ClawHub
Back to skill

Security audit

imagenCN

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill mostly matches its stated purpose, but it needs review because it can send prompts, images, and API credentials to external services, including a user-configured DashScope endpoint that is not validated.

Install only if you are comfortable sending prompts and any input images to the listed external providers. Use dedicated, low-privilege API keys; keep DASHSCOPE_API_BASE to cn, sg, us, or a trusted HTTPS Aliyun endpoint; avoid sensitive images or secrets in prompts; and prefer a virtual environment with reviewed pinned dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate_image.py:385
Finding

Unrestricted DashScope API endpoint permits credential disclosure

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:586
Finding

Unvalidated image URLs permit server-side request forgery and unsafe downloads

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:289
Finding

Third-party dependencies are installed without version or integrity pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises executable behavior that can read environment variables, read/write files, and make network requests, but it does not declare any explicit tool scope or permissions boundary. That weakens least-privilege controls and makes it harder for a host agent or reviewer to understand what capabilities will be exercised before activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill does not clearly warn that user prompts, and potentially local images or image URLs, will be transmitted to third-party image-generation providers across multiple platforms. This creates a privacy and data-governance risk because users may provide sensitive text or images without informed consent about external processing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The auto-activation rules are broad enough to trigger on many ordinary image-related requests, including generic mentions of photography, posters, or Chinese support. Over-broad triggering can cause the agent to invoke a networked third-party skill unexpectedly, increasing the chance of unnecessary data disclosure and unintended file/network operations.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

Dry run (preview without making API call)

python ~/.claude/skills/imagenCN/scripts/generate_image.py --dry-run --platform ark "Test prompt"

List all models

python ~/.claude/skills/imagenCN/scripts/generate_image.py --list-models

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

md
## Config File (Optional)

Create `~/.imagenCN.json` for personal defaults, or `.imagenCN.json` in a project
directory for per-project overrides.  API keys stay in environment variables for
security.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/generate_image.py (reported line 33)May include surrounding context.

python
1 — usage error (bad arguments, unknown model)
    2 — auth / config error (missing or invalid API key)
    3 — API error (upstream failure, rate limit, quota)
    4 — I/O error (cannot write output file, download failed)
"""

import argparse

Tainted flow: 'output_path' from os.environ.get (line 866, credential/environment) → pathlib.Path.write_bytes (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate_image.py (reported line 590)May include surrounding context.

python
try:
        response = requests.get(url, timeout=60)
        response.raise_for_status()
        output_path.write_bytes(response.content)
        return True
    except Exception as e:
        if _FMT == "json":

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This script sends user prompts and optional input images to third-party cloud providers across multiple platforms, but it does not provide an explicit privacy/disclosure warning at the point of use. In an agent or automation context, users may not realize sensitive prompts, embedded secrets, or local image contents are being transmitted to external services, which can create confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

At this point the script selects a remote provider endpoint as part of actual execution and later transmits user prompts and possibly input images to that external service. In the context of an agent skill, this is a genuine external data transmission risk because potentially sensitive user content leaves the local environment without an explicit just-in-time disclosure or restriction mechanism.

Content

Scanner excerpt · scripts/generate_image.py (reported line 903)May include surrounding context.

python
endpoint = "https://tokenhub.tencentmaas.com/v1/images/generations"
    elif platform == "zhipu":
        api_type = "Zhipu (OpenAI-compatible)"
        endpoint = "https://api.z.ai/api/paas/v4/images/generations"
    elif platform == "stepfun":
        api_type = "StepFun (OpenAI-compatible)"
        endpoint = "https://api.stepfun.com/v1/images/generations"

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

This execution path similarly configures an external StepFun endpoint that will receive user-supplied prompts and optional related metadata during generation. In a multi-provider skill, the expanded set of destinations increases the chance of unintentional disclosure, especially when used by automation or agents on behalf of users.

Content

Scanner excerpt · scripts/generate_image.py (reported line 906)May include surrounding context.

python
endpoint = "https://api.z.ai/api/paas/v4/images/generations"
    elif platform == "stepfun":
        api_type = "StepFun (OpenAI-compatible)"
        endpoint = "https://api.stepfun.com/v1/images/generations"
    elif model in SYNTHESIS_MODELS:
        api_type = "ImageSynthesis"
        endpoint = dashscope.base_http_api_url

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hunyuan.py (reported line 18)May include surrounding context.

python
name = "Hunyuan"
    env_var = "HUNYUAN_API_KEY"
    env_model_var = "HUNYUAN_MODEL"
    api_base = "https://api.hunyuan.cloud.tencent.com/v1/images/generations"
    default_model = "hy-image-v3.0"

    models = {"hy-image-v3.0"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 662)May include surrounding context.

python
name = "StepFun"
    env_var = "STEP_API_KEY"
    env_model_var = "STEP_MODEL"
    api_base = "https://api.stepfun.com/v1/images/generations"
    default_model = "step-2x-large"

    models = {"step-2x-large", "step-image-edit-2"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/stepfun.py (reported line 18)May include surrounding context.

python
name = "StepFun"
    env_var = "STEP_API_KEY"
    env_model_var = "STEP_MODEL"
    api_base = "https://api.stepfun.com/v1/images/generations"
    default_model = "step-2x-large"

    models = {"step-2x-large", "step-image-edit-2"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 661)May include surrounding context.

python
name = "Zhipu"
    env_var = "ZHIPUAI_API_KEY"
    env_model_var = "ZHIPUAI_MODEL"
    api_base = "https://api.z.ai/api/paas/v4/images/generations"
    default_model = "cogview-4"

    models = {"cogview-4", "cogview-4-250304", "glm-image"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/zhipu.py (reported line 18)May include surrounding context.

python
name = "Zhipu"
    env_var = "ZHIPUAI_API_KEY"
    env_model_var = "ZHIPUAI_MODEL"
    api_base = "https://api.z.ai/api/paas/v4/images/generations"
    default_model = "cogview-4"

    models = {"cogview-4", "cogview-4-250304", "glm-image"}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The generate method sends the user prompt and authorization header to an external provider API. While this is functionally central to the provider, this file contains no user-visible notice, confirmation, or logging that prompt content and credentials are being sent off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The download method performs a file write to an arbitrary output path, creating parent directories and saving remote content to disk. Although the docstring describes the behavior for developers, there is no user-facing confirmation, print/log disclosure, or other visible warning in this file about the write operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
74% confidence
Finding

Sensitive environment-variable access is in scope for this rule when there is no warning or disclosure. Although the top-level docstring names ARK_API_KEY as required configuration, it does not explicitly warn that the skill reads and uses a secret credential for external API requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The function delegates to a download helper that saves data to disk, which is a file-write operation covered by the missing-warning rule for code files. This file contains no confirmation prompt, logging, or inline comment/docstring warning users that invoking this helper will write an image to the provided path.

Content

No source excerpt is available for this finding.