Yu Product Image Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:53 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches product-image generation, but it embeds credentials and can upload or send user images to outside services without clear disclosure or recipient control.

Review this skill before installing. It should not ship shared API keys or Feishu app secrets, and users should be clearly told when product photos are uploaded to Grsai or sent through Feishu. Require your own credentials, remove the hardcoded Feishu recipient, make remote uploads opt-in, and add download and HTML escaping safeguards before using it with private product assets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: utils/feishu_sender.py:13

Finding

Hardcoded API Keys and Feishu Application Credentials

Content

View full analysis

" # Default API Key DEFAULT_API_KEY = "" ``` ```python # config/settings.py:4-12 NANO_BANANA_API_KEY = "" NANO_BANANA_ENDPOINT = "https://grsai.dakka.com.cn" NANO_BANANA_MODEL = "nano-banana-pro" NANO_BANANA_TIMEOUT = 120 NANO_BANANA_MAX_RETRIES = 3 VOLCENGINE_API_KEY = "" VOLCENGINE_ENDPOINT = "https://ark.cn-beijing.volces.com/api/v3" ``` ```python # utils/feishu_sender.py:13-16 APP_ID = "" APP_SECRET = "" ``` ### Technical Analysis The project embeds service credentials directly in source files. The Nano Banana key is duplicated in runtime code, test code, configuration, and an executable demonstration block. A Volcengine key and Feishu application secret are also committed in plaintext. Any person or automated system able to download the Skill package can extract these credentials without executing the project. The runtime also automatically uses the embedded Nano Banana key, removing the security boundary that would normally require each operator to supply an authorized credential. Source-code deletion alone is insufficient if the repository or package has already been distributed because the credentials may remain in cached copies, release archives, logs, or version-control history. ### Attack Path 1. An attacker obtains the published Skill package or repository contents. 2. The attacker searches the source for key and secret patterns. 3. The attacker ...[truncated 912 chars]

Remediation

View remediation

other

Error

• Location: core/image_generator.py:187

Finding

Undisclosed Upload of Original User Images to a Third-Party Generation Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: main.py:333

Finding

Generated Images Can Be Sent to a Hardcoded Feishu Recipient

Content

View full analysis

Dict[str, Any]: if not self.state['generated_images']: return {'status': 'error', 'message': '没有可发送的图片'} if user_id is None: user_id = "ou_9ac9a7fa7050b46022dcdaf6c02a3ee3" print("\n📤 准备发送到飞书...") product_name = self.state.get('analysis', {}).get( 'product_type', '产品' ) scheme_name = ( self.state.get('selected_scheme', {}).name if self.state.get('selected_scheme') else '默认风格' ) message = ( f"🎨 商品图生成完成！\n" f"产品：{product_name}\n" f"风格：{scheme_name}\n" f"共{len(self.state['generated_images'])}张图片" ) send_feishu_message(message, user_id) success_count = send_feishu_images( self.state['generated_images'], user_id ) ``` ```python # utils/feishu_sender.py:88-127 def send_feishu_images( image_paths, user_id="ou_9ac9a7fa7050b46022dcdaf6c02a3ee3" ): if not image_paths: print("⚠️ 没有图片需要发送") return 0 token = get_access_token() if not token: return 0 success_count = 0 for i, image_path in enumerate(image_paths, 1): if not os.path.exists(image_path): continue image_key = upload_image(token, image_path) if not image_key: continue if send_image_to_user(token, user_id, image_key): success_count += 1 return success_count ``` ### Technical Analysis The Feishu integration uses a fixed Open ID whenever the caller does not supply a recipient. The source comment describes this behavior as defaulting to the “current user,” but no authenticated identity lookup or binding exists. The Sk ...[truncated 1356 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: core/image_generator.py:300

Finding

Server-Controlled Download URLs Permit Blind SSRF and Unbounded File Downloads

Content

View full analysis

str: try: response = requests.get(url, timeout=30) response.raise_for_status() timestamp = datetime.now().strftime('%Y%m%d_%H%M%S') filename = f"generated_{timestamp}_{index}.png" save_path = os.path.join(save_dir, filename) with open(save_path, 'wb') as f: f.write(response.content) ``` ### Technical Analysis The Grsai response controls the URL passed to `requests.get()`. The code does not validate: - URL scheme. - Destination hostname. - Resolved IP address. - Redirect destination. - Whether the destination is loopback, private, link-local, or otherwise internal. - Response content type or actual image signature. - Maximum response size. If the upstream service, its response path, or an intermediary is compromised, it can make the runtime issue HTTP requests from the host’s network position. This is a blind SSRF condition because the response is written to a local file rather than returned directly to the upstream service through this code. Because `response.content` buffers the complete response and no size limit is enforced, an oversized response can also consume memory and disk space. ### Attack Path 1. An attacker gains control over a generation-result URL, su ...[truncated 1314 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: core/image_packager.py:77

Finding

Unescaped Product Names Allow Script Injection in Generated Preview HTML

Content

View full analysis

str: timestamp = datetime.now().strftime('%Y%m%d_%H%M%S') html_filename = f"预览_{product_name}_{timestamp}.html" html_path = os.path.join(self.output_dir, html_filename) html_content = f""" {product_name} - 商品图预览 ``` ```python # core/image_packager.py:118-123

{product_name} - 商品图预览

""" ``` ```python # core/image_packager.py:130-152 for idx, img_path in enumerate(image_paths, start=1): img_rel_path = os.path.relpath(img_path, self.output_dir) html_content += f"""

图{idx}

""" html_content += """

""" with open(html_path, 'w', encoding='utf-8') as f: f.write(html_content) ``` ### Technical Analysis `product_name` is interpolated directly into both the document title and an HTML heading. No HTML escaping or template auto-escaping is applied. A product name containing markup such as an image element with an event handler becomes active HTML when the preview is opened. For example, a value structurally equivalent to: ```html ``` is inserted into the `

` element and interpreted by the browser. The same value is also incorporated into the output filename without sanitization. Path separator injection may cause unexpected subpaths or write failures. A reliable escape from the output directory is not established solely by the sho ...[truncated 1295 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes a feature-rich AI product image generation skill. However, the supplied code chunk does not implement those features; it only stores configuration values for external image-generation providers and includes hardcoded API keys and endpoints. While using image-generation APIs is broadly related to the stated domain, this chunk materially exposes undeclared credential handling and does not substantiate several headline capabilities in the description. Therefore, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says this skill is an AI product image generator with multiple plan selection, 12-language support, storyboard planning, and batch generation. However, the supplied code is an image analysis module: it reads image files, checks existence, base64-encodes them, and returns mocked product attributes and selling points based on filename keywords. It also supports analyzing multiple images and merging selling points. The primary purpose is materially different: analysis of product images rather than generation of product images. The advertised capabilities such as multilingual support, storyboard planning, and image generation are not implemented in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code is broadly related to AI image generation and does support batch generation, so part of the description is accurate. However, several prominently declared capabilities are not substantiated by this code chunk: there is no implementation of storyboard planning, no real 12-language handling beyond a binary Chinese/non-Chinese prompt format, and no clear multi-scheme selection workflow beyond accepting external scheme/shot objects in prompt construction. Additionally, the code performs network calls to external API endpoints, reads local reference image files, and writes downloaded images to local storage, none of which are reflected in the declared permissions. The hardcoded API key in the test block is also a notable security issue. Overall, the description overstates implemented features and omits important operational behaviors/resources.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents this skill as an AI商品图生成器 with advanced generation-related features such as multiple方案选择, multilingual support, 分镜规划, and 批量生成. However, the supplied code chunk does not generate images or implement any AI functionality. Instead, it packages already-existing image files into a ZIP, creates a preview HTML page, and deletes old files from an output directory. ZIP packaging and preview generation could be supporting utilities within a larger image-generation system, but this code chunk by itself materially differs from the declared primary purpose and omits the headline capabilities in the description. It also includes a file cleanup capability that is not reflected in the declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The declared description presents a broader AI product image generation skill with multiple advanced capabilities: multi-option selection, 12-language support, storyboard planning, and batch generation. The supplied code chunk is much narrower. It defines static style templates, chooses an order for three schemes based on product type, instantiates dataclass objects, and formats them for display. There is no code for generating images, invoking AI models, translating/localizing into multiple languages, planning storyboards/shots, or processing batches. The primary purpose of the code is scheme recommendation/template selection, which is only a partial and materially narrower subset of the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The core declared purpose is broadly accurate: the code supports multiple方案 selection, 12 language options, composition/storyboard planning, and generation of multiple product images. However, the implementation also includes undeclared capabilities that are materially significant: it can send messages and generated images to Feishu, package outputs into ZIP files for download/preview, and uses a hardcoded API key for an external image-generation service. These are not mentioned in the description or permissions. Because outbound delivery to a third-party messaging platform is a meaningful extra capability beyond simple image generation, this should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a feature-rich AI product image generator with multi-solution selection, 12-language support, storyboard planning, and batch generation. The code actually is a test script for a specific external image API. It generates three fixed scenes for one product image, using hardcoded prompts in Chinese, a hardcoded API key, and hardcoded local input/output paths. While it does perform image generation and a small batch of outputs, key advertised capabilities are missing or not implemented in a general way: there is no multi-option selection interface, no multilingual handling, and no real storyboard planning beyond three manually defined prompts. Additionally, the script performs undeclared external API access and local file read/write operations, which are materially relevant capabilities given that declared permissions are empty. Therefore the description does not accurately represent the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on generating product images, multilingual support, storyboard planning, and batch generation. However, this code does not generate images, perform language handling, or do storyboard planning. Its actual purpose is outbound messaging/file transfer to Feishu. That is a materially different capability and involves external network access plus hardcoded credentials, neither of which is reflected in the declared purpose or permissions. While such messaging could theoretically support a larger image workflow, this specific code chunk primarily implements Feishu delivery functionality, which is undeclared and therefore a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description presents a broad AI product image generation skill with multilingual support, storyboard planning, and batch generation. However, the supplied code chunk only performs post-processing on existing images by drawing text overlays using PIL. It does not generate images, invoke any AI model, manage multiple方案, support 12 languages beyond whatever text the font can render, plan storyboards, or handle batch workflows. While text overlay could be a supporting feature for marketing/product images, this chunk’s actual behavior is materially narrower than the declared primary purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file contains hardcoded live-looking API credentials directly in source code, which creates immediate risk of credential theft, unauthorized API usage, billing abuse, and possible downstream compromise of connected services. In a distributed skill/plugin context, source files may be exposed to users, repositories, logs, or package artifacts, making embedded secrets especially dