ClawHub
Back to skill

Security audit

Zhipu Image Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Zhipu image-generation helper, with expected third-party API use and some input-validation/privacy documentation caveats.

Install only if you intend to use Zhipu AI for image generation. Avoid putting secrets, private personal data, or proprietary content in prompts, keep the ZHIPU_API_KEY scoped and monitored for billing, and be aware that unusual quotes or JSON-like text in prompts may cause malformed or unintended API requests until the script is hardened.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.sh:115
Finding

JSON Injection Through Unescaped Image Generation Parameters

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.sh (reported line 17)May include surrounding context.

sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.sh (reported line 37)May include surrounding context.

sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.sh (reported line 80)May include surrounding context.

sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.sh (reported line 81)May include surrounding context.

sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.sh (reported line 18)May include surrounding context.

sh
SKILL_DIR="$(dirname "$SCRIPT_DIR")"

# Load ZHIPU_API_KEY from .env file if exists (secure: only read the specific variable)
ENV_FILE="$SKILL_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    # Secure read: only extract ZHIPU_API_KEY, ignore other content
    API_KEY_FROM_ENV=$(grep -E '^ZHIPU_API_KEY=' "$ENV_FILE" 2>/dev/null | head -1 | cut -d'=' -f2- | tr -d '"' | tr -d "'")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares shell-capable behavior by instructing users to run a local script, but it does not define any explicit tool scope such as permissions or allowed-tools. This increases the chance of over-broad execution in an agent environment and makes it harder to constrain what the skill may invoke.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation description is broad enough to trigger on common image-related requests, which can cause the agent to invoke this skill in situations where the user did not clearly consent to using an external image-generation provider. Over-broad routing raises privacy and safety risk because user prompts may be sent off-platform unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation does not warn that prompts and related content are transmitted to Zhipu's external API service. Users may unknowingly send sensitive, proprietary, or personal information to a third party, creating privacy and compliance exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The script sends user-supplied prompt content and the bearer API credential to an external third-party endpoint. This is expected for an API client, but it is still a real data-transmission boundary: sensitive prompts or misuse of the key could expose user data to the provider or enable unauthorized billing if the environment is compromised.

Content

Scanner excerpt · scripts/generate_image.sh (reported line 112)May include surrounding context.

sh
echo "Size: $SIZE"
echo "Watermark: $WATERMARK"

RESPONSE=$(curl -s -X POST "$API_URL" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "{

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Most of the user-facing documentation is in Chinese, while the policy requires avoiding forced language constraints unless the user is given a choice or the locale restriction is justified. The file mentions support for Chinese/English prompts, but it does not offer bilingual documentation or state that Chinese-only documentation is intentional and limited to a specific audience.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest describes a text-to-image generation skill, but the implementation also reads a local .env file to obtain credentials. While this is a common convenience pattern, it is still a local file access capability not mentioned in the stated purpose and not strictly inherent to image generation itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.