IMA AI Image Generator & Photo Generator — Poster, Thumbnail, Logo, Art, Illustration, Product & Social Media Graphic Design

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:50 AM UTC
• Version: 1.0.14

Overview

The skill is a real image generator, but it can expose API keys and image data through under-scoped network and troubleshooting behavior.

Install only if you trust IMA Studio and are comfortable sending prompts, selected local images, and your IMA_API_KEY to its services. Use a scoped or test key first, avoid custom IMA_BASE_URL or IMA_IM_BASE_URL values, do not upload sensitive local files, and do not follow the troubleshooting step that prints the full API key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ima_runtime/shared/client.py:16
• Finding: Bearer API Credential Can Be Redirected to an Arbitrary Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ima_runtime/cli_parser.py:36`, `scripts/ima_runtime/cli_flow.py:235-258`, `scripts/ima_runtime/shared/client.py:16-22, 84-91, 163-168, 190-195` **Vulnerability Type**: Credential disclosure through an unrestricted API endpoint **Risk Level**: High ### Vulnerable Code ```python # scripts/ima_runtime/cli_parser.py parser.add_argument("--base-url", default=DEFAULT_BASE_URL, help="API base URL") ``` ```python # scripts/ima_runtime/cli_flow.py def run_cli(args, logger) -> int: api_key = args.api_key or os.getenv("IMA_API_KEY") if not api_key: return _fail("API key is required. Use --api-key or set IMA_API_KEY.") # ... if args.list_models: try: tree = get_product_list( args.base_url, api_key, args.task_type, language=args.language, ) except Exception as exc: return _fail(str(exc)) ``` ```python # scripts/ima_runtime/shared/client.py def make_headers(api_key: str, language: str = "en") -> dict: return { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "x-app-source": "ima_skills", "x_app_language": language, } ``` ```python def get_product_list( base_url: str, api_key: str, category: str, app: str = "ima", platform: str = "web", language: str = "en", ) -> list: response = requests.get( f"{base_url}/open/v1/product/list", params={"app": app, "platform": platform, "category": category}, headers=make_headers(api_key, language), timeout=30, ) ``` ```python response = requests.post( f"{base_url}/open/v1/tasks/create", json=payload, headers=make_headers(api_key), timeout=30, ) ``` ```python response = requests.post( f"{base_url}/open/v1/tasks/detail", json={"task_id": task_id}, headers=make_headers(api_key), ...[truncated 2013 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Allowlist the production API origin, including the exact scheme, hostname, and permitted port: - Scheme: `https` - Host: `api.imastudio.com` - Port: default HTTPS port only 2. Reject URL user information, fragments, non-HTTPS schemes, IP-literal hosts, and unexpected ports. 3. Disable custom base URLs in normal operation. 4. If custom endpoints are required for development, place them behind an explicit option such as `--allow-unsafe-development-endpoint`. 5. Never forward a production API key to a custom endpoint. Require a separate development credential. 6. Disable redirects for authenticated API requests, or validate the destination of every redirect before retaining the authorization header. 7. Ignore `IMA_BASE_URL` in privileged or automated production execution unless it passes the same validation. 8. Add tests confirming that bearer credentials are never sent to unapproved origins. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ima_runtime/shared/inputs.py:33
• Finding: Server-Controlled Upload URL Can Exfiltrate Local File Contents<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ima_runtime/shared/inputs.py:33-56`, `scripts/ima_runtime/shared/client.py:72-75` **Vulnerability Type**: Unvalidated upload destination and insufficient local-file validation **Risk Level**: Medium ### Vulnerable Code ```python # scripts/ima_runtime/shared/inputs.py def prepare_image_url( source: str | bytes, api_key: str, im_base_url: str = DEFAULT_IM_BASE_URL, ) -> str: if isinstance(source, str) and source.startswith("https://"): logger.info("Using URL directly: %s", source[:50]) return source if not api_key: raise RuntimeError("Local image upload requires IMA API key (--api-key)") if isinstance(source, str): if not os.path.isfile(source): raise RuntimeError(f"Image file not found: {source}") ext = Path(source).suffix.lstrip(".").lower() or "jpeg" with open(source, "rb") as handle: image_bytes = handle.read() content_type = mimetypes.guess_type(source)[0] or "image/jpeg" else: image_bytes = source ext = "jpeg" content_type = "image/jpeg" token_data = get_upload_token(api_key, ext, content_type, im_base_url) ful = token_data.get("ful") fdl = token_data.get("fdl") if not ful or not fdl: raise RuntimeError("Upload token missing 'ful' or 'fdl' field") upload_to_oss(image_bytes, content_type, ful) return fdl ``` ```python # scripts/ima_runtime/shared/client.py def upload_to_oss(image_bytes: bytes, content_type: str, ful: str) -> None: response = requests.put( ful, data=image_bytes, headers={"Content-Type": content_type}, timeout=60, ) response.raise_for_status() ``` ### Technical Analysis The upload-token service controls the `ful` destination used for uploading the complete local file. The runtime does not validate the URL scheme, hostname, port, resolved address, or redirects before send ...