图片生成技能 - 支持动态 API 配置和任务记忆，根据 Token 自动获取可用功能，支持文生图和图生图

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:55 PM UTC
• Version: 1.0.4

Overview

This image-generation skill is coherent overall, but it mishandles API tokens and uploads in ways users should review before installing.

Review this skill carefully before installing. Use only a token you can revoke, avoid pasting secrets into commands or logs, do not store the token in plaintext task files, keep the API URL on the trusted GNano HTTPS endpoint, and do not provide private or sensitive reference files or person images unless you are comfortable uploading them to the remote service.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/get_config.py:107

Finding

API Token Exposure Through Standard Output, Process Arguments, and Plaintext State

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_image.py:191

Finding

Unrestricted Custom API Endpoint Can Receive Bearer Tokens and User Data

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/generate_image.py:61

Finding

Arbitrary Local Files Can Be Disguised as Images and Uploaded

Content

View full analysis

Tuple[Optional[str], Optional[str]]: """将图片转换为 base64 编码""" abs_path = convert_to_absolute_path(image_path) path = Path(abs_path) if not path.exists(): return None, f"参考图不存在: {abs_path}" file_size = path.stat().st_size max_size = max_size_mb * 1024 * 1024 if file_size > max_size: return None, f"参考图超过{max_size_mb}MB限制" suffix = path.suffix.lower() if suffix in ['.png']: mime_type = "image/png" elif suffix in ['.jpg', '.jpeg']: mime_type = "image/jpeg" elif suffix in ['.webp']: mime_type = "image/webp" elif suffix in ['.gif']: mime_type = "image/gif" else: mime_type = "image/png" try: with open(path, "rb") as f: data = base64.b64encode(f.read()).decode("utf-8") return mime_type, data except Exception as e: return None, f"读取图片失败: {e}" ``` The resulting content is added directly to the network payload: ```python for i, ref_path in enumerate(reference_paths, 1): abs_ref_path = convert_to_absolute_path(ref_path) mime_type, image_data = encode_image(abs_ref_path, max_reference_size_mb) if mime_type is None: log_progress(f"警告: 跳过参考图 {i}") continue parts.append({ "inline_data": { "mime_type": mime_type, "data": image_data } }) loaded_references.append(abs_ref_path) ``` ### Technical Analysis The implementation uses file extensions only to assign a MIME type and labels every unknown extension as `image/png`. It does not decode and validate the file as an image. Absolute paths are accepted, resolved paths are not constrained to ...[truncated 1769 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_config.py:55

Finding

API Token Validation Fails Open on Server and Network Errors

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:324

Finding

Privacy Documentation Incorrectly Claims API Tokens Are Not Transmitted Externally

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The documented behavior claims automatic capability discovery from the user's token, but the described interface also relies on externally supplied model lists and does not substantiate a distinct trusted discovery flow. This mismatch is dangerous because users and orchestrators may trust safety or authorization properties that are not actually implemented, leading to misuse of tokens, unsupported operations, or incorrect policy assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document states that the token is only kept locally and not transmitted externally, yet the same skill instructs passing that token to remote API operations and storing it in task state. This is a direct deceptive data-handling statement that can cause users to disclose secrets under false assumptions, making credential exposure and unauthorized account use more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script includes the raw API token in the returned config object and then prints that JSON to stdout. In a skill/agent context, stdout is often logged, surfaced to calling components, or stored in execution records, so this can leak long-lived credentials to logs or other users with access to run artifacts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill clearly instructs use of networked scripts against a remote API, but it does not declare any tool scope or allowed-tools boundaries. That weakens reviewability and can cause an agent runtime to invoke network access without explicit least-privilege constraints, increasing the chance of unintended data exfiltration or over-broad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill asks users for an API token and describes local task memory, but it does not clearly warn that the token will be sent to the remote GNano service and persisted in local state files. This omission undermines informed consent around secret handling and can expose users to credential leakage through local storage, logs, screenshots, or unexpected third-party transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages users to supply reference images for remote generation/editing but omits a clear warning that those images will be uploaded to an external service. That is a privacy risk because users may provide sensitive or identifying photos without understanding that third-party processing, retention, or policy terms may apply.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The reference-image editing example explicitly instructs removing a person's clothing, which normalizes sexualized image manipulation without safeguards around consent, age, or abuse prevention. In an image-editing skill, this materially increases misuse risk for non-consensual intimate imagery and other exploitative content generation.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The full dialogue example repeats the undressing workflow in a conversational format, reinforcing a realistic path for harmful use rather than presenting it as prohibited content. This makes the skill more dangerous because it operationalizes abusive image-editing behavior for end users and downstream agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends the user’s prompt, bearer token, and any supplied reference images to a remote third-party API, but the CLI does not present a clear, explicit warning or consent checkpoint before transmission. In a skill context, users may assume local processing; this can cause unintended disclosure of sensitive text or image contents to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The code performs an external HTTP POST to a configurable API endpoint and includes the full prompt plus inline base64-encoded reference images in the request body. This is expected for an image-generation client, but in a skill environment it is still a real data-exfiltration boundary because --api-url is user-configurable and there is no allowlist, consent gate, or trust verification for the destination.

Content

Scanner excerpt · scripts/generate_image.py (reported line 205)May include surrounding context.

python

log_progress("正在生成图片，请稍候...", step=4, total=5)
    
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=120)
    except requests.exceptions.Timeout:
        return {
            "success": False,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code sends the provided API token in an Authorization header to a remote endpoint, which is a sensitive network operation covered by the warning requirement for code files. Although the script has brief docstrings, it does not disclose to the user that their token will be transmitted to a server, and later lines also include the token in printed output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction '所有回复使用中文' is a blanket language requirement. There is no indication that users can choose another language or that the Chinese-only behavior is a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description is written as a Chinese-only skill description ("图片生成技能 - 支持动态 API 配置") with no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The dependency specification uses an open-ended lower bound for requests instead of pinning to a known-safe version, so installations may resolve to versions affected by known advisories depending on the environment and resolver behavior. Because this skill appears to interact with remote APIs and tokens, a vulnerable HTTP client library could increase exposure to credential leakage, request handling flaws, or other network-layer issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows future unreviewed versions to be installed and makes builds non-reproducible. This can introduce vulnerable or incompatible releases over time and weakens supply-chain control, even though it is not an immediately exploitable flaw by itself.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest references requests without pinning an exact version, so there is no way to verify whether installation will resolve to a release affected by known advisories. In a skill that performs dynamic API interaction, an HTTP client library is security-relevant, so leaving its resolved version uncontrolled increases the chance of pulling a vulnerable build.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Natural-language strings in the docstring, CLI descriptions, help text, and status/error messages force a specific language for all users. Under the policy, locale constraints should either be optional/opt-in or clearly justified as region-specific; that justification is not present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Natural-language strings in the docstring, error messages, and argument descriptions force a specific language without offering opt-in or documenting a justified region-specific constraint. This matches the language/locale policy violation category for all file types.

Content

No source excerpt is available for this finding.