BizyAir GPT_IMAGE_2 API 出图

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:28 AM UTC
• Version: 2.0.0

Overview

This image-generation skill is mostly purpose-aligned, but it handles credentials and downloaded remote content unsafely enough that users should review it before installing.

Install only if you are comfortable sending prompts, reference image URLs, and your BizyAir API authorization to the BizyAir endpoint. Before use, remove API-key-prefix logging, replace string-built JSON with a JSON serializer, validate downloaded files before saving or opening them, and narrow the chmod permission to the exact scripts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/text-to-image.sh:93
• Finding: Unescaped prompt permits JSON request-body injection in text-to-image workflow<![CDATA[ ## Vulnerability Details **File Location**: `scripts/text-to-image.sh`, lines 93-102 **Vulnerability Type**: Untrusted data embedded into JSON without serialization **Risk Level**: Medium ### Vulnerable Code ```bash # 构建JSON请求体 - 使用 BizyAir GPT_IMAGE_2 T2I API (web_app_id: 52416) JSON_PAYLOAD=$(cat <<EOF { "web_app_id": 52416, "suppress_preview_output": false, "input_values": { "4:BizyAir_GPT_IMAGE_2_T2I_API.prompt": "$PROMPT", "4:BizyAir_GPT_IMAGE_2_T2I_API.aspect_ratio": "$ASPECT_RATIO" } } EOF ) ``` ### Technical Analysis `PROMPT` is populated directly from the first command-line argument and interpolated into a JSON string without JSON escaping. A prompt containing quotation marks, backslashes, control characters, or JSON syntax can terminate the intended string and alter the request structure. This is not shell command injection because the expanded value remains inside the here-document and is later passed as a quoted argument to `curl`. It is, however, JSON injection into the request sent to BizyAir. The exact effect of duplicate or injected fields depends on the remote API's JSON parser and validation rules. ### Attack Path 1. An attacker supplies or persuades the agent to use a crafted image prompt containing JSON delimiters. 2. The script assigns the value to `PROMPT`. 3. The value is interpolated directly into `JSON_PAYLOAD`. 4. The resulting request can contain malformed JSON or attacker-injected fields. 5. `curl` submits the manipulated body using the configured account and API key. ### Impact Assessment An attacker may cause denial of service for the generation request or manipulate API input fields accepted by the remote workflow. Requests execute under the privileges and quota associated with the configured BizyAir API key. This issue does not directly provide local command execution or access to the full API key. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Construct the body using a JSON-aware serializer rather than string interpolation. For example: ```bash JSON_PAYLOAD=$(jq -n \ --arg prompt "$PROMPT" \ --arg ratio "$ASPECT_RATIO" \ '{ web_app_id: 52416, suppress_preview_output: false, input_values: { "4:BizyAir_GPT_IMAGE_2_T2I_API.prompt": $prompt, "4:BizyAir_GPT_IMAGE_2_T2I_API.aspect_ratio": $ratio } }') || exit 1 ``` Also validate that serialization succeeds before submitting the request and reject unexpectedly large prompts to control resource consumption. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/image-to-image.sh:135
• Finding: Unescaped prompts and image URLs permit JSON request-body injection in image-to-image workflow<![CDATA[ ## Vulnerability Details **File Location**: `scripts/image-to-image.sh`, lines 135-153 **Vulnerability Type**: Untrusted data embedded into JSON without serialization **Risk Level**: Medium ### Vulnerable Code ```bash # 构建 input_values 的 JSON # 先构建图片输入部分 INPUT_PARTS="\"6:BizyAir_GPT_IMAGE_2_I2I_API.prompt\": \"$PROMPT\",\n \"6:BizyAir_GPT_IMAGE_2_I2I_API.aspect_ratio\": \"$ASPECT_RATIO\"" for i in "${!IMAGE_URLS[@]}"; do NODE_ID="${NODE_IDS[$i]}" URL="${IMAGE_URLS[$i]}" INPUT_PARTS="$INPUT_PARTS,\n \"${NODE_ID}:LoadImage.image\": \"$URL\"" done # 组装完整 JSON JSON_PAYLOAD=$(printf "{ \"web_app_id\": $WEB_APP_ID, \"suppress_preview_output\": false, \"input_values\": { %s } }" "$INPUT_PARTS") ``` ### Technical Analysis Both `PROMPT` and every element of `IMAGE_URLS` originate from command-line arguments. They are concatenated into JSON without escaping. Crafted quotation marks, backslashes, control characters, or JSON fragments can corrupt the body or introduce additional properties. The values are not evaluated by the local shell as commands, so this is not direct shell command injection. The security boundary affected is the request sent to the remote BizyAir service. The impact of duplicate keys or injected properties depends on server-side parsing and workflow validation. ### Attack Path 1. An attacker supplies a crafted prompt or reference-image URL. 2. The argument is stored in `PROMPT` or `IMAGE_URLS`. 