ClawHub
Back to skill

Security audit

Azure Image Gen

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but it handles an Azure API key in a way that can send it to an unvalidated endpoint and writes unescaped prompt text into a generated gallery.

Install only if you trust and control the skill directory and its .env file. Verify AZURE_OPENAI_ENDPOINT is your real Azure HTTPS endpoint before running, avoid sharing generated galleries from untrusted prompts until HTML escaping is fixed, and treat manifest/gallery files as containing prompt history.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate.py:43
Finding

Azure API Key Disclosure Through an Unrestricted Configurable Endpoint

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.py:142
Finding

Stored HTML Injection in the Generated Image Gallery

Content
View full analysis
{img['prompt'][:100]}

{img['prompt']}

{img['size']} • {img['quality']} • {img['style']}

""" ``` ### Technical Analysis The gallery generator inserts `img['prompt']` directly into both an HTML attribute and an HTML text context without escaping it. The value can originate from the user-supplied prompt or from the Azure response's `revised_prompt` field. An attacker-controlled value containing quotation marks and HTML markup can terminate the `alt` attribute or inject elements through the paragraph body. When the generated `index.html` is opened, the browser interprets the injected content as markup rather than inert text. The risk is amplified by the unrestricted endpoint issue: a maliciously configured service can return a crafted `revised_prompt`, which is subsequently stored in the generated gallery. ### Attack Path 1. An attacker supplies a crafted prompt, or controls the configured endpoint and returns a crafted `revised_prompt`. 2. The script stores that value in the `images` collection. 3. `create_gallery_html` concatenates the value into `index.html` without context-appropriate escaping. 4. The user opens the generated gallery in a web browser. 5. The injected HTML is parsed and any browser-permitted active content executes in the local gallery's origin context. ### Impact Assessment Exploitation can alter the gallery, display deceptive content, initiate unwanted browser requests, and execute JavaScript where the browser's handling of the local document permits it. The exact capabilities ...[truncated 411 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 20)May include surrounding context.

python
def load_env():
    """Load environment variables from .env file if present."""
    env_file = Path(__file__).parent.parent / ".env"
    if env_file.exists():
        with open(env_file) as f:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 182)May include surrounding context.

python
def load_env():
    """Load environment variables from .env file if present."""
    env_file = Path(__file__).parent.parent / ".env"
    if env_file.exists():
        with open(env_file) as f:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 21)May include surrounding context.

python
def load_env():
    """Load environment variables from .env file if present."""
    env_file = Path(__file__).parent.parent / ".env"
    if env_file.exists():
        with open(env_file) as f:
            for line in f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documentation describes capabilities that require access to environment variables, network communication with Azure OpenAI, and file writes, but it does not declare any tool scope or permissions boundary. This creates a transparency and least-privilege problem: an agent or reviewer cannot easily determine what the skill is allowed to access, increasing the risk of overbroad execution and misuse if the implementation is run in a permissive environment.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
75% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
**404 Not Found**: Verify your `AZURE_OPENAI_DALLE_DEPLOYMENT` name matches exactly

**Content Policy**: Azure has strict content filters. Rephrase prompts that get blocked.

Static analysis

No suspicious patterns detected.