadata, and optional reference images to the configured image API. Keep GPT_IMAGE_BASE_URL at the trusted default unless you intentionally use a trusted proxy, and use local or trusted HTTPS reference images.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:228
Finding: Unrestricted Reference Image Retrieval Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:157
Finding: Configurable API Endpoint Can Receive the Bearer API Key
Content: View full analysis
"$RESP" ``` The same pattern is also used for the image-editing request: `BASE_URL` is read at line 210 and the bearer credential is attached at line 241. ### Technical Analysis `GPT_IMAGE_BASE_URL` can be set to an arbitrary URL, but the skill unconditionally attaches `GPT_IMAGE_API_KEY` as an `Authorization: Bearer` header. The endpoint is not restricted to OpenAI or another explicitly trusted provider, and HTTPS is not enforced. If an attacker can alter the environment, supply setup instructions, or convince a user to configure a malicious compatibility proxy, the request will transmit the API key directly to that endpoint. The request also exposes the generated prompt and, in image-editing mode, the reference image. The risk is heightened because the documentation explicitly presents `GPT_IMAGE_BASE_URL` as a supported compatibility-proxy setting. Users may therefore treat a third-party endpoint as an expected configuration rather than a security-sensitive credential destination. ### Attack Path 1. An attacker influences project configuration, process environment, deployment settings, or user instructions. 2. `GPT_IMAGE_BASE_URL` is set to an attacker-controlled HTTP or HTTPS server. 3. The user invokes the skill with a valid `GPT_IMAGE_API_KEY`. 4. The skill constructs a request to the attacker-controlled base URL. 5. The request includes `Authorization: Bearer $GPT_IMAGE_API_KEY`. 6. The attacker records the be ...[truncated 782 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
md
OUT="$BOOK_DIR/封面/封面_v${i}.png" RESP=$(mktemp) REF_TMP="" trap '[ -n "$REF_TMP" ] && rm -f "$REF_TMP"; rm -f "$RESP"' EXIT # URL 先下载到临时文件，本地路径直接用。用裸 mktemp 以保证 macOS/Linux 行为一致。 case "$REF_IMAGE" in

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
md
OUT="$BOOK_DIR/封面/封面_v${i}.png" RESP=$(mktemp) REF_TMP="" trap '[ -n "$REF_TMP" ] && rm -f "$REF_TMP"; rm -f "$RESP"' EXIT # URL 先下载到临时文件，本地路径直接用。用裸 mktemp 以保证 macOS/Linux 行为一致。 case "$REF_IMAGE" in

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases include broad natural-language expressions such as '生成封面图' and '封面设计', which can overlap with ordinary conversation and cause the skill to activate unexpectedly. Because the skill performs file writes and external API use, accidental invocation increases the chance of unintended data transmission or filesystem changes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
| 变量 | 必填 | 默认 | 说明 | |:-----|:----:|:-----|:-----| | `GPT_IMAGE_API_KEY` | ✅ | — | OpenAI 或兼容代理的 API Key | | `GPT_IMAGE_BASE_URL` | | `https://api.openai.com/v1` | 兼容代理时改这个 | | `GPT_IMAGE_MODEL` | | `gpt-image-2` | 仅在测试新模型时覆盖 | | `GPT_IMAGE_SIZE` | | `1024x1536` | gpt-image-2 要求两边为 16 倍数、比例 ≤ 3:1 | | `BOOK_DIR` | ✅ | — | 输出目录，建议 `./covers/<书名>` |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill writes generated images and prompt/reference sidecar files to disk and sends prompt content to an external image API, but the user-facing instructions do not prominently disclose these side effects as part of normal operation. This creates a privacy and transparency issue because titles, author names, prompts, and reference image locations may be persisted locally and transmitted externally without clear warning.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This code sets a configurable external base URL for image generation requests, enabling transmission to third-party or proxy endpoints beyond the default vendor. In context this flexibility is functional, but it increases risk because a malicious or misconfigured endpoint could capture prompts, metadata, and API usage.
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
md
set -euo pipefail : "${GPT_IMAGE_API_KEY:?请设置 export GPT_IMAGE_API_KEY=你的key}" : "${PROMPT:?请先 export PROMPT=Step 2 拼好的完整提示词}" BASE_URL="${GPT_IMAGE_BASE_URL:-https://api.openai.com/v1}" MODEL="${GPT_IMAGE_MODEL:-gpt-image-2}" SIZE="${GPT_IMAGE_SIZE:-1024x1536}" BOOK_DIR="${BOOK_DIR:?请先 export BOOK_DIR=./covers/<书名>}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This command transmits user-supplied prompt content to an external API using curl with an authorization header. In this skill context external transmission is expected, but it is still security-relevant because book metadata and prompt text leave the local environment and may be sent to a configurable endpoint.
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
md
--arg s "$SIZE" \ '{model:$m, prompt:$p, size:$s}') curl -fsS --max-time 180 --retry 2 --retry-delay 5 \ "$BASE_URL/images/generations" \ -H "Authorization: Bearer $GPT_IMAGE_API_KEY" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This code similarly enables external transmission for the image-edit flow through a configurable base URL. Because reference images may also be uploaded in this path, misuse of a custom endpoint has broader privacy impact than text-only prompts.
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
set -euo pipefail : "${GPT_IMAGE_API_KEY:?请设置 export GPT_IMAGE_API_KEY=你的key}" : "${PROMPT:?请先 export PROMPT=Step 2 拼好的完整提示词}" BASE_URL="${GPT_IMAGE_BASE_URL:-https://api.openai.com/v1}" MODEL="${GPT_IMAGE_MODEL:-gpt-image-2}" SIZE="${GPT_IMAGE_SIZE:-1024x1536}" BOOK_DIR="${BOOK_DIR:?请先 export BOOK_DIR=./covers/<书名>}"

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill allows REF_IMAGE to be an arbitrary HTTP(S) URL and will fetch it with curl, which expands the skill from pure image generation into general outbound retrieval. This can be abused for unintended network access, including contacting attacker-controlled hosts, leaking access patterns/IP metadata, or retrieving untrusted content for downstream processing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Lines L074-L077 state that GPT-Image-2 can directly render Chinese and provide a fixed Chinese-title/author formatting pattern. Because this skill material is framed as a general cover-style library, the language choice appears forced rather than optional, which can conflict with locale-choice policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.