Ernie Image Gen

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 2.0.0

Overview

The skill is a coherent Baidu image-generation helper, but its setup path includes risky unverified shell installation guidance and unpinned runtime dependency resolution.

Review before installing. Use this only if you are comfortable sending image prompts to Baidu AI Studio and exposing AI_STUDIO_API_KEY to the Python process. Avoid the documented curl | sh installer path; install uv through a trusted, verified channel. Prefer running the skill in a constrained workspace and consider pinning or locking the openai dependency before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/api-guide.md:202
• Finding: Unverified Remote Installer Executed Directly by the Shell## Vulnerability Details **File Location**: `references/api-guide.md:202` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical **Complete Code Snippet**: ```markdown | `uv run` fails | uv not installed or Python < 3.11 | Install uv: `curl -LsSf https://astral.sh/uv/install.sh \| sh` | ``` ### Technical Analysis The troubleshooting documentation instructs the user to download a remotely hosted shell script and immediately pipe it into `sh`. The installer is not version-pinned, included in the audited project, or verified using a cryptographic checksum or signature. HTTPS protects the connection in transit under normal conditions, but it does not make the remotely controlled payload immutable. The effective code executed by this instruction can change after the Skill has been reviewed. Compromise of the hosting service, domain, DNS infrastructure, certificate issuance path, or publisher account could therefore turn this installation command into an arbitrary-code execution channel. Installing `uv` may be a prerequisite for the documented workflow, but executing an unreviewed mutable script directly from the network exceeds the minimum privileges and trust necessary for image generation. ### Attack Path 1. An attacker compromises or gains control over the remote installer distribution path. 2. The attacker replaces or modifies the installer returned from `https://astral.sh/uv/install.sh`. 3. A user encounters the documented `uv run` troubleshooting condition. 4. The user runs the suggested command. 5. `curl` retrieves the attacker-controlled script. 6. The pipe passes the response directly to `sh` without inspection or integrity verification. 7. The malicious payload executes with the permissions and environment access of the invoking user. ### Impact Assessment A substituted installer could execute arbitrary commands with the invoking user’s privileges. Depending on th ...[truncated 486 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct `curl | sh` installation command from the documentation. 2. Prefer a reviewed operating-system package manager or another trusted, reproducible installation channel. 3. If a standalone installer is necessary, pin a specific release and download it as a separate file. 4. Publish and verify a cryptographic checksum or trusted signature before execution. 5. Keep download, verification, and execution as separate steps so users can inspect the artifact. 6. Run installation with ordinary user privileges unless elevated permissions are demonstrably required. 7. Document the expected installer source, version, checksum, and files it will modify.

T08 · Insecure Dependencies

Warning

• Location: scripts/generate.py:2
• Finding: Unpinned Runtime Dependency Permits Unreviewed Package Updates## Vulnerability Details **File Location**: `scripts/generate.py:2-4` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```python # /// script # requires-python = ">=3.11" # dependencies = ["openai>=2.33.0"] # /// ``` The documented execution path in `SKILL.md:75` invokes this inline dependency declaration through: ```bash uv run {baseDir}/scripts/generate.py "<PROMPT>" --model ERNIE-Image-Turbo --size 1024x1024 ``` ### Technical Analysis The dependency declaration specifies only a lower bound for the `openai` package. Consequently, `uv run` may resolve and install any future package release satisfying `openai>=2.33.0`. The project contains no lockfile, exact dependency version, package hash, or vendored artifact that constrains execution to the version covered by the audit. The code ultimately imported and executed can therefore change after publication without any modification to the Skill itself. This does not establish that the current `openai` package is malicious. The vulnerability is the absence of reproducible dependency resolution and integrity controls. A compromised, malicious, or unexpectedly incompatible future release could run during installation or import with access to the current user’s environment. ### Attack Path 1. A future compatible package release is compromised, maliciously published, or otherwise contains unsafe behavior. 2. A user invokes the documented `uv run` command in an environment without a securely locked dependency resolution. 3. `uv` resolves the lower-bound-only requirement to the affected release. 4. The dependency is installed and imported by `scripts/generate.py`. 5. Package code executes with the invoking user’s permissions. 6. Because the script reads `AI_STUDIO_API_KEY` from the environment, malicious dependency code running in the same process could access that credential and other user-accessible res ...[truncated 612 chars]
• Remediation: ## Remediation Suggestions 1. Replace the lower-bound-only requirement with an exact, reviewed dependency version. 2. Commit a lockfile that records the complete transitive dependency graph. 3. Enforce cryptographic hashes for downloaded package artifacts where supported. 4. Use a trusted package index and prevent fallback to unapproved package sources. 5. Update dependencies only through an explicit review and testing process. 6. Run the Skill in a restricted environment with access only to the required output directory, network endpoint, and API credential. 7. Rotate `AI_STUDIO_API_KEY` immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Credential Access

