SiliconFlow 多模态服务，支持图片生成(FLUX/Qwen)、视频生成(Wan)、TTS语音合成、ASR语音识别。使用代金券支付。

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:11 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed SiliconFlow media helper that sends user-provided prompts or media to the advertised third-party API and saves returned outputs locally.

Install only if you are comfortable sending prompts and selected audio/images/video inputs to SiliconFlow using your SILICONFLOW_API_KEY. Prefer running it in a constrained environment, avoid sensitive or regulated media unless approved, and consider pinning dependencies or using a reviewed lockfile before regular use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: scripts/image_gen.py:2

Finding

Unpinned Runtime Dependencies in Image Generation Script

Content

View full analysis

Vulnerability Details

File Location: scripts/image_gen.py:2-7
Vulnerability Type: Unpinned third-party runtime dependencies
Risk Level: Medium

Vulnerable Code:

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2.28.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The script declares requests and pillow with lower-bound constraints but no exact versions or integrity hashes. The documented uv run execution model may therefore resolve and install future package releases that were not reviewed with the Skill.

No malicious package name, alternate package source, or dependency confusion attempt was observed. This is nevertheless a supply-chain weakness: compromise of a legitimate package release, package registry, or dependency resolution environment could cause attacker-controlled code to execute during installation or import.

Attack Path

1. An attacker compromises a permitted future release of requests, pillow, or a transitive dependency, or influences the configured package registry.
2. A user invokes image_gen.py through the documented uv run command in an environment without a trusted lockfile.
3. The resolver selects the compromised version because it satisfies the lower-bound constraint.
4. Malicious installation or import-time code executes with the privileges of the user running the Skill.
5. The malicious dependency can access process environment variables, including SILICONFLOW_API_KEY, user-supplied prompts, generated media, and files accessible to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The resulting access is bounded by that user's operating-system permissions but may include the SiliconFlow API key, submitted prompts, generated images, writable output paths, and other locally readable files.

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to an exact, reviewed version.
• Commit and enforce a uv lockfile that also fixes transitive dependency versions.
• Verify downloaded distributions using trusted hashes where supported.
• Restrict dependency resolution to an approved package index.
• Perform dependency updates through a reviewed process with vulnerability and provenance checks.
• Run the script with only the filesystem and environment access required for image generation.

T08 · Insecure Dependencies

Warning

• Location: scripts/video_gen.py:2

Finding

Unpinned Runtime Dependency in Video Generation Script

Content

View full analysis

Vulnerability Details

File Location: scripts/video_gen.py:2-6
Vulnerability Type: Unpinned third-party runtime dependency
Risk Level: Medium

Vulnerable Code:

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2.28.0",
# ]
# ///

Technical Analysis

The requests dependency is constrained only by a minimum version. Running the script through the documented uv run workflow can resolve a later, unreviewed release without a lockfile or integrity pin.

No evidence of a malicious dependency, unsafe custom index, or remote executable payload was found. The risk arises if a legitimate package release, transitive dependency, registry, or resolution environment is compromised.

The base64 operation in this script is not itself a vulnerability. It encodes the explicitly selected input image for transmission to the declared SiliconFlow image-to-video service and does not conceal an unrelated data flow.

Attack Path

1. An attacker compromises a future compatible release of requests, one of its transitive dependencies, or the dependency source used by the local environment.
2. A user starts video_gen.py with uv run without an enforced trusted lockfile.
3. The compromised package is selected because it satisfies requests>=2.28.0.
4. Attacker-controlled installation or import code executes as the invoking user.
5. The code can read SILICONFLOW_API_KEY, prompts, the selected source image, generated video data, and other resources available to the process.

Impact Assessment

Exploitation could lead to arbitrary code execution with the invoking user's privileges. Sensitive assets exposed to that process may include the SiliconFlow API credential and private images intentionally supplied for video generation. No privilege-escalation mechanism beyond the invoking user's existing permissions was identified.

Remediation

View remediation

Remediation Suggestions

• Replace the lower-bound dependency declaration with an exact reviewed version.
• Commit and enforce a lockfile covering all transitive dependencies.
• Use package hashes or equivalent integrity verification.
• Resolve packages only from an approved, authenticated registry.
• Review and test dependency updates before deployment.
• Isolate execution and expose only the API key and input files required for the requested video operation.

T08 · Insecure Dependencies

Warning

• Location: scripts/tts.py:2

Finding

Unpinned Runtime Dependency in Text-to-Speech Script

Content

View full analysis

Vulnerability Details

File Location: scripts/tts.py:2-6
Vulnerability Type: Unpinned third-party runtime dependency
Risk Level: Medium

Vulnerable Code:

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2.28.0",
# ]
# ///

Technical Analysis

The script permits any requests release at or above version 2.28.0. In the documented dynamic uv run workflow, future package versions may be downloaded and executed without being reviewed as part of this Skill.

The package name is legitimate, and the audit found no malicious source configuration or intentionally deceptive dependency. The security concern is the absence of deterministic version and integrity controls, which increases exposure to compromised releases and package-registry attacks.

Attack Path

1. A compatible requests release, transitive dependency, or configured registry is compromised.
2. A user invokes tts.py through uv run without a trusted lockfile.
3. Dependency resolution selects the compromised artifact under the >=2.28.0 constraint.
4. Malicious installation or import-time code runs with the user's privileges.
5. The attacker can access the SiliconFlow API key, synthesis text, generated audio, and other process-accessible data.

Impact Assessment

Successful exploitation could result in arbitrary code execution as the invoking user. It could expose the API credential and potentially sensitive text submitted for speech synthesis. Access to other local resources would be limited only by the user's filesystem and operating-system permissions.

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive packages to exact reviewed versions.
• Maintain an enforced lockfile and update it only through code review.
• Add package integrity verification using hashes or trusted attestations.
• Restrict package installation to an approved index.
• Scan dependency updates for known vulnerabilities and unexpected ownership or provenance changes.
• Execute TTS processing in a constrained environment that contains only the required API credential and output access.

T08 · Insecure Dependencies

Warning

• Location: scripts/asr.py:2

Finding

Unpinned Runtime Dependency in Speech Recognition Script

Content

View full analysis

Vulnerability Details

File Location: scripts/asr.py:2-6
Vulnerability Type: Unpinned third-party runtime dependency
Risk Level: Medium

Vulnerable Code:

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2.28.0",
# ]
# ///

Technical Analysis

The ASR script dynamically depends on any requests version satisfying a lower-bound constraint. Without a committed and enforced lockfile or artifact hashes, dependency resolution is not reproducible and can introduce code that was not present during the Skill audit.

No malicious dependency name, custom unsafe repository, or intentional code-execution channel was identified. Uploading the user-selected audio file to the declared SiliconFlow transcription endpoint is necessary for the advertised cloud ASR function. The confirmed issue is limited to dependency supply-chain hardening.

Attack Path

1. An attacker compromises a compatible requests release, transitive dependency, package registry, or local dependency-resolution configuration.
2. A user executes asr.py through the documented uv run mechanism without a trusted lockfile.
3. The resolver downloads the compromised artifact because it satisfies requests>=2.28.0.
4. Malicious package installation or import code executes with the invoking user's authority.
5. The malicious code can read the API key, uploaded audio, transcription results, and any other files or environment values accessible to the process.

Impact Assessment

Exploitation could permit arbitrary code execution as the invoking user and disclosure of the SiliconFlow credential or sensitive speech recordings. It does not inherently provide elevated system privileges, but it inherits all permissions and accessible resources of the user running the Skill.

Remediation

View remediation

Remediation Suggestions

• Pin the direct dependency to an exact reviewed version.
• Generate, commit, and enforce a lockfile for direct and transitive packages.
• Require integrity hashes or trusted package attestations.
• Use only an approved package registry and prevent untrusted index overrides.
• Review dependency changes and scan them for vulnerabilities before release.
• Limit runtime access to the selected audio file and required API credential, preferably using process or container isolation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code is narrowly focused on image generation. It defines image model mappings, calls the SiliconFlow image generation endpoint, downloads the generated image, and writes it to disk. This aligns with the image-generation portion of the description, but the broader declared description claims additional multimodal capabilities—video generation, TTS, ASR, and voucher-based payment—that are absent from the provided code. Because the declared description materially overstates the capabilities represented by this code chunk, this is a description/behavior mismatch for the supplied chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code’s behavior is narrowly focused on video generation through SiliconFlow’s /v1/video/generations endpoint. It supports prompt-based video creation and optional image-to-video by base64-encoding an input image, polling asynchronous job status, and downloading the resulting video. This aligns with only one portion of the declared description: Wan video generation. The broader declared description claims a multimodal service covering image generation, TTS, ASR, and voucher payment, none of which appear in the supplied code. There is no evidence of undeclared malicious behavior or inconsistent resource access beyond normal API usage, but the description overstates the implemented capabilities of this code chunk enough to count as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares access to an API key and clearly instructs running scripts that contact an external service, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization and review gap: the skill can use environment secrets and network access without transparent least-privilege constraints, making misuse or accidental overreach harder to detect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to send prompts, images, audio, and other media to a third-party AI service but gives no privacy or data-handling warning. Users may unknowingly transmit sensitive content, credentials embedded in media, personal data, or regulated information to an external provider, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'image_url' from requests.post (line 78, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 87% confidence

Finding

The code trusts a URL returned by the upstream API and immediately fetches it with requests.get, creating an SSRF-style tainted network-to-network flow. If the API response is compromised or unexpected, the script could be induced to contact arbitrary hosts, including internal services or attacker-controlled endpoints, and then parse untrusted image content.

Content

Scanner excerpt · scripts/image_gen.py (reported line 81)May include surrounding context.

python

image_url = data["images"][0]["url"]
            
            print(f"📥 Downloading image...")
            img_response = requests.get(image_url, timeout=60)
            img_response.raise_for_status()
            
            image = PILImage.open(BytesIO(img_response.content))

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/asr.py (reported line 27)May include surrounding context.

python

import requests


SILICONFLOW_URL = "https://api.siliconflow.cn/v1/audio/speech"

MODELS = {
    "fish-speech": "fishaudio/fish-speech-1.5",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image_gen.py (reported line 32)May include surrounding context.

python

import requests


SILICONFLOW_URL = "https://api.siliconflow.cn/v1/audio/speech"

MODELS = {
    "fish-speech": "fishaudio/fish-speech-1.5",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 27)May include surrounding context.

python

import requests


SILICONFLOW_URL = "https://api.siliconflow.cn/v1/audio/speech"

MODELS = {
    "fish-speech": "fishaudio/fish-speech-1.5",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/video_gen.py (reported line 33)May include surrounding context.

python

import requests


SILICONFLOW_URL = "https://api.siliconflow.cn/v1/audio/speech"

MODELS = {
    "fish-speech": "fishaudio/fish-speech-1.5",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/video_gen.py (reported line 106)May include surrounding context.

python

import requests


SILICONFLOW_URL = "https://api.siliconflow.cn/v1/audio/speech"

MODELS = {
    "fish-speech": "fishaudio/fish-speech-1.5",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image_gen.py (reported line 72)May include surrounding context.

python

print(f"🎤 Synthesizing speech with {model_id}...")
    
    try:
        response = requests.post(SILICONFLOW_URL, json=payload, headers=headers, timeout=120)
        response.raise_for_status()
        
        with open(output_path, "wb") as f:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 70)May include surrounding context.

python

print(f"🎤 Synthesizing speech with {model_id}...")
    
    try:
        response = requests.post(SILICONFLOW_URL, json=payload, headers=headers, timeout=120)
        response.raise_for_status()
        
        with open(output_path, "wb") as f:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/video_gen.py (reported line 79)May include surrounding context.

python

print(f"🎤 Synthesizing speech with {model_id}...")
    
    try:
        response = requests.post(SILICONFLOW_URL, json=payload, headers=headers, timeout=120)
        response.raise_for_status()
        
        with open(output_path, "wb") as f:

Tainted flow: 'video_url' from requests.post (line 86, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 93% confidence

Finding

The script takes a video download URL from the remote API response and fetches it without validating the scheme, host, or destination. If the upstream service is compromised or returns attacker-controlled URLs, this can enable server-side request forgery behavior or unexpected outbound requests to internal or sensitive endpoints.

Content

Scanner excerpt · scripts/video_gen.py (reported line 89)May include surrounding context.

python

video_url = data["videos"][0].get("url")
            if video_url:
                print(f"📥 Downloading video...")
                video_response = requests.get(video_url, timeout=300)
                video_response.raise_for_status()
                
                with open(output_path, "wb") as f:

Tainted flow: 'status_url' from requests.post (line 106, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/video_gen.py (reported line 112)May include surrounding context.

python

while time.time() - start_time < max_wait:
                time.sleep(10)
                
                status_response = requests.get(status_url, headers=headers, timeout=30)
                status_response.raise_for_status()
                status_data = status_response.json()

Tainted flow: 'video_url' from requests.get (line 121, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 93% confidence

Finding

As with the direct-response path, the script trusts a remotely supplied video URL from the task status response and downloads it without origin validation. A malicious or compromised service could cause the client to retrieve arbitrary URLs, potentially exposing internal services or causing unexpected data egress.

Content

Scanner excerpt · scripts/video_gen.py (reported line 124)May include surrounding context.

python

video_url = status_data["videos"][0].get("url")
                    if video_url:
                        print(f"📥 Downloading video...")
                        video_response = requests.get(video_url, timeout=300)
                        video_response.raise_for_status()
                        
                        with open(output_path, "wb") as f:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The docstring includes Chinese-language parameter examples such as '要合成的文字' and '你好世界', which can signal a locale preference in the user-facing usage text. Because the file does not explain whether the tool is language-agnostic or offer an explicit language/locale choice, this may conflict with language-neutral policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.