3. The script concatenates it into `INPUT_PARTS` without JSON encoding. 4. `printf` places the manipulated fragment into `JSON_PAYLOAD`. 5. The request is submitted using the victim's BizyAir credentials and quota. 6. If the API accepts the injected structure, unintended workflow parameters may be processed; otherwise, the request fails. ### Impact Assessment Successful exploitation can alter accepted API inputs, submit unintended values, or repeatedly invalidate requests and consume operational time. The reques ...[truncated 195 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Build `input_values` with `jq` and pass all external values through `--arg`. For dynamic image nodes, construct the object incrementally with JSON operations rather than shell string concatenation. Additional hardening should include: - Validate reference URLs with an explicit URL parser. - Permit only `https` URLs if supported by the service. - Set reasonable maximum lengths for prompts and URLs. - Abort if JSON serialization or validation fails. - Optionally run `jq -e .` against the completed payload before transmission. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/text-to-image.sh:65
• Finding: Text-to-image script discloses an API key prefix in logs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/text-to-image.sh`, line 65 **Vulnerability Type**: Partial credential disclosure **Risk Level**: Low ### Vulnerable Code ```bash print_info "API密钥已读取: ${API_KEY:0:8}..." ``` ### Technical Analysis The script prints the first eight characters of `BIZYAIR_API_KEY`. Terminal output may be retained by agent transcripts, CI systems, shell logging, monitoring platforms, or support bundles. Although the complete credential is not exposed, a stable prefix can identify and correlate a secret across systems and reduce its effective secrecy. ### Attack Path 1. The script runs with a valid `BIZYAIR_API_KEY`. 2. Bash expands `${API_KEY:0:8}`. 3. The prefix is written to standard output. 4. A party with access to execution logs obtains the partial credential. ### Impact Assessment The exposed prefix is generally insufficient for direct authentication, but it can assist credential correlation, targeted phishing, secret identification, or validation of separately obtained credential material. The scope is limited to the first eight characters and any systems retaining script output. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Remove all credential-derived output: ```bash print_info "BizyAir API key is configured" ``` Additionally: - Ensure command tracing with `set -x` is not enabled around authenticated requests. - Redact authorization headers from diagnostic output. - Restrict access to CI and agent execution logs. - Rotate the key if logs containing its prefix were exposed to untrusted parties and organizational policy requires rotation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/image-to-image.sh:89
• Finding: Image-to-image script discloses an API key prefix in logs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/image-to-image.sh`, line 89 **Vulnerability Type**: Partial credential disclosure **Risk Level**: Low ### Vulnerable Code ```bash print_info "API密钥已读取: ${API_KEY:0:8}..." ``` ### Technical Analysis The first eight characters of the BizyAir API key are emitted to standard output. This output can persist in agent transcripts, CI logs, monitoring systems, or support diagnostics. A partial key is not normally sufficient to authenticate, but exposing any stable portion of a secret violates secret-minimization practices. ### Attack Path 1. The environment contains a valid BizyAir API key. 2. The script extracts its first eight characters through Bash substring expansion. 3. The prefix is printed during normal execution. 4. Anyone able to read retained output receives the partial secret. ### Impact Assessment The immediate authentication impact is limited because only a prefix is exposed. Nevertheless, the value may allow correlation between environments or assist an attacker who possesses other partial credential information. Exposure reaches every system or user that can access the script's output history. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Replace the message with a non-sensitive status indicator: ```bash print_info "BizyAir API key is configured" ``` Prevent authorization headers and environment variables from appearing in debug traces, restrict log access, establish log-retention limits, and rotate credentials when required by the applicable secret-handling policy. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/text-to-image.sh:138
• Finding: Text-to-image workflow trusts and automatically opens unvalidated downloaded content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/text-to-image.sh`, lines 138-183 **Vulnerability Type**: Unvalidated remote file download and automatic file opening **Risk Level**: Medium ### Vulnerable Code ```bash # 从outputs数组提取图片URL和文件扩展名 IMAGE_URL=$(echo "$RESPONSE" | grep -o '"object_url":"[^"]*"' | head -1 | cut -d'"' -f4) OUTPUT_EXT=$(echo "$RESPONSE" | grep -o '"output_ext":"[^"]*"' | head -1 | cut -d'"' -f4) if [ -z "$IMAGE_URL" ]; then print_error "无法从outputs数组提取URL" exit 1 fi print_info "获取到URL: $IMAGE_URL" # ======================================== # 第二步：下载图片并保存到pic文件夹 # ======================================== echo "" print_info "正在下载..." echo "========================================" # 确定文件扩展名，默认为.jpg if [ -z "$OUTPUT_EXT" ]; then OUTPUT_EXT="jpg" fi OUTPUT_FILE="pic/${DATE}.${OUTPUT_EXT}" # 图片下载超时：连接 30 秒，下载 120 秒 curl -s --connect-timeout 30 --max-time 120 -o "$OUTPUT_FILE" "$IMAGE_URL" if [ -f "$OUTPUT_FILE" ]; then FILE_SIZE=$(stat -c%s "$OUTPUT_FILE" 2>/dev/null || stat -f%z "$OUTPUT_FILE" 2>/dev/null || wc -c < "$OUTPUT_FILE") echo "" echo "========================================" print_info "保存成功!" echo "========================================" echo "文件路径: $OUTPUT_FILE" echo "文件大小: $FILE_SIZE 字节" echo "完成时间: $(date '+%Y-%m-%d %H:%M:%S')" echo "" # 尝试在macOS上预览图片 if [[ "$OSTYPE" == "darwin"* ]]; then print_info "正在打开图片预览..." open "$OUTPUT_FILE" 2>/dev/null & fi else print_error "图片下载失败" exit 1 fi ``` ### Technical Analysis The download URL and output extension are derived from the API response. The script does not enforce HTTPS, restrict the destination host, allowlist extensions, inspect the content type, validate image magic bytes, impose a file-size limit, or check the `curl` exit status. Because `curl` is not invoked with `--fail`, an HTTP error response can still create an output file. The subsequent check verifies only that a ...[truncated 1446 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Apply layered download validation: 1. Parse the API response with `jq -e` instead of regular expressions. 2. Require an `https` URL and restrict hosts to documented BizyAir-controlled storage domains. 3. Use `curl --fail --show-error --location` and check its exit status. 4. Set an explicit maximum download size, where supported, and verify the final file size. 5. Allowlist expected extensions such as `png`, `jpg`, `jpeg`, and `webp`. 6. Validate MIME type and file signatures with tools such as `file`. 7. Download to a temporary file and move it into `pic/` only after successful validation. 8. Do not automatically open the result; require explicit user consent. 9. Delete partial or invalid files when any validation step fails. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/image-to-image.sh:193
• Finding: Image-to-image workflow trusts and automatically opens unvalidated downloaded content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/image-to-image.sh`, lines 193-238 **Vulnerability Type**: Unvalidated remote file download and automatic file opening **Risk Level**: Medium ### Vulnerable Code ```bash IMAGE_URL=$(echo "$RESPONSE" | grep -o '"object_url":"[^"]*"' | head -1 | cut -d'"' -f4) OUTPUT_EXT=$(echo "$RESPONSE" | grep -o '"output_ext":"[^"]*"' | head -1 | cut -d'"' -f4) if [ -z "$IMAGE_URL" ]; then print_error "无法从响应中提取图片URL" exit 1 fi print_info "获取到URL: $IMAGE_URL" echo "" print_info "正在下载..." echo "========================================" if [ -z "$OUTPUT_EXT" ]; then OUTPUT_EXT="png" fi # 移除可能的点号前缀 OUTPUT_EXT="${OUTPUT_EXT#.}" OUTPUT_FILE="pic/${DATE}.${OUTPUT_EXT}" # 图片下载超时：连接 30 秒，下载 120 秒 curl -s --connect-timeout 30 --max-time 120 -o "$OUTPUT_FILE" "$IMAGE_URL" if [ -f "$OUTPUT_FILE" ]; then FILE_SIZE=$(stat -c%s "$OUTPUT_FILE" 2>/dev/null || stat -f%z "$OUTPUT_FILE" 2>/dev/null || wc -c < "$OUTPUT_FILE") echo "" echo "========================================" print_info "保存成功!" echo "========================================" echo "文件路径: $OUTPUT_FILE" echo "文件大小: $FILE_SIZE 字节" echo "完成时间: $(date '+%Y-%m-%d %H:%M:%S')" echo "" # macOS 自动预览 if [[ "$OSTYPE" == "darwin"* ]]; then print_info "正在打开图片预览..." open "$OUTPUT_FILE" 2>/dev/null & fi else print_error "图片下载失败" exit 1 fi ``` ### Technical Analysis The script accepts the response-provided URL and extension without validating their scheme, destination host, expected extension, MIME type, file signature, or size. Removing a single leading dot from the extension does not establish that the value represents a safe image format. `curl` lacks `--fail`, and its exit status is not checked. Consequently, error responses and partial downloads may create a file that passes the existence-only test. On macOS, the resulting file is opened automatically using its registered handler. T ...[truncated 993 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Parse `object_url` and `output_ext` with `jq -e`. - Enforce HTTPS and an allowlist of approved download hosts. - Restrict extensions to documented image types. - Use `curl --fail --show-error --location` and check the return code. - Apply a maximum permitted file size. - Validate both MIME type and image magic bytes. - Save to a temporary file first and atomically move only validated content. - Remove incomplete files on failure. - Replace automatic `open` behavior with an explicit opt-in prompt. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: .claude/settings.local.json:2
• Finding: Wildcard chmod permission violates least-privilege requirements<![CDATA[ ## Vulnerability Details **File Location**: `.claude/settings.local.json`, lines 2-5 **Vulnerability Type**: Overbroad local permission rule **Risk Level**: Low ### Vulnerable Code ```json "permissions": { "allow": [ "Bash(chmod +x *)" ] } ``` ### Technical Analysis The permission rule authorizes the wildcard command `chmod +x *`. It can mark every matching entry in the current working directory as executable, rather than limiting permission changes to the two known Skill scripts. This exceeds the minimum permissions required by the documented functionality. Marking a file executable does not execute it by itself, so exploitation requires another action that subsequently invokes the newly executable file. Nevertheless, broad authorization can contribute to an attack chain when untrusted files are present in the working directory. ### Attack Path 1. An attacker or another process introduces a file into the command's working directory. 2. The allowed wildcard command `chmod +x *` is invoked. 3. The untrusted file becomes executable along with legitimate files. 4. A user, agent, automation task, or script later executes that file because it now appears runnable. 5. The file executes with the privileges of that invoking process. ### Impact Assessment The direct effect is modification of executable permission bits for unintended files. If one of those files is later run, its code receives the privileges of the current user or automation account. The rule does not independently grant root access, execute files, or modify files outside the wildcard's working-directory scope. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Remove the permission rule if executable bits are already stored in the project. If runtime permission changes are unavoidable, authorize only exact paths: ```json { "permissions": { "allow": [ "Bash(chmod +x scripts/text-to-image.sh)", "Bash(chmod +x scripts/image-to-image.sh)" ] } } ``` Prefer setting executable permissions in source control and avoid wildcard permission-changing commands. Ensure newly added files require explicit review before any execution permission is granted. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 代码仅接收两个参数：提示词和比例。请求体里只包含 prompt 与 aspect_ratio，没有上传输入图片、参考图列表、图像混合参数或任何 image-to-image 相关字段，因此无法支持声明中的“图生图”“参考图片生成”“多图融合”。它确实实现了“文生图”“文本转图片”“设置图片尺寸比例”“生成横版/竖版图片”等子能力，但声明把技能描述成同时覆盖文生图与图生图工具，这与当前代码块实际行为不符。未发现额外危险或无关能力；问题主要是声明的功能范围大于实际实现。

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger conditions are extremely broad, including generic phrases like '帮我画一张' or '生成图片', which can cause the skill to activate on many everyday requests. In an agentic environment with shell and networked side effects, overbroad triggering increases the chance of unintended execution, external API calls, and data transmission without sufficiently specific user intent.

Ae1

High

• Category: analysis-evasion

Content

调用脚本 `scripts/image-to-image.sh`：

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

调用脚本 `scripts/image-to-image.sh`：

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

调用脚本 `scripts/image-to-image.sh`：

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

调用脚本 `scripts/image-to-image.sh`：

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to execute shell scripts, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and review gap: consumers cannot easily tell that code execution is required, and a broadly empowered runtime may permit unintended command execution paths.

External Transmission

Medium

• Category: Data Exfiltration

Content

| 参数 | 值 |
|------|-----|
| 端点 | `https://api.bizyair.cn/w/v1/webapp/task/openapi/create` |
| web_app_id | `52416` |
| 模型 | BizyAir_GPT_IMAGE_2_T2I_API |
| 提示词键 | `4:BizyAir_GPT_IMAGE_2_T2I_API.prompt` |

• Confidence: 88% confidence
• Finding: The skill sends user prompts and possibly reference image URLs to a third-party external API, which is a real data egress path. In this context, the transmission is part of the intended functionality, but it still poses privacy and compliance risk if users are not clearly informed that their content will leave the local environment and be processed by an external provider.

Session Persistence

Medium

• Category: Rogue Agent

Content

# ========================================
# 创建pic文件夹（如果不存在）
# ========================================
mkdir -p pic

# ========================================
# 从环境变量获取API密钥

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script prints the first 8 characters of the API key to stdout, unnecessarily disclosing part of a secret. Logs may be captured by terminals, CI systems, shared shells, agent telemetry, or support bundles, making partial credential leakage easier to correlate and exploit alongside other exposed data.

External Transmission

Medium

• Category: Data Exfiltration

Content

# --connect-timeout: 连接超时 30 秒
# --max-time: 总请求超时 600 秒（10 分钟），覆盖最慢情况
print_info "正在等待 API 响应（预计 90秒 ~ 10分钟）..."
RESPONSE=$(curl -s --connect-timeout 30 --max-time 600 -X POST "https://api.bizyair.cn/w/v1/webapp/task/openapi/create" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$JSON_PAYLOAD")

• Confidence: 93% confidence
• Finding: The script transmits user prompts, image URLs, and the bearer API credential to an external third-party service. In the context of an image-generation skill this is expected functionality, but it still creates a real data-exposure boundary: sensitive prompts, private image references, and credentials leave the local environment and depend on the remote provider's security and privacy controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

# --connect-timeout: 连接超时 30 秒
# --max-time: 总请求超时 600 秒（10 分钟），覆盖最慢情况
print_info "正在等待 API 响应（预计 90秒 ~ 10分钟）..."
RESPONSE=$(curl -s --connect-timeout 30 --max-time 600 -X POST "https://api.bizyair.cn/w/v1/webapp/task/openapi/create" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$JSON_PAYLOAD")

• Confidence: 93% confidence
• Finding: The script transmits user prompts, image URLs, and the bearer API credential to an external third-party service. In the context of an image-generation skill this is expected functionality, but it still creates a real data-exposure boundary: sensitive prompts, private image references, and credentials leave the local environment and depend on the remote provider's security and privacy controls.

Session Persistence

Medium

• Category: Rogue Agent

Content

# ========================================
# 创建pic文件夹（如果不存在）
# ========================================
mkdir -p pic

# ========================================
# 从环境变量获取API密钥

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script prints the first 8 characters of the API key to the console, unnecessarily exposing secret material during normal operation. Even partial credential disclosure can aid attackers through log scraping, screenshot leaks, shared terminal history, or correlation with other leaked data, and this exposure is not required for an image-generation tool to function.

External Transmission

Medium

• Category: Data Exfiltration

Content

# --connect-timeout: 连接超时 30 秒
# --max-time: 总请求超时 600 秒（10 分钟），覆盖最慢情况
print_info "正在等待 API 响应（预计 90秒 ~ 10分钟）..."
RESPONSE=$(curl -s --connect-timeout 30 --max-time 600 -X POST "https://api.bizyair.cn/w/v1/webapp/task/openapi/create" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$JSON_PAYLOAD")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# --connect-timeout: 连接超时 30 秒
# --max-time: 总请求超时 600 秒（10 分钟），覆盖最慢情况
print_info "正在等待 API 响应（预计 90秒 ~ 10分钟）..."
RESPONSE=$(curl -s --connect-timeout 30 --max-time 600 -X POST "https://api.bizyair.cn/w/v1/webapp/task/openapi/create" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$JSON_PAYLOAD")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: All user-facing usage and status documentation in the script header is presented only in Chinese, with no indication that language is configurable or optional. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The manifest describes an image-generation skill using the BizyAir GPT_IMAGE_2 API, but it does not mention accessing environment variables for credentials. While network access is expected for this purpose, reading local environment state is an additional capability that is not explicitly justified by the stated user-facing purpose.

Static analysis

No suspicious patterns detected.