High

• Category: Privilege Escalation

Content

## Prerequisites

- Python 3.11+ with `uv` installed
- `AI_STUDIO_API_KEY` environment variable set to your Baidu AI Studio access token
- Get a token at: https://aistudio.baidu.com/account/accessToken

Prefer `ERNIE-Image-Turbo`, `1024x1024`, `n=1`, and `b64_json` unless the user

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Prerequisites

- Python 3.11+ with `uv` installed
- `AI_STUDIO_API_KEY` environment variable set to your Baidu AI Studio access token
- Get a token at: https://aistudio.baidu.com/account/accessToken

Prefer `ERNIE-Image-Turbo`, `1024x1024`, `n=1`, and `b64_json` unless the user

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Prerequisites

- Python 3.11+ with `uv` installed
- `AI_STUDIO_API_KEY` environment variable set to your Baidu AI Studio access token
- Get a token at: https://aistudio.baidu.com/account/accessToken

Prefer `ERNIE-Image-Turbo`, `1024x1024`, `n=1`, and `b64_json` unless the user

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Authentication

### Getting Your Access Token

1. Visit https://aistudio.baidu.com/account/accessToken
2. Register or log in with your Baidu account

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

| Error | Likely Cause | Solution |
|---|---|---|
| `AI_STUDIO_API_KEY not set` | Environment variable missing | Set the `AI_STUDIO_API_KEY` env var |
| 401 Unauthorized | Invalid or expired token | Generate a new access token at AI Studio |
| 403 Forbidden | No permission for the model | Check your AI Studio account permissions |
| Content filtered | Prompt contains restricted content | Rephrase the prompt to avoid sensitive topics |
| Timeout (API) | Large `n` or complex prompt | Reduce `n`, simplify prompt (timeout: 60s) |

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to use environment variables, local file writes, and outbound network access, but it does not declare any explicit tool scope or permissions boundary. This can cause the runtime to grant broader capabilities than reviewers or policy systems expect, increasing the chance of unintended data exposure or unauthorized actions if the skill is invoked automatically.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The description includes many broad trigger phrases for common image-generation language, which can cause the skill to match and activate in situations where the user did not specifically intend to use this Baidu-backed workflow. Because activation leads to external API use and local file creation, overbroad routing increases the risk of sending prompts or sensitive text to a third party without clear user intent.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The quick-trigger section instructs the agent to 'generate immediately with defaults' for very general phrases such as 'draw' or '画画', without confirmation, eligibility checks, or safeguards against accidental capture of surrounding text. This creates a direct path from casual language to networked execution and file output, which is risky in agent environments handling mixed-purpose conversations.

External Script Fetching

Low

• Category: Supply Chain

Content

| Empty response | Temporary API issue | Retry after a few seconds |
| Invalid size | Size not in allowed list | Use one of the 7 supported sizes |
| Invalid prefix | Unsafe filename prefix | Use letters, numbers, `_`, `-`, or `.` |
| `uv run` fails | uv not installed or Python < 3.11 | Install uv: `curl -LsSf https://astral.sh/uv/install.sh \| sh` |

---

• Confidence: 83% confidence
• Finding: The documentation recommends piping a remotely fetched script directly into a shell with 'curl ... | sh'. This pattern is risky because it executes network-delivered code without verification, making users vulnerable to supply-chain compromise, DNS/TLS interception edge cases, or a compromised upstream installer.

Static analysis

No suspicious patterns detected.