apifox-image-gen

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:06 AM UTC
• Version: 1.0.0

Overview

This image-generation skill does what it claims, but it needs review because it bundles an API key and can download and write API-controlled content without strong limits.

Install only if you are comfortable sending image prompts to jyapi.AI-WX.CN and accepting a bundled shared API key. Avoid sensitive prompts, avoid using --output outside a disposable directory, and prefer a revised version that loads the API key from user-controlled secrets, restricts download hosts, validates image content and size, and prevents overwriting arbitrary files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: image_gen.py:14

Finding

Hard-Coded API Credential Exposed in Source Code

Content

View full analysis

Vulnerability Details

File Location: image_gen.py, lines 14-24
Vulnerability Type: Hard-coded secret and insecure credential management
Risk Level: High

Vulnerable Code

python

API_KEY = "sk-hJP0yrKv2H7A4mjy39D8C3D5Dd17492494A65f4bCbE9859e"
BASE_URL = "https://jyapi.AI-WX.CN"

def generate_image(prompt, model="gpt-image-1.5", size="1024x1024", n=1, image=None):
    url = f"{BASE_URL}/v1/images/generations"
    
    headers = {
        "Authorization": API_KEY,
        "Content-Type": "application/json"
    }

Technical Analysis

A live-looking API credential is embedded directly in the distributed Python source and transmitted in the authorization header on every generation request. Anyone who can read the Skill package can extract and reuse the credential outside the intended application.

Authentication is necessary for the declared image-generation functionality, but embedding a shared credential in source code is not necessary and violates least-privilege credential-management practices. The key cannot be isolated per user, rotated without changing the package, or protected using filesystem or secret-manager controls.

Attack Path

1. An attacker obtains or reads the Skill package.
2. The attacker extracts the API_KEY value from image_gen.py.
3. The attacker sends independent requests to the configured API using the extracted authorization value.
4. Requests are attributed to the exposed credential until the service revokes or rotates it.

Impact Assessment

Exploitation may permit unauthorized use of the API account associated with the credential. The scope includes consumption of API quota, potential billing impact, service abuse, rate-limit exhaustion, and loss of reliable request attribution. The exposed key does not directly grant local system privileges, but it grants whatever remote API permissions are assigned to that credential.

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed credential.
2. Remove all credentials from source code and repository history.
3. Read the credential from a protected environment variable or secret manager:

   python

   API_KEY = os.environ.get("APIFOX_API_KEY")
   if not API_KEY:
       raise RuntimeError("APIFOX_API_KEY is not configured")
   

4. Use a dedicated credential with only the permissions and quota required for image generation.
5. Prefer per-user or short-lived credentials instead of a shared package-level secret.
6. Add automated secret scanning to development and release workflows.
7. Confirm the API's required authorization scheme and use the documented header format.

T09 · Insecure Skill Coding Practices

Error

• Location: image_gen.py:47

Finding

Unvalidated Server-Controlled Image Download URL

Content

View full analysis

Vulnerability Details

File Location: image_gen.py, lines 47-54 and 91-99
Vulnerability Type: Unrestricted URL retrieval and server-side request forgery risk
Risk Level: High

Vulnerable Code

python

def download_image(url, save_path=None):
    if not save_path:
        save_path = f"/tmp/image_{uuid.uuid4().hex[:8]}.png"
    
    try:
        urllib.request.urlretrieve(url, save_path)
        return save_path
    except Exception as e:
        return None

python

for i, img in enumerate(images):
    img_url = img.get("url")
    if img_url:
        if args.output:
            save_path = args.output
        else:
            save_path = f"/tmp/generated_image_{i+1}_{uuid.uuid4().hex[:8]}.png"
        
        downloaded = download_image(img_url, save_path)

Technical Analysis

The remote image-generation service controls the url field returned in each response. The program passes that value directly to urllib.request.urlretrieve without validating the URL scheme, destination host, resolved IP address, redirects, content type, response size, or file signature.

If the external service, its account, or an upstream component is compromised, it can cause the Agent to request arbitrary network locations accessible from the Agent's environment. This creates a server-side request forgery primitive. Depending on supported URL handlers and runtime configuration, unexpected non-HTTPS resources may also be accepted.

The implementation also trusts that the downloaded response is an image. A malicious endpoint can return arbitrary or excessively large content, resulting in disk consumption or attacker-controlled data being written to the selected destination.

