ClawHub
Back to skill

Security audit

Img2img

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple image-generation helper, but its JavaScript path disables TLS verification and can send the API key and prompts to an environment-controlled endpoint.

Review before installing. Use the Python path or require the JavaScript code to remove rejectUnauthorized: false and restrict or remove BASE_URL/API_BASE_URL overrides before using a real API key. Avoid putting sensitive personal or confidential details in prompts, and prefer environment or secret-manager credentials over command-line API keys.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
gen_image.js:15
Finding

TLS Certificate Verification Disabled for API Requests

Content
View full analysis

Vulnerability Details

File Location: gen_image.js:15-19
Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable Code

javascript
const client = new OpenAI({
  apiKey: apiKey,
  baseURL: process.env.BASE_URL || process.env.API_BASE_URL || 'https://api.openai.com/v1',
  httpAgent: new https.Agent({ rejectUnauthorized: false })
});

Technical Analysis

The HTTPS agent is configured with rejectUnauthorized: false, which disables validation of the server's TLS certificate. The client consequently cannot reliably authenticate the API server.

An attacker capable of intercepting network traffic, controlling a proxy, manipulating DNS, or presenting a forged certificate could terminate the TLS connection without possessing a certificate trusted by the host. Requests made through the OpenAI client may contain the API key in an authorization header, as well as the user's image-generation prompt.

This condition is especially dangerous because the same client configuration supports an environment-controlled API base URL.

Attack Path

  1. A victim invokes gen_image.js on an attacker-controlled network or through a malicious proxy.
  2. The attacker intercepts the connection and presents an arbitrary or forged TLS certificate.
  3. The script accepts the certificate because verification is disabled.
  4. The OpenAI client sends the API request, including the API credential and prompt, through the intercepted connection.
  5. The attacker captures the credential and prompt and may return a manipulated API response.
  6. The stolen credential can be reused within the permissions and usage limits associated with that API key.

Impact Assessment

Successful exploitation may disclose the OpenAI API key and private user prompts. The attacker could consume the victim's API quota, incur charges, access API resources authorized to the key, or manipulate the generated response.

...[truncated 196 chars]

Remediation
View remediation

Remediation Suggestions

Remove the custom agent so that the Node.js runtime performs standard certificate validation:

javascript
const client = new OpenAI({
  apiKey,
  baseURL: 'https://api.openai.com/v1'
});

If a private certificate authority is operationally required, configure an explicit trusted CA certificate instead of disabling validation globally. Production deployments should also:

  • Require HTTPS for every configured API endpoint.
  • Keep the operating system and Node.js trust stores current.
  • Avoid global TLS bypasses such as NODE_TLS_REJECT_UNAUTHORIZED=0.
  • Rotate the API key if the vulnerable implementation has operated on untrusted networks.
  • Use a restricted API key with appropriate usage and spending limits.

T09 · Insecure Skill Coding Practices

Warning
Location
gen_image.js:15
Finding

API Credentials Can Be Redirected to an Arbitrary Environment-Controlled Endpoint

Content
View full analysis

Vulnerability Details

File Location: gen_image.js:15-19
Vulnerability Type: Unrestricted API endpoint override causing credential disclosure
Risk Level: Medium

Vulnerable Code

javascript
const client = new OpenAI({
  apiKey: apiKey,
  baseURL: process.env.BASE_URL || process.env.API_BASE_URL || 'https://api.openai.com/v1',
  httpAgent: new https.Agent({ rejectUnauthorized: false })
});

Technical Analysis

The API destination is selected from the generic BASE_URL or API_BASE_URL environment variables without validating the scheme or hostname. The project documentation presents the operation as a request to OpenAI, but the executable JavaScript code may instead send the request to any endpoint supplied through the process environment.

The OpenAI client authenticates requests using the configured API key. Therefore, a malicious or accidentally poisoned environment can cause the credential and user prompt to be transmitted to an untrusted server. Disabled certificate verification further weakens transport security, although endpoint redirection remains a concern independently of that setting.

Exploitation requires the ability to influence the environment used to launch the script, such as through a compromised wrapper, CI/CD configuration, service definition, shell profile, container configuration, or orchestration manifest.

Attack Path

  1. An attacker gains the ability to modify the environment or launch configuration used for the skill.
  2. The attacker sets BASE_URL or API_BASE_URL to an attacker-controlled API-compatible endpoint.
  3. A victim invokes the image-generation script with a legitimate API_KEY.
  4. The OpenAI client sends the authorization data and image prompt to the attacker-controlled endpoint.
  5. The endpoint records the credential and may return a fabricated response.
  6. The attacker reuses the captured key against services permitted by that credential.

...[truncated 509 chars]

Remediation
View remediation

Remediation Suggestions

Remove endpoint overrides if the skill is intended to communicate only with OpenAI:

javascript
const client = new OpenAI({
  apiKey,
  baseURL: 'https://api.openai.com/v1'
});

If custom endpoints are a required feature:

  • Use a dedicated, clearly documented environment variable rather than generic names.
  • Parse the endpoint with the standard URL API.
  • Require the https: scheme.
  • Enforce an explicit allowlist of trusted hostnames and, where practical, trusted ports and path prefixes.
  • Reject URLs containing unexpected credentials, redirects, or insecure schemes.
  • Keep TLS certificate verification enabled.
  • Ensure service managers, CI/CD systems, containers, and shell profiles cannot be modified by untrusted users.
  • Use separate restricted credentials for each approved endpoint rather than forwarding one provider's key to another service.

T09 · Insecure Skill Coding Practices

Warning
Location
gen_image.py:32
Finding

API Key Accepted Through a Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: gen_image.py:32-35
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python
if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="DALL-E 图生图")
    parser.add_argument("prompt", help="图片描述")
    parser.add_argument("--api-key", help="OpenAI API Key")

The parsed value is subsequently passed to the API client:

python
url = generate_image(args.prompt, args.api_key)

Technical Analysis

Supplying an API key through --api-key places the secret in the process command line. Depending on the operating system and deployment environment, process arguments can be exposed through process inspection utilities, process accounting, monitoring agents, audit logs, CI/CD logs, crash diagnostics, command histories, or wrapper scripts.

Although command-line visibility varies by platform and system configuration, command arguments should not be treated as a confidential secret-delivery mechanism.

Attack Path

  1. A user runs the script with python gen_image.py "prompt" --api-key <secret>.
  2. The key becomes part of the command-line argument vector.
  3. A local user, monitoring service, process-accounting system, shell-history mechanism, or CI/CD logger records or observes the command.
  4. An unauthorized party retrieves the exposed key.
  5. The party uses the key to make API requests within its assigned permissions and limits.

Impact Assessment

The exposure may allow unauthorized use of the OpenAI API, depletion of quotas, financial charges, and use of any API capabilities granted to the key. The accessible scope is limited to the permissions associated with the leaked credential.

The issue does not directly grant elevated local privileges. Exploitation generally requires access to process metadata, logs, command history, or another location where the c ...[truncated 25 chars]

Remediation
View remediation

Remediation Suggestions

Remove the --api-key argument and obtain the credential from a protected secret source:

python
api_key = os.environ.get("API_KEY")

For production environments, prefer a secret manager or platform-native credential injection mechanism. Additional hardening should include:

  • Preventing credentials from being printed or included in exception messages.
  • Restricting access to service definitions and secret configuration.
  • Disabling shell-history recording before entering a secret if temporary manual handling is unavoidable.
  • Rotating any key previously supplied through command-line arguments.
  • Applying least-privilege permissions, quota restrictions, and spending limits to API keys.
  • Documenting environment-variable or secret-manager usage as the only supported credential-delivery method.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are very broad and include common conversational requests such as '生成图片' and '画一个', which can cause the skill to activate when the user did not explicitly intend to invoke this capability. Unintended activation can lead to accidental transmission of user prompts to an external image-generation service and confuse routing or safety controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that user descriptions are sent to DALL-E but does not clearly warn users that their prompts are being transmitted to an external API provider. This creates a privacy and consent risk, especially if users include personal, sensitive, or confidential information in image prompts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The comment on L02 describes the skill as '图生图' (image-to-image), which implies transforming an input image into another image. However, the implementation only accepts CLI text arguments on L32 and passes them as a prompt to client.images.generate on L21-L23, with no image input anywhere in the code.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

The script explicitly disables TLS certificate verification by setting rejectUnauthorized: false in the HTTPS agent. This allows man-in-the-middle interception or modification of traffic, which can expose the API key, user prompts, and returned content, especially since the base URL can also be overridden by environment variables.

Content

Scanner excerpt · gen_image.js (reported line 17)May include surrounding context.

js
const client = new OpenAI({
    apiKey: apiKey,
    baseURL: process.env.BASE_URL || process.env.API_BASE_URL || 'https://api.openai.com/v1',
    httpAgent: new https.Agent({ rejectUnauthorized: false })
  });

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code sends the user-supplied prompt to a remote API and uses an API key from the environment, but there is no user-facing notice beyond a generic usage string. For a code file, transmitting user data and using credentials should have some visible disclosure such as a comment, prompt, or explicit warning unless clearly documented elsewhere in the skill description, which is not present in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring says "图生图" and the CLI description also says "DALL-E 图生图", which implies image-to-image functionality. However, the implementation only accepts a text prompt and calls client.images.generate without any image input, so the documented intent contradicts the actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The statement "英文描述效果更好" establishes a language preference in the skill's natural-language guidance, which can pressure users toward a specific language without explicitly offering choice or explaining the limitation. This may conflict with language/locale policy expectations unless framed as optional guidance with user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language description is written as a Chinese-only skill label and the CLI messages are also Chinese-only, with no indication that the user can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module docstring, function docstring, argument descriptions, and error messages are written in Chinese, which imposes a specific language on users without opt-in. This can violate language or locale policy when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The code automatically pulls an API key from the API_KEY environment variable if no argument is provided. While this is common, there is no confirmation prompt, user-facing notice beyond the missing-key error, or explanatory comment warning that the skill accesses credentials from the environment.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency version is specified with a caret range (^6.32.0), which allows installation of newer compatible releases rather than a single exact version. This can introduce supply-chain risk and reduce build reproducibility if an upstream release is buggy or compromised.

Content

Scanner excerpt · package.json (reported line 3)May include surrounding context.

json
{
  "dependencies": {
    "openai": "^6.32.0"
  }
}

Static analysis

No suspicious patterns detected.