ClawHub
Back to skill

Security audit

modelscope-image

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to generate images through ModelScope as advertised, but it handles API keys and downloads provider-supplied URLs with insufficient safeguards.

Review before installing. Use an environment variable or secret manager for MODELSCOPE_API_KEY, avoid the --api-key command-line option, do not send sensitive or confidential prompts, and prefer running it in an environment where outbound network access and output size are constrained.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gen.py:378
Finding

API Token Exposure Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gen.py:457
Finding

Unrestricted Retrieval of API-Controlled Image URLs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Tainted flow: 'req' from os.environ.get (line 220, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gen.py (reported line 230)May include surrounding context.

python
)
        
        try:
            with urllib.request.urlopen(req, timeout=30) as resp:
                result = json.loads(resp.read().decode("utf-8"))
                
                task_status = result.get("task_status", "")

Tainted flow: 'req' from os.environ.get (line 220, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gen.py (reported line 292)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req, timeout=300) as resp:
            response = json.loads(resp.read().decode("utf-8"))
            
            # 检查是否为异步任务

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill invokes a Python script that reads environment variables, reads local reference files, writes output files, and makes outbound network requests, but the manifest does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it harder for a host agent or reviewer to understand and constrain what the skill is permitted to access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

L003 明确写明“根据用户需求由 AI 生成专业的提示词”，并将技能定位为“中文 AI 模型生成图片”场景；结合全文示例和长度规则均以中文提示词为默认，没有说明用户可选择英文或其他语言。若无用户明确同意或业务上的区域限定，这属于语言/locale 强制约束。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill states it will generate prompts and call an external API, which means user-supplied content may be transmitted to a third party, yet it does not clearly warn users about that transfer at the point the workflow is introduced. In a skill that may process creative requests containing personal or sensitive details, lack of explicit disclosure can lead to unintended privacy exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

L033-L037 的“当出现以下情况时使用本技能”包含“用户需要专业优化的提示词来生成高质量图片”等宽泛条件，未明确限定必须是 ModelScope/魔搭社区相关请求时才触发。对于清单中第三条，这可能与大量普通文生图或提示词优化场景重叠，导致技能被过度调用。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document instructs users to place a bearer API token into requests sent to an external service, but it does not explicitly warn that this transmits credentials off-platform or advise safe secret handling. In an agent skill context, users may not realize the token is sensitive operational data, increasing the risk of accidental disclosure through logs, screenshots, copied commands, or misuse in untrusted environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

文档在 L007-L016 明确声明正确端点为 https://api-inference.modelscope.cn/v1/images/generations，但后续 Python、cURL、urllib 示例在 L196、L216、L233 使用了 https://api-inference.modelscope.cn/api/v1/images/generations。这不是单纯的信息遗漏，而是文档内部对同一关键调用目标给出了互相冲突的指导，可能直接导致实现者调用错误接口。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This example performs an outbound HTTP request to a remote service using a bearer token. In the context of an agent skill, external transmission is security-relevant because prompts and credentials may leave the local environment, and without prominent disclosure users may unknowingly send sensitive data to a third party.

Content

Scanner excerpt · references/api_reference.md (reported line 208)May include surrounding context.

"size": "1024x1024" }

response = requests.post(url, headers=headers, json=data) result = response.json() print(result)

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The cURL example shows direct transmission of a bearer token to a third-party endpoint from a shell command, which is prone to accidental disclosure through shell history, process inspection, screenshots, or copied terminal output. In a skill meant to guide users, this is dangerous if presented without warnings or safer secret-handling practices.

Content

Scanner excerpt · references/api_reference.md (reported line 213)May include surrounding context.

print(result)

text

### cURL 示例

```bash
curl -X POST https://api-inference.modelscope.cn/api/v1/images/generations \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The retry example repeatedly sends requests to an external service and may retransmit prompt content and credentials multiple times. In an agent setting, repeated external transmission amplifies privacy and operational risk, especially if prompts contain confidential data or if retries are not clearly disclosed to the user.

Content

Scanner excerpt · references/api_reference.md (reported line 314)May include surrounding context.

md
def call_api_with_retry(prompt, max_retries=3):
    for attempt in range(max_retries):
        try:
            response = requests.post(url, headers=headers, json=data)
            if response.status_code == 200:
                return response.json()
            elif response.status_code == 429:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file presents all instructions and model-selection guidance only in Chinese, including the usage note and headings. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can exclude users who do not read that language, and the file does not state that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire guide is written in Chinese and presents itself as a general-purpose prompt guide, but it does not indicate that Chinese is optional, user-selected, or required for a specific regional compliance reason. This can violate language/locale policy when a skill implicitly constrains users to one language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

L197-L201 将提示词长度控制写成“中文 20-50 字”，呈现为默认且唯一的语言规范，没有提供英文等其他语言的可选规则。这会把技能行为绑定到单一语言习惯，缺少用户语言偏好选择。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The document explains how to supply an API key and use bearer authentication but does not explicitly warn against exposing the credential in logs, shell history, shared terminals, or generated artifacts. While this is common operational guidance, omitting credential-handling precautions increases the risk of accidental secret leakage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

All headings, instructions, and examples are presented in Chinese, which effectively imposes a specific language on users. The policy allows locale constraints only when users are given a choice or when the restriction is explicitly justified, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/api_reference.md:338