ClawHub
Back to skill

Security audit

seedream-img-gen

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it handles an API key unsafely by telling users to print it in the terminal.

Review before installing. Use a dedicated, low-privilege Volcengine API key, do not run the documented `echo $ARK_API_KEY` check, avoid putting secrets or sensitive personal data in prompts, and install dependencies in a virtual environment. Treat generated image URLs and downloaded files as external-provider content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

API Key Disclosed Through Terminal and Log Output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:25
Finding

Unpinned Third-Party Runtime Dependencies

Content
View full analysis
Remediation
View remediation
\ --hash=sha256: volcengine-python-sdk[ark]== \ --hash=sha256: ``` ]]>

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_image.py:87
Finding

API-Provided URL Downloaded Without Scheme or Destination Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs the agent to read an environment variable and make outbound network calls to the Volcengine API, but the manifest does not declare any explicit tool scope or permissions. This creates a mismatch between documented behavior and declared capabilities, increasing the chance of unintended tool access or overly broad execution in environments that rely on manifest scoping for enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description is broad enough to match generic image-generation requests, not just requests explicitly intended for Seedream or Volcengine. Over-broad activation can route unrelated prompts into a skill that reads API-key-related environment state and performs network actions, causing unintended external calls, privacy issues, or incorrect tool selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document instructs users to authenticate with an API key and send prompts or images to a remote third-party service, but it provides no warning about safeguarding credentials, limiting key scope, or the privacy implications of transmitting user-supplied content off-platform. In a skill specifically designed to generate images through an external API, this omission can lead to accidental disclosure of secrets or sensitive prompts/images by users or downstream agents.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 111)May include surrounding context.

print(resp.data[0].url)

text

### cURL
```bash
curl -X POST "https://ark.cn-beijing.volces.com/api/v3/images/generations" \
  -H "Content-Type: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script sends the user-supplied prompt to Volcengine's remote image generation API, but it does not clearly warn users that prompt contents leave the local environment. If users include sensitive data in prompts, that information may be disclosed to a third-party service and logged or retained externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

In OpenAI-compatible mode, the script sends prompt text to a remote Volcengine endpoint via the OpenAI client without an explicit disclosure warning. This can expose confidential or personal information embedded in prompts to an external provider, which is a meaningful privacy and data-handling risk in agent workflows.

Content

No source excerpt is available for this finding.

Tainted flow: 'save_to' from os.environ.get (line 110, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate_image.py (reported line 115)May include surrounding context.

python
timestamp = int(time.time())
                save_to = f"seedream_output_{timestamp}_{i+1}.png"

            with open(save_to, "wb") as f:
                f.write(base64.b64decode(b64_data))
            saved_files.append(save_to)
            print(f"✅ 已保存: {save_to}")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description is written only in Chinese and presents the skill's functionality in a single language, with no indication that users can choose another language or that the skill is intended only for a Chinese-language environment. This may violate a language/locale policy if organizational standards require user choice or explicit justification for locale restrictions.

Content

No source excerpt is available for this finding.