Attack Path

1. An attacker gains influence over the configured API response or compromises the remote service.
2. The service returns an image object whose url points to an internal, loopback, link-local, ...[truncated 985 chars]

Remediation

View remediation

Remediation Suggestions

1. Permit only https download URLs.
2. Maintain an explicit allowlist of trusted image-delivery hostnames.
3. Resolve the hostname before connecting and reject loopback, private, link-local, reserved, multicast, and unspecified IP ranges.
4. Disable automatic redirects or validate the scheme, hostname, and resolved address after every redirect.
5. Replace urlretrieve with a bounded streaming download that enforces:
   • A strict connection and read timeout.
   • A maximum response size.
   • A maximum redirect count.
   • An expected image content type.
6. Verify downloaded file signatures using a trusted image parser before treating the content as an image.
7. Execute downloads in a network-restricted environment that can reach only the API and approved content hosts.
8. Delete partial files when validation or download fails.

T09 · Insecure Skill Coding Practices

Error

• Location: image_gen.py:91

Finding

Caller-Controlled Output Path Allows Arbitrary File Overwrite

Content

View full analysis

Vulnerability Details

File Location: image_gen.py, lines 69-70 and 91-99
Vulnerability Type: Unrestricted file write and unsafe path handling
Risk Level: High

Vulnerable Code

python

parser.add_argument('--output', '-o', help='Output file path')

python

for i, img in enumerate(images):
    img_url = img.get("url")
    if img_url:
        if args.output:
            save_path = args.output
        else:
            save_path = f"/tmp/generated_image_{i+1}_{uuid.uuid4().hex[:8]}.png"
        
        downloaded = download_image(img_url, save_path)

The selected path reaches the following write operation:

python

urllib.request.urlretrieve(url, save_path)

Technical Analysis

The --output argument accepts an unrestricted filesystem path. The path is used as the destination of urlretrieve without canonicalization, directory confinement, an existing-file check, or symlink protection.

A caller who can influence command-line arguments can therefore select any file writable by the Agent's operating-system account. Existing files may be replaced. A pre-created symbolic link can also redirect the write to another writable target.

This exceeds the minimum privileges required by the declared functionality, which states that generated images are saved under /tmp/. Image generation requires writing an output image, but it does not require unrestricted write access to arbitrary filesystem locations.

Attack Path

1. An attacker or untrusted caller influences the arguments passed to the Skill through its permitted execution interface.
2. The attacker supplies a sensitive writable location using --output.
3. The image API returns a URL, potentially containing attacker-controlled non-image content if combined with the unvalidated download issue.
4. urlretrieve opens the selected destination and writes the downloaded response.
5. The target file is created ...[truncated 803 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict all generated files to a dedicated output directory owned by the Skill.
2. Resolve the canonical destination and verify that it remains beneath the approved directory.
3. Accept a filename rather than an arbitrary absolute path, and reject path separators and traversal components.
4. Reject symbolic links and use operating-system flags that prevent following symlinks.
5. Create new files atomically with restrictive permissions and fail if the destination already exists.
6. Generate unique destinations for every image when n is greater than one.
7. Validate the downloaded content as an image before moving it to the final destination.
8. Run the Skill under a dedicated, low-privilege account with no write access to configuration, executable, or persistence-sensitive locations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill declares simple image generation, but the finding indicates the underlying behavior also includes a hardcoded API key and downloading remote content to the local filesystem. That creates hidden trust and data-handling risks not disclosed in the skill description, including credential exposure and unsafe persistence of untrusted remote data.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 98% confidence

Finding

The script performs outbound network access to a third-party API and to arbitrary image URLs, but this capability is not declared in the skill permissions. Undeclared network behavior is dangerous because it can exfiltrate prompts or other sensitive data and bypass the user's expected trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documentation does not warn users that their prompts are sent to a third-party image-generation API. Users may unknowingly transmit sensitive, proprietary, or personal information to an external service, creating privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

User-supplied prompts are transmitted to an external API without an explicit warning or consent flow. This is risky because prompts may contain sensitive business, personal, or proprietary data that the user does not expect to leave the local environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does more than generate images via an API: it also fetches a remote URL from the API response and writes the content to local disk. This expands the attack surface because a compromised or malicious API could return unexpected URLs, causing unreviewed remote content retrieval and local file creation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Allowing the caller to provide an arbitrary output path permits the tool to write downloaded content anywhere the process has filesystem access. In agent contexts, this can overwrite sensitive files, place files in unexpected locations, or be chained with other behaviors for persistence or tampering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The user-facing description and usage instructions are presented in Chinese throughout the file, with no indication that this language choice is optional or region-specific. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Natural-language strings and documentation in this file are entirely in Chinese, including the module description and CLI help text. There is no indication that the user can choose a language or that the locale restriction is intentional and justified for a region-specific tool.

Content

No source excerpt is available for this finding.