Security audit

图可丽视觉api

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Tukeli image-processing skill, but it should go to Review because it sends images and an API key to a paid external service with weak or inaccurate safeguards.

Install only if you are comfortable sending selected images, image URLs, prompts, and optional facial landmark data to Tukeli's servers and paying for API usage. Do not rely on the documented TUKELI_MAX_IMAGES_PER_DAY limit unless it is implemented or enforced provider-side, and prefer running it in an isolated environment with a scoped API key and reviewed dependency pinning.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tukeli.py:93
Finding: API credential may be disclosed through cross-origin HTTP redirects
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/requirements.txt:4
Finding: Dependencies are installed without reproducible version and integrity controls
Content: View full analysis
=2.28.0 ``` The documented installation command is: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis The lower-bound-only requirement permits installation of any future Requests release accepted by the package resolver. Transitive dependencies are also not locked, and no package hashes are provided. This creates non-reproducible installations and expands the supply-chain trust boundary beyond the dependency versions reviewed with the Skill. A compromised, malicious, or unexpectedly incompatible future release could change security-relevant HTTP behavior or execute package installation code in the user's Python environment. No evidence was found that the current `requests` package name is a typosquat or intentionally malicious. The issue is the absence of version locking and artifact integrity verification, not a confirmed compromise of the dependency. ### Attack Path 1. A future permitted Requests release or one of its resolved dependencies is compromised, malicious, or replaced at an untrusted package source. 2. A user runs the documented `pip install -r scripts/requirements.txt` command. 3. The resolver selects the affected release because no exact version, lock file, or hash restricts it. 4. Malicious installation or runtime code executes with the privileges of the user running `pip`. 5. The affected dependency may access environment variables, local files available to the process, API credentials, or image data processed by the Skill. ### Impact Assessment The potential privilege level is that of the user or environment performing package installation and subsequently running the Skill. Depending on the compromised package behavior, impact could include credential theft, local data disclosure, arbitrary code execut ...[truncated 245 chars]
Remediation: View remediation
--hash=sha256: ``` Additionally: 1. Lock all transitive dependencies using a trusted lock-generation workflow. 2. Install with `pip install --require-hashes -r requirements.txt`. 3. Use only trusted package indexes configured over TLS. 4. Review dependency updates before regenerating the lock file. 5. Run automated vulnerability and provenance checks on locked artifacts. 6. Prefer installation in an isolated virtual environment with minimum filesystem and credential access. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: references/setup-guide.md:119
Finding: Documented daily paid-API usage limit is not implemented
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 68)May include surrounding context.
python
def _parse_env_file(env_path: Path) -> dict[str, str]: """解析 .env 文件，返回 key=value 字典。""" result: dict[str, str] = {} if not env_path.exists(): return result

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 89)May include surrounding context.
python
def _parse_env_file(env_path: Path) -> dict[str, str]: """解析 .env 文件，返回 key=value 字典。""" result: dict[str, str] = {} if not env_path.exists(): return result

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tukeli.py (reported line 210)May include surrounding context.
python
def _parse_env_file(env_path: Path) -> dict[str, str]: """解析 .env 文件，返回 key=value 字典。""" result: dict[str, str] = {} if not env_path.exists(): return result

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config.py (reported line 93)May include surrounding context.
python
key = os.environ.get("TUKELI_API_KEY") if key: return key env_data = _parse_env_file(ROOT_DIR / ".env") return env_data.get("TUKELI_API_KEY")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill performs sensitive actions implied by its documentation and referenced scripts—reading local files, writing outputs/metadata, accessing environment variables for API keys, and making network requests—yet it does not declare any explicit tool scope or allowed-tools boundaries. This weakens least-privilege controls and makes it easier for an agent runtime to grant broader capabilities than users expect, increasing the blast radius if the skill is misused or compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill describes uploading local images or submitting image URLs to a third-party cloud API, but it does not clearly warn users that their content will leave the local environment and be processed by an external service. This creates a privacy and data-handling risk, especially for personal photos, faces, IDs, or other sensitive imagery, because users may invoke the skill without informed consent about external transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation describes uploading image files and submitting image URLs to a third-party API but does not clearly warn users that their images will be transmitted off-platform to an external service. This creates privacy and compliance risk, especially if users send sensitive, proprietary, or personal images under the assumption processing is local or first-party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The faceAnalysis option returns facial landmarks and face bounding data, which may constitute biometric or sensitive personal data in many jurisdictions. Documenting this feature without a clear warning can lead integrators to unknowingly collect, transmit, or store regulated facial data, increasing privacy, legal, and misuse risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 379)May include surrounding context.
python
import requests response = requests.post( 'https://picupapi.tukeli.net/api/v1/matting?mattingType=6', files={'file': open('/path/to/file.jpg', 'rb')}, headers={'APIKEY': 'INSERT_YOUR_API_KEY_HERE'},

