ClawHub
Back to skill

Security audit

BizyAir API出图

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent image-generation purpose, but its instructions assemble user input into shell curl commands in a way that can create local command-execution risk.

Review this skill before installing. Use it only with non-sensitive prompts, a minimally scoped BizyAir API key, and a sandboxed environment. Avoid custom parameters or request IDs from untrusted users, and do not allow arbitrary local download paths unless the runner enforces safe path validation and overwrite controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:80
Finding

Shell Command Injection Through Unsanitized API Parameters

Content
View full analysis
, "suppress_preview_output": true, "input_values": }' ``` The result-retrieval workflow similarly places a user-provided request ID directly into a double-quoted shell argument: ```bash curl -s -X GET "[https://api.bizyair.cn/w/v1/webapp/task/openapi/outputs?requestId=](https://api.bizyair.cn/w/v1/webapp/task/openapi/outputs?requestId=)" \ -H "Authorization: Bearer ${BIZYAIR_API_KEY}" ``` ### Technical Analysis The skill supports user-controlled prompts, custom node values, custom `web_app_id` values, and user-supplied `requestId` values. It instructs the agent to dynamically assemble these values into `curl` commands without requiring strict validation, shell-safe argument handling, or JSON serialization. In the POST command, the request body is enclosed in single quotes. If a dynamic prompt or custom parameter contains a single quote, it can terminate the quoted argument. Additional shell syntax can then be interpreted as a command rather than as JSON data. In the GET command, the request ID is inserted into a double-quoted URL. Shell constructs such as command substitution remain active inside double quotes. A value containing `$(command)` or backticks may therefore cause local command execution when the generated command is interpreted by a shell. Embedded d ...[truncated 2451 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill description and instructions are written to operate in Chinese and do not indicate that users may choose another language or that the Chinese-only behavior is regionally required. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user prompts and parameters to an external third-party API using an API key, but does not warn users that their content will leave the local environment. This is dangerous because prompts may contain sensitive personal or business data, and the absence of disclosure prevents informed consent and safe handling decisions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill instructs the agent to make outbound HTTP POST requests to a third-party service, transmitting user-supplied prompts and dynamic JSON parameters. In context this is core functionality rather than overtly malicious, but it still creates a real data-exposure surface because arbitrary user content and potentially sensitive parameters are sent externally using privileged credentials.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

  1. 从【功能模块库】中确定目标 <应用ID> 和完整的 <动态JSON参数>。
  2. 使用 curl 执行以下 POST 请求：
    bash
    curl -s -X POST "[https://api.bizyair.cn/w/v1/webapp/task/openapi/create](https://api.bizyair.cn/w/v1/webapp/task/openapi/create)" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${BIZYAIR_API_KEY}" \
  -H "X-Bizyair-Task-Async: enable" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill instructs the agent to make outbound HTTP POST requests to a third-party service, transmitting user-supplied prompts and dynamic JSON parameters. In context this is core functionality rather than overtly malicious, but it still creates a real data-exposure surface because arbitrary user content and potentially sensitive parameters are sent externally using privileged credentials.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

  1. 从【功能模块库】中确定目标 <应用ID> 和完整的 <动态JSON参数>。
  2. 使用 curl 执行以下 POST 请求：
    bash
    curl -s -X POST "[https://api.bizyair.cn/w/v1/webapp/task/openapi/create](https://api.bizyair.cn/w/v1/webapp/task/openapi/create)" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${BIZYAIR_API_KEY}" \
  -H "X-Bizyair-Task-Async: enable" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill performs an outbound GET request to retrieve task outputs from the external BizyAir service using a bearer token. Although expected for the feature, it still exposes request identifiers and result metadata to a third party and relies on external network access without any user-facing disclosure or validation of requestId provenance.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

  1. 使用 curl 执行查询：
bash
curl -s -X GET "[https://api.bizyair.cn/w/v1/webapp/task/openapi/outputs?requestId=](https://api.bizyair.cn/w/v1/webapp/task/openapi/outputs?requestId=)<对应的requestId>" \
  -H "Authorization: Bearer ${BIZYAIR_API_KEY}"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly offers to download generated images to a user-provided local path, expanding behavior from remote image generation/query into local filesystem writes. This increases risk because an attacker could induce unsafe path usage, overwrite files, or persist untrusted content locally without any documented path validation, sandboxing, or consent controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.