Security audit

glm-v-model

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Zhipu GLM vision API helper, but users should understand that supplied images, URLs, prompts, and an API key are used with an external provider.

Install only if you intend to use Zhipu's external vision API. Treat any image, screenshot, chart, video URL, or prompt you pass to it as data sent to that provider, confirm you are allowed to share it, and set ZHIPU_API_KEY only in environments where that credential should be available.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: 整体上，这段代码的核心方向与声明大体一致，确实是在调用智谱视觉模型做图像多模态分析。但声明中提到“图像/视频理解、多模态对话、图表分析等任务”，而实际代码只支持图片 URL 或图片文件读取并发送给模型，没有任何视频输入处理、视频 URL/文件解析、抽帧或视频专用消息结构，因此‘视频理解’这一能力被高估了。此外，函数签名虽然暴露了 model 和 type 参数，但请求中实际写死了 model='glm-4.6v' 和 thinking.type='enabled'，并未真正提供声明所暗示的 GLM-4V/4.6V 灵活调用能力。故应判定为存在描述与行为不完全一致的情况，但不属于完全无关，属于部分能力夸大。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: L005 将“图片理解、图像识别、看图说话、图表分析、视频理解”等泛化表达直接作为使用条件，其中多项是普通用户常见表述，且未限定具体上下文或排除条件。这会让技能在一般对话中也可能被匹配，触发边界不清晰。

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation explicitly shows reading a local image file, base64-encoding it, and sending it to an external vision API without a clear warning that local file contents leave the user's environment. In a multimodal skill, users may submit sensitive screenshots, IDs, medical images, or internal charts, so missing privacy disclosure increases the risk of unintentional data exfiltration to a third party.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The examples instruct the model to process remote image and video URLs but do not warn that this can trigger external network access and transmit resource identifiers or contents to a third-party service. In context, this is more dangerous because URLs may point to private or sensitive media, and users are not alerted to privacy, ownership, or access-control implications.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The function sends user-supplied images and prompt text to Zhipu's external API, including raw base64-encoded image contents when the input is a file-like object. In a vision-analysis skill this behavior is expected, but without explicit disclosure, consent, or data-classification checks, users may unknowingly transmit sensitive images, screenshots, or regulated data to a third party.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: L004-L005 以及全文描述均以中文固定表述技能用途和触发条件，没有说明是否支持其他语言或允许用户按偏好选择语言。若组织要求不应无提示地强制特定语言/locale，这种单一语言约束可能构成自然语言政策问题。

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script reads `ZHIPU_API_KEY` from the environment to authenticate with an external service. While this is a common pattern, the file provides no user-facing warning or explanatory comment about credential use beyond a terse inline note, and no disclosure that the skill depends on external authentication.

Static analysis

No suspicious patterns detected.