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 392)May include surrounding context.
python
import requests response = requests.post( 'https://picupapi.tukeli.net/api/v1/matting?mattingType=6', files={'file': open('/path/to/file.jpg', 'rb')}, headers={'APIKEY': 'INSERT_YOUR_API_KEY_HERE'},

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 406)May include surrounding context.
python
import requests response = requests.post( 'https://picupapi.tukeli.net/api/v1/matting?mattingType=6', files={'file': open('/path/to/file.jpg', 'rb')}, headers={'APIKEY': 'INSERT_YOUR_API_KEY_HERE'},

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 406)May include surrounding context.
md
import requests # 提交任务 response = requests.post( 'https://picupapi.tukeli.net/api/v1/paintAsync', json={ 'imgUrl': 'https://example.com/transparent.png',

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guide tells users to submit local files or image URLs to an external API endpoint but does not clearly disclose that image content will leave the local environment and be processed by a third party. This creates a real privacy and data-governance risk, especially if users upload sensitive photos, biometric data, or proprietary images without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This file presents its descriptive documentation entirely in Chinese, and the user-facing exception messages are also hard-coded in Chinese. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill uploads local image files or sends image URLs to a third-party API, but the runtime flow does not provide a prominent consent/privacy warning before transmission. Users may unknowingly send sensitive personal images or internal URLs to an external service, creating privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The AI background feature transmits image content and free-form text prompts to a third-party endpoint without a clear in-band warning or consent mechanism. Because prompts and images may contain personal, confidential, or regulated data, silent transmission increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This code sends user-supplied images/text to an external API over the network, which is expected for the skill but still security-relevant because sensitive data may leave the local environment. In the skill context, the danger is not hidden malware behavior but undisclosed third-party data transfer and possible exposure of personal or confidential content.
Content: Scanner excerpt · scripts/tukeli.py (reported line 145)May include surrounding context.
python
} if method == "POST": resp = requests.post(url, json=body, headers=headers, timeout=timeout) else: resp = requests.get(url, params=body, headers=headers, timeout=timeout)

Tainted flow: 'body' from requests.get (line 158, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/tukeli.py (reported line 145)May include surrounding context.
python
} if method == "POST": resp = requests.post(url, json=body, headers=headers, timeout=timeout) else: resp = requests.get(url, params=body, headers=headers, timeout=timeout)

Tainted flow: 'body' from requests.get (line 158, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/tukeli.py (reported line 147)May include surrounding context.
python
if method == "POST": resp = requests.post(url, json=body, headers=headers, timeout=timeout) else: resp = requests.get(url, params=body, headers=headers, timeout=timeout) _raise_for_status(resp) return resp.json()

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: 文件中的自然语言说明全部为中文，且未提供多语言选项、英文别名或声明该技能仅面向中文用户。根据语言/区域政策，若技能强制特定语言而无用户选择或合理限定，可能构成自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: A language or locale policy issue can arise when a skill forces a specific language without user opt-in. This file presents all instructions in Chinese and does not indicate that the skill is region-specific or provide an alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This requirements file contains natural-language comments only in Chinese, which may impose a specific language/locale on users without offering a choice or documenting a justified region-specific constraint. The policy for this audit flags language or locale restrictions when they are forced without opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency is specified as requests>=2.28.0, which allows installation of a wide range of versions and makes builds non-reproducible. In a skill that calls external visual-processing APIs and may handle image URLs, uploads, credentials, and remote network traffic, leaving requests unpinned increases the chance of pulling in a vulnerable or behavior-changing release during deployment.
Content: Scanner excerpt · scripts/requirements.txt (reported line 4)May include surrounding context.
text
# 图可丽视觉 API Skill - 依赖 # 安装：pip install -r requirements.txt requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: requests has multiple published advisories, and because the manifest does not pin a specific version, there is no way to verify whether the installed package includes fixes. Given this skill's purpose—making outbound HTTP requests to a third-party image API and potentially fetching user-supplied URLs—dependency uncertainty can expose secrets, request metadata, or transport security assumptions if an affected version is resolved.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 文件头文档、CLI 描述和用户输出均固定为中文，没有提供语言切换、用户选择或对中文限定场景的说明。按规则，强制特定语言而无用户 opt-in 可能构成语言/locale 政策问题。
Content: No source excerpt is available for this finding.