[truncated 1684 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Allowlist the exact HTTPS object-storage domains authorized by IMA Studio. 2. Reject non-HTTPS destinations, URL user information, unexpected ports, IP-literal hosts, and unapproved domains. 3. Disable redirects for uploads, or validate every redirect destination before sending any bytes. 4. Resolve the destination hostname and reject loopback, private, link-local, multicast, and reserved addresses. 5. Validate image signatures rather than relying on filename extensions or MIME guesses. 6. Enforce a strict maximum file size before reading or uploading the file. 7. Stream uploads in bounded chunks instead of loading the entire file into memory. 8. Require explicit confirmation showing the canonical local path and destination host before uploading a local file. 9. Restrict or remove `IMA_IM_BASE_URL` in production. If retained for testing, require a separate non-production credential and an explicit unsafe-development flag. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ima_runtime/shared/output_validation.py:105
• Finding: Server-Supplied Output URL Enables SSRF and Unbounded Response Download<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ima_runtime/shared/client.py:207-212`, `scripts/ima_runtime/shared/output_validation.py:105-108, 125` **Vulnerability Type**: Server-side request forgery and resource exhaustion **Risk Level**: High ### Vulnerable Code ```python # scripts/ima_runtime/shared/client.py if medias and all( (0 if media.get("resource_status") in (None, "") else int(media.get("resource_status"))) == 1 for media in medias ): first_media = medias[0] result_url = first_media.get("url") or first_media.get("watermark_url") if result_url: return first_media ``` ```python # scripts/ima_runtime/shared/output_validation.py def fetch_image_dimensions(url: str, timeout: int = 30) -> tuple[int, int]: response = requests.get(url, timeout=timeout) response.raise_for_status() data = response.content for parser in (_parse_png_dims, _parse_jpeg_dims, _parse_webp_dims): dims = parser(data) if dims is not None: return dims raise RuntimeError( "Unable to determine output image dimensions for validation." ) ``` ```python def validate_output_constraints( url: str, raw_params: dict[str, Any], effective_params: dict[str, Any], ) -> None: # ... width, height = fetch_image_dimensions(url) ``` ### Technical Analysis When output size or aspect-ratio constraints require validation, the runtime fetches the media URL returned by the remote task API. That URL is treated as trusted even though no scheme, hostname, resolved address, port, or redirect validation is performed. A malicious or compromised API can return a URL targeting loopback services, private network hosts, link-local metadata services, or other destinations reachable from the Agent host. The request library follows redirects by default, creating an additional route to otherwise blocked destinations unless each redirect is revalidated. The complete response is accessed through ...[truncated 1635 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Allowlist approved HTTPS media and object-storage origins. 2. Reject HTTP and all non-HTTPS schemes. 3. Resolve destination hostnames before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved address ranges for both IPv4 and IPv6. 4. Disable redirects. If redirects are operationally required, revalidate the scheme, hostname, port, and resolved addresses at every hop. 5. Use streaming requests and stop after a small, explicit byte limit sufficient to parse image headers. 6. Validate `Content-Type` and `Content-Length`, while retaining a streamed hard limit because headers are not trustworthy. 7. Avoid fetching the complete generated image merely to determine dimensions. Prefer dimensions returned in signed API metadata where available. 8. Add tests covering direct private addresses, DNS rebinding, IPv6 loopback, encoded IP representations, and redirects to private destinations. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4
• Finding: Runtime Bootstrap Installs a Broadly Ranged and Unhashed Dependency<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:4`, `scripts/ima_runtime/setup.py:34-38` **Vulnerability Type**: Non-reproducible and insufficiently verified dependency installation **Risk Level**: Medium ### Vulnerable Code ```text # requirements.txt requests>=2.25.0 ``` ```python # scripts/ima_runtime/setup.py def _install_requirements() -> None: subprocess.run( [ sys.executable, "-m", "pip", "install", "-r", str(REQUIREMENTS_PATH), ], check=True, ) ``` ### Technical Analysis The documented setup path invokes pip against the active package index. The dependency has only a minimum version and does not specify an exact audited release, upper bound, artifact hash, trusted index, or isolated environment. This is not shell injection because the subprocess uses a fixed argument list. The risk is supply-chain mutability: different installations may resolve different package versions and artifacts. Pip configuration inherited from the environment may also point to an unintended or compromised index. Package installation can execute package build and installation behavior with the privileges of the invoking user. The broad version range means future releases are accepted without review. ### Attack Path 1. A user follows the documented setup process and runs `python3 scripts/ima_runtime_setup.py --install`. 