ClawHub
Back to skill

Security audit

WuyinKeji GPT-Image-2

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent third-party image-generation wrapper, but it exposes and handles API credentials in ways that warrant review before installation.

Review this skill before installing. Use only a rotated, limited WuyinKeji API key, avoid sensitive prompts or private reference images, and be aware that the helper sends credentials to the provider and places the key in a polling URL. Consider requiring safer credential handling and result-URL validation before production use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:3
Finding

Hard-Coded API Credential in Skill Metadata

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate.sh:76
Finding

API Credential Disclosed Through Polling Query String

Content
View full analysis
&key=" ``` ### Technical Analysis The polling request places the API key in the URL query string. Although HTTPS protects the URL in transit from ordinary network interception, the full URL can still be exposed through process inspection, shell or diagnostic output, proxy logs, API gateway logs, server access logs, monitoring products, and observability systems. Query parameters are generally treated as request-identifying metadata rather than secrets and commonly receive broader retention and visibility than authorization headers. ### Attack Path 1. A legitimate user runs `generate.sh` with an API key. 2. The script constructs a polling URL containing `key=$KEY`. 3. The URL becomes visible to a process monitor, privileged local observer, proxy, server logger, or monitoring platform. 4. An attacker with access to one of those records extracts the key. 5. The attacker reuses the credential to issue unauthorized API requests. ### Impact Assessment Successful exploitation grants the attacker the API permissions associated with the disclosed key. Potential consequences include unauthorized image generation, quota consumption, unexpected charges, and service disruption. Local process inspection ordinarily requires an account or monitoring capability able to observe the process; server- and proxy-side exposure depends on their logging configurations. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.sh:44
Finding

JSON Injection Through Unescaped User-Controlled Values

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.sh:87
Finding

Unvalidated Provider-Controlled Result URL Is Followed and Downloaded

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation instructs users to send prompts, reference image URLs, and API credentials to a third-party API but does not clearly warn about that data transfer. Because prompts and reference URLs may contain sensitive personal, proprietary, or regulated content, the lack of disclosure undermines informed consent and can lead to unintended data exposure.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The helper command fetches an untrusted URL directly to disk with redirect following and no host validation. In this skill context, returned image URLs are expected, but the absence of allowlisting or verification makes the download step more dangerous because it bridges trusted automation with untrusted network input.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

3. Download Image

bash
curl -sL "<RESULT_URL>" -o output.png

Typical resolution: 1672×941 (the API output is fixed at this resolution regardless of the size parameter; use the size parameter mainly for aspect ratio hints).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The helper command fetches an untrusted URL directly to disk with redirect following and no host validation. In this skill context, returned image URLs are expected, but the absence of allowlisting or verification makes the download step more dangerous because it bridges trusted automation with untrusted network input.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

3. Download Image

bash
curl -sL "<RESULT_URL>" -o output.png

Typical resolution: 1672x941 (the API output is fixed at this resolution regardless of the size parameter; use the size parameter mainly for aspect ratio hints).

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill documents shell-based behavior and a helper script but does not declare any tool scope or allowed-tools constraints. This increases the chance an agent may invoke shell/network capabilities more broadly than intended, reducing policy enforcement and making misuse or accidental execution easier.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says to use the skill whenever the user wants image generation and especially when they mention a specific API key or domain, which is an overly broad trigger. Broad activation conditions can cause the skill to engage in contexts where users did not explicitly consent to using this third-party service or exposing related secrets.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
| Action | Method | URL |
|--------|--------|-----|
| Submit task | POST | `https://api.wuyinkeji.com/api/async/image_gpt` |
| Query result | GET | `https://api.wuyinkeji.com/api/async/detail?id=<task_id>&key=<key>` |

## Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
| Action | Method | URL |
|--------|--------|-----|
| Submit task | POST | `https://api.wuyinkeji.com/api/async/image_gpt` |
| Query result | GET | `https://api.wuyinkeji.com/api/async/detail?id=<task_id>&key=<key>` |

## Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The POST example shows active external transmission to the WuyinKeji API. While aligned with the skill's purpose, it still creates a real exposure path for prompts, reference URLs, and credentials, especially since the API key is included in multiple places.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Request

bash
curl -s -X POST "https://api.wuyinkeji.com/api/async/image_gpt" \
  -H "Content-Type: application/json" \
  -H "Authorization: <API_KEY>" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The POST example shows active external transmission to the WuyinKeji API. While aligned with the skill's purpose, it still creates a real exposure path for prompts, reference URLs, and credentials, especially since the API key is included in multiple places.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Request

bash
curl -s -X POST "https://api.wuyinkeji.com/api/async/image_gpt" \
  -H "Content-Type: application/json" \
  -H "Authorization: <API_KEY>" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The polling request places the API key in the URL query string, which is more easily exposed via logs, browser history, proxies, and monitoring systems than header-based authentication. Even if this matches the vendor API, query-parameter secrets materially increase credential leakage risk.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

2. Query Result (Polling)

bash
curl -s "https://api.wuyinkeji.com/api/async/detail?id=<TASK_ID>&key=<API_KEY>"

Response Fields

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.sh (reported line 61)May include surrounding context.

sh
JSON_BODY+="}"

RESPONSE=$(curl -s -X POST "$API_BASE/api/async/image_gpt" \
    -H "Content-Type: application/json" \
    -H "Authorization: $KEY" \
    -d "$JSON_BODY")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script sends the API key in the URL query string when polling task status (?id=$TASK_ID&key=$KEY). Query parameters are commonly exposed in shell history, process listings, proxy logs, web server logs, monitoring tools, and crash reports, which increases the chance of credential leakage even over HTTPS. In this skill context, handling a real third-party API key is central to the tool, so leaking it is materially dangerous rather than theoretical.

Content

No source excerpt is available for this finding.