apifox-image-gen

• Analyzed: May 11, 2026, 6:45 AM
• Findings: 1
• Version: 1.0.0
• Hash: e59f0117b00fd4622982386de96d9d8e95d9d045442a1222e4d4d3c41a451d11
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a hardcoded API key in `image_gen.py` and relies on a third-party API proxy (jyapi.AI-WX.CN). It is classified as suspicious due to security vulnerabilities: the hardcoded credential and the use of `urllib.request.urlretrieve` on external API responses, which could potentially be exploited for local file access (SSRF/Local File Read) if the API returns a malicious file URI.