T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/text-to-image.sh:93- Finding
Unescaped prompt permits JSON request-body injection in text-to-image workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
BizyAir GPT_IMAGE_2 API 出图
Security checks for vulnerabilities and agentic risk
Overview
This image-generation skill is mostly purpose-aligned, but it handles credentials and downloaded remote content unsafely enough that users should review it before installing.
Install only if you are comfortable sending prompts, reference image URLs, and your BizyAir API authorization to the BizyAir endpoint. Before use, remove API-key-prefix logging, replace string-built JSON with a JSON serializer, validate downloaded files before saving or opening them, and narrow the chmod permission to the exact scripts.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/image-to-image.sh:135- Finding
Unescaped prompts and image URLs permit JSON request-body injection in image-to-image workflow
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/text-to-image.sh:65- Finding
Text-to-image script discloses an API key prefix in logs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/image-to-image.sh:89- Finding
Image-to-image script discloses an API key prefix in logs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/text-to-image.sh:138- Finding
Text-to-image workflow trusts and automatically opens unvalidated downloaded content
- Content
View full analysis
/dev/null || stat -f%z "$OUTPUT_FILE" 2>/dev/null || wc -c < "$OUTPUT_FILE") echo "" echo "========================================" print_info "保存成功!" echo "========================================" echo "文件路径: $OUTPUT_FILE" echo "文件大小: $FILE_SIZE 字节" echo "完成时间: $(date '+%Y-%m-%d %H:%M:%S')" echo "" # 尝试在macOS上预览图片 if [[ "$OSTYPE" == "darwin"* ]]; then print_info "正在打开图片预览..." open "$OUTPUT_FILE" 2>/dev/null & fi else print_error "图片下载失败" exit 1 fi ``` ### Technical Analysis The download URL and output extension are derived from the API response. The script does not enforce HTTPS, restrict the destination host, allowlist extensions, inspect the content type, validate image magic bytes, impose a file-size limit, or check the `curl` exit status. Because `curl` is not invoked with `--fail`, an HTTP error response can still create an output file. The subsequent check verifies only that a ...[truncated 1446 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/image-to-image.sh:193- Finding
Image-to-image workflow trusts and automatically opens unvalidated downloaded content
- Content
View full analysis
/dev/null || stat -f%z "$OUTPUT_FILE" 2>/dev/null || wc -c < "$OUTPUT_FILE") echo "" echo "========================================" print_info "保存成功!" echo "========================================" echo "文件路径: $OUTPUT_FILE" echo "文件大小: $FILE_SIZE 字节" echo "完成时间: $(date '+%Y-%m-%d %H:%M:%S')" echo "" # macOS 自动预览 if [[ "$OSTYPE" == "darwin"* ]]; then print_info "正在打开图片预览..." open "$OUTPUT_FILE" 2>/dev/null & fi else print_error "图片下载失败" exit 1 fi ``` ### Technical Analysis The script accepts the response-provided URL and extension without validating their scheme, destination host, expected extension, MIME type, file signature, or size. Removing a single leading dot from the extension does not establish that the value represents a safe image format. `curl` lacks `--fail`, and its exit status is not checked. Consequently, error responses and partial downloads may create a file that passes the existence-only test. On macOS, the resulting file is opened automatically using its registered handler. T ...[truncated 993 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
.claude/settings.local.json:2- Finding
Wildcard chmod permission violates least-privilege requirements
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
代码仅接收两个参数：提示词和比例。请求体里只包含 prompt 与 aspect_ratio，没有上传输入图片、参考图列表、图像混合参数或任何 image-to-image 相关字段，因此无法支持声明中的“图生图”“参考图片生成”“多图融合”。它确实实现了“文生图”“文本转图片”“设置图片尺寸比例”“生成横版/竖版图片”等子能力，但声明把技能描述成同时覆盖文生图与图生图工具，这与当前代码块实际行为不符。未发现额外危险或无关能力；问题主要是声明的功能范围大于实际实现。
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger conditions are extremely broad, including generic phrases like '帮我画一张' or '生成图片', which can cause the skill to activate on many everyday requests. In an agentic environment with shell and networked side effects, overbroad triggering increases the chance of unintended execution, external API calls, and data transmission without sufficiently specific user intent.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 调用脚本 `scripts/image-to-image.sh`：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 调用脚本 `scripts/image-to-image.sh`：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 调用脚本 `scripts/image-to-image.sh`：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 调用脚本 `scripts/image-to-image.sh`：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to execute shell scripts, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and review gap: consumers cannot easily tell that code execution is required, and a broadly empowered runtime may permit unintended command execution paths.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill sends user prompts and possibly reference image URLs to a third-party external API, which is a real data egress path. In this context, the transmission is part of the intended functionality, but it still poses privacy and compliance risk if users are not clearly informed that their content will leave the local environment and be processed by an external provider.
- Content
md | 参数 | 值 | |------|-----| | 端点 | `https://api.bizyair.cn/w/v1/webapp/task/openapi/create` | | web_app_id | `52416` | | 模型 | BizyAir_GPT_IMAGE_2_T2I_API | | 提示词键 | `4:BizyAir_GPT_IMAGE_2_T2I_API.prompt` |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh # ======================================== # 创建pic文件夹（如果不存在） # ======================================== mkdir -p pic # ======================================== # 从环境变量获取API密钥
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script prints the first 8 characters of the API key to stdout, unnecessarily disclosing part of a secret. Logs may be captured by terminals, CI systems, shared shells, agent telemetry, or support bundles, making partial credential leakage easier to correlate and exploit alongside other exposed data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The script transmits user prompts, image URLs, and the bearer API credential to an external third-party service. In the context of an image-generation skill this is expected functionality, but it still creates a real data-exposure boundary: sensitive prompts, private image references, and credentials leave the local environment and depend on the remote provider's security and privacy controls.
- Content
sh # --connect-timeout: 连接超时 30 秒 # --max-time: 总请求超时 600 秒（10 分钟），覆盖最慢情况 print_info "正在等待 API 响应（预计 90秒 ~ 10分钟）..." RESPONSE=$(curl -s --connect-timeout 30 --max-time 600 -X POST "https://api.bizyair.cn/w/v1/webapp/task/openapi/create" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $API_KEY" \ -d "$JSON_PAYLOAD")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The script transmits user prompts, image URLs, and the bearer API credential to an external third-party service. In the context of an image-generation skill this is expected functionality, but it still creates a real data-exposure boundary: sensitive prompts, private image references, and credentials leave the local environment and depend on the remote provider's security and privacy controls.
- Content
sh # --connect-timeout: 连接超时 30 秒 # --max-time: 总请求超时 600 秒（10 分钟），覆盖最慢情况 print_info "正在等待 API 响应（预计 90秒 ~ 10分钟）..." RESPONSE=$(curl -s --connect-timeout 30 --max-time 600 -X POST "https://api.bizyair.cn/w/v1/webapp/task/openapi/create" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $API_KEY" \ -d "$JSON_PAYLOAD")
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh # ======================================== # 创建pic文件夹（如果不存在） # ======================================== mkdir -p pic # ======================================== # 从环境变量获取API密钥
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script prints the first 8 characters of the API key to the console, unnecessarily exposing secret material during normal operation. Even partial credential disclosure can aid attackers through log scraping, screenshot leaks, shared terminal history, or correlation with other leaked data, and this exposure is not required for an image-generation tool to function.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # --connect-timeout: 连接超时 30 秒 # --max-time: 总请求超时 600 秒（10 分钟），覆盖最慢情况 print_info "正在等待 API 响应（预计 90秒 ~ 10分钟）..." RESPONSE=$(curl -s --connect-timeout 30 --max-time 600 -X POST "https://api.bizyair.cn/w/v1/webapp/task/openapi/create" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $API_KEY" \ -d "$JSON_PAYLOAD")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # --connect-timeout: 连接超时 30 秒 # --max-time: 总请求超时 600 秒（10 分钟），覆盖最慢情况 print_info "正在等待 API 响应（预计 90秒 ~ 10分钟）..." RESPONSE=$(curl -s --connect-timeout 30 --max-time 600 -X POST "https://api.bizyair.cn/w/v1/webapp/task/openapi/create" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $API_KEY" \ -d "$JSON_PAYLOAD")
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing usage and status documentation in the script header is presented only in Chinese, with no indication that language is configurable or optional. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes an image-generation skill using the BizyAir GPT_IMAGE_2 API, but it does not mention accessing environment variables for credentials. While network access is expected for this purpose, reading local environment state is an additional capability that is not explicitly justified by the stated user-facing purpose.
- Content