2. The setup script invokes pip using the current environment and configured indexes. 3. Pip resolves any available `requests` version satisfying `>=2.25.0`. 4. A compromised index, altered pip configuration, malicious artifact, or compromised future release is selected. 5. Installation or later import executes code from the unreviewed dependency in the context of the invoking user. ### Impact Assessment If dependency resolution is compromised, attacker-controlled package code can execute with the privileges of the user running se ...[truncated 364 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `requests` to an exact reviewed version. 2. Generate and verify cryptographic hashes for all direct and transitive dependencies. 3. Install with `pip --require-hashes`. 4. Use a lock file generated through a reproducible dependency-management process. 5. Document and enforce the trusted package index. 6. Avoid inheriting arbitrary user-controlled pip configuration in automated setup. 7. Install dependencies inside a dedicated virtual environment rather than the invoking interpreter's global environment. 8. Add automated dependency scanning and a controlled process for reviewing and updating pins. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ima_runtime/shared/config.py:43
• Finding: Hardcoded Application Credential and User API Key Included in Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ima_runtime/shared/config.py:43-44`, `scripts/ima_runtime/shared/client.py:27-31, 51-64` **Vulnerability Type**: Hardcoded credential and sensitive data exposure through URLs **Risk Level**: Medium ### Vulnerable Code ```python # scripts/ima_runtime/shared/config.py APP_ID = "webAgent" APP_KEY = "32jdskjdk320eew" ``` ```python # scripts/ima_runtime/shared/client.py def _gen_sign() -> tuple[str, str, str]: nonce = uuid.uuid4().hex[:21] ts = str(int(time.time())) raw = f"{APP_ID}|{APP_KEY}|{ts}|{nonce}" sign = hashlib.sha1(raw.encode()).hexdigest().upper() return sign, ts, nonce ``` ```python def get_upload_token( api_key: str, suffix: str, content_type: str, im_base_url: str = DEFAULT_IM_BASE_URL, ) -> dict: sign, ts, nonce = _gen_sign() response = requests.get( f"{im_base_url}/api/rest/oss/getuploadtoken", params={ "appUid": api_key, "appId": APP_ID, "appKey": APP_KEY, "cmimToken": api_key, "sign": sign, "timestamp": ts, "nonce": nonce, "fService": "privite", "fType": "picture", "fSuffix": suffix, "fContentType": content_type, }, timeout=30, ) ``` ### Technical Analysis The application key is embedded directly in distributed source code and participates in the upload-token signature. Any party with access to the Skill package can recover it, so it cannot provide meaningful secrecy as a shared client credential. The user's `IMA_API_KEY` is placed in the URL query twice, as `appUid` and `cmimToken`. Query strings are commonly recorded by reverse proxies, application servers, observability systems, load balancers, browser-like diagnostics, and access logs. TLS protects the URL while in transit but does not prevent endpoint and intermediary logging. Using SHA-1 for the signature also prov ...[truncated 1161 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place user credentials in URL query parameters. 2. Send the user token through a standard authorization header or an encrypted request body accepted only over HTTPS. 3. Ensure proxy, application, and observability logs redact authorization data and sensitive request fields. 4. If `APP_KEY` is intended to be secret, remove it from the client and perform signing on a trusted server. 5. If it is merely a public client identifier, rename and document it accordingly rather than treating it as a security secret. 6. Rotate the exposed application credential after redesigning the authentication flow. 7. Replace SHA-1 with a modern message authentication construction such as HMAC-SHA-256, using a secret held only by a trusted server. 8. Avoid duplicating the same user credential across multiple request fields. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This code chunk does not perform any image generation, image transformation, API calls, catalog/runtime interaction, setup, or doctor functionality described in the declaration. Its primary purpose is unrelated support infrastructure for logging. While logging can be a supporting detail in a larger image skill, the evaluation is for whether this supplied code chunk matches the declared description; here, the behavior is materially different. It also accesses the local filesystem to create, rotate, and delete log files, which is not suggested by the declared purpose. Therefore this chunk is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose describes a substantial image-processing/runtime integration capability. The actual code chunk is a minimal __init__.py containing only the docstring 'CLI presentation helpers.' Based on the provided code alone, its primary purpose is unrelated to image generation or transformation, and none of the declared capabilities are implemented or indicated. This is a material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Yes, this is a mismatch. The declared description promises a substantive image-processing/runtime skill, but the provided code chunk is only an empty package initializer with the docstring 'Capability namespace.' It does not demonstrate any of the claimed functionality, resource access, triggers, or runtime behavior. Because the actual code has no meaningful implemented behavior related to the declared purpose, the description does not accurately represent this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Yes, this is a mismatch for the supplied code chunk. The description claims a substantial image-processing capability built on the IMA Open API and associated runtime behaviors, but the actual file is only an empty package initializer with a docstring. There is no code here that performs any of the declared functions, accesses APIs, handles images, or wires runtime features. Because the evaluation compares the description to this supplied chunk specifically, the description materially overstates what the code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description frames the skill as something to use for actual image generation or transformation through the IMA Open API. However, this specific code chunk only implements setup and validation logic: argument parsing, dependency detection, optional `pip install -r requirements.txt`, diagnostics collection, API-key presence handling, and report output. While this may support the broader image runtime mentioned in the description, the code’s primary purpose is materially different from the declared operational purpose. The setup/doctor aspect is mentioned in the description, but the description still presents the skill as an image-generation/transformation capability; this chunk itself does not execute those capabilities, access image inputs, or call generation endpoints. Therefore this is a meaningful description-versus-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The description presents a broad image runtime with multiple generation/transformation modes and repo-aware operational behavior. This code does not implement runtime behavior; it is only a configuration module. Within that module, the explicitly supported task types are just text_to_image and image_to_image, so the declared capabilities of style transfer and reference-image continuity are not substantiated here. The mention of setup, doctor, and live-catalog-aware runtime is also not represented. Additionally, the code includes hardcoded APP_ID and APP_KEY, which is an access-related detail absent from the description. While configuration files are supporting details, the narrower task support and presence of embedded credentials make the declared purpose materially broader than what this code chunk actually shows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: There is a clear mismatch between the broad declared purpose and the provided code chunk. The code shown is merely an __init__.py file with a descriptive docstring about workflow seams for plan confirmation. Based on this chunk alone, it does not implement or evidence the declared image-related capabilities or the stated runtime integrations. Because the actual code behavior presented is materially different and far narrower than the declared purpose, this should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: There is a clear description-behavior mismatch. The declared purpose describes a substantial image-processing skill tied to the IMA Open API and runtime infrastructure. The actual code chunk is a trivial identity function over a workflow plan draft, likely related to confirmation/plan handling rather than image operations. It does not access image resources, call any API, transform data in an image-related way, or implement the described runtime features. Therefore the code's primary purpose is materially different from the declared description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description promises user-facing image generation/transformation behavior via the IMA Open API. However, this code only exposes a diagnostic 'doctor' command that likely validates runtime/environment configuration. Its primary purpose is operational health checking, not generating or transforming images. While 'doctor' is mentioned in the declared description as part of the setup/runtime, this specific chunk does not implement any of the advertised image capabilities, so the actual behavior is materially different from the declared purpose.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

# Catalog-Aware Dynamic Model Selection

## 1. Purpose

This document defines the formal model-selection contract for image generation requests in this repo.

The goal is to ensure that model choice is driven by:

1. user-specified constraints
2. live catalog capabilities
3. user intent semantics

Model selection must not depend on hardcoded parameter-to-model mappings in documentation or prompt templates.

## 2. Core Principle

The runtime must first determine what the user explicitly requires, then determine what the live catalog can actually support, and only then choose a model.

The live catalog is the capabilit

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Instruction Override

High

• Category: Prompt Injection

Content

- user preference must not override explicit incompatibility
- recommended defaults must not override explicit incompatibility
- semantic intent only ranks compatible candidates; it does not bypass constraints

## 7. Ranking Among Compatible Models

• Confidence: 90% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _run_cli_list_models_smoke(base_url: str, api_key: str, language: str) -> dict:
    entrypoint = Path(__file__).resolve().parents[1] / "ima_runtime_cli.py"
    env = os.environ.copy()
    env["IMA_API_KEY"] = api_key
    result = subprocess.run(
        [

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

for rule in credit_rules:
        attrs = {k.lower().strip(): _normalize_value(v) for k, v in (rule.get("attributes") or {}).items()}
        if all(normalized_user.get(k) == v for k, v in attrs.items()):
            return rule

    return credit_rules[0]

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The keyword block at this location contains extremely broad generic triggers such as 'AI image generator', 'image generator', and related phrases that are common across many ordinary user requests. This can cause the skill to activate in contexts where the user did not specifically intend to use this tool, leading to inappropriate tool routing, unnecessary API use, and possible exposure of user content to external image-generation services.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The Chinese description uses broad natural-language wording like '用中文描述即可生成...' that blurs whether the text is descriptive marketing copy or an invocation trigger. In multilingual environments, ambiguous trigger boundaries increase the chance that normal conversation about posters, product images, or social media graphics will spuriously invoke the skill and send prompts or images to the external service.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares powerful capabilities in metadata and instructions: environment secret use (IMA_API_KEY), filesystem write access under ~/.openclaw, network access to external domains, and shell execution via python3 entrypoints, but it does not define an explicit tool/permission scope. That creates an authorization ambiguity where an agent or reviewer cannot clearly constrain what the skill is allowed to do, increasing the chance of overbroad execution and secret exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The playbook instructs operators to run live smoke tests with a real API key and to submit prompts and image inputs to an external API, but it does not explicitly warn that test data will be transmitted to a third-party service. This creates a real risk of accidental disclosure of sensitive prompts, local images, or metadata during testing, especially in operational runbooks that may be followed mechanically.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The troubleshooting steps explicitly instruct users to print the full value of IMA_API_KEY to the terminal, which unnecessarily exposes a sensitive credential on screen and potentially in terminal recordings, scrollback buffers, shared sessions, or support logs. In this skill context, users are likely to follow copy-paste debugging steps, making accidental disclosure of a live API key more likely during troubleshooting.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown file includes recommendation text entirely in Chinese for default model guidance, while the surrounding policy is in English. That creates a language/locale policy concern because the file does not offer user opt-in, translation, or any justification that the skill is intentionally region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The model alias hints include Chinese trigger strings such as "香蕉" and "可梦", which create language-specific behavior in prompt parsing. There is no indication here that users can opt in to this locale-specific matching or choose language behavior, which may violate a language/locale policy requiring neutrality or user choice.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The clarification question and options are hard-coded in Chinese, which imposes a specific language on users without any visible opt-in or fallback. This is a natural-language policy concern because the file contains user-facing text but does not offer locale selection or document a justified region-specific constraint.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

entrypoint = Path(__file__).resolve().parents[1] / "ima_runtime_cli.py"
    env = os.environ.copy()
    env["IMA_API_KEY"] = api_key
    result = subprocess.run(
        [
            sys.executable,
            str(entrypoint),

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _install_requirements() -> None:
    subprocess.run(
        [sys.executable, "-m", "pip", "install", "-r", str(REQUIREMENTS_PATH)],
        check=True,
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

External Transmission

Medium

• Category: Data Exfiltration

Content

],
    }

    response = requests.post(
        f"{base_url}/open/v1/tasks/create",
        json=payload,
        headers=make_headers(api_key),

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

while True:
        if time.time() - start > max_wait:
            raise TimeoutError(f"Task {task_id} timed out after {max_wait}s. Check the IMA dashboard for status.")
        response = requests.post(
            f"{base_url}/open/v1/tasks/detail",
            json={"task_id": task_id},
            headers=make_headers(api_key),

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.