Zhipu Image Generator

• Analyzed: May 11, 2026, 6:58 AM
• Findings: 1
• Version: 1.1.1
• Hash: 70cd843c64c7b987f9d5268e509238b3a940b9763f34453995fa4c2808b6b5f0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides legitimate image generation functionality via Zhipu AI but contains a JSON injection vulnerability in `scripts/generate_image.sh`. The script constructs a JSON payload for a `curl` request by directly interpolating unescaped variables (`$PROMPT`, `$SIZE`), which could allow malformed or malicious input to manipulate the API call. Additionally, the script permits writing files to arbitrary system locations via the `-o` (output directory) parameter.