ClawHub
Back to skill

Security audit

Alibaba Cloud AI Image Zimage Turbo

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a legitimate DashScope image generator, but its helper script can send your API key to a caller-chosen endpoint and then download an unvalidated returned URL.

Review before installing. Use it only with official DashScope endpoints, do not run untrusted request JSON that sets base_url, avoid setting DASHSCOPE_BASE_URL to non-DashScope hosts, and use a scoped/revocable API key.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'image_url' from os.getenv (line 162, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
def download_image(image_url: str, output_path: Path) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)
    with urllib.request.urlopen(image_url) as response:
        output_path.write_bytes(response.read())
Confidence
96% confidence
Finding
with urllib.request.urlopen(image_url) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documents and encourages use of environment secrets, local file reads/writes, and outbound network access, but it does not declare any permissions or capability boundaries. This creates a transparency and governance gap: an agent or reviewer may authorize the skill without understanding it can access credentials, write artifacts, and transmit data externally.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The request allows caller-controlled override of the API `base_url`, so the bearer token can be sent to any arbitrary endpoint instead of the intended DashScope service. In this skill context, that is especially dangerous because the script automatically attaches the `DASHSCOPE_API_KEY` Authorization header and then trusts the response enough to fetch a returned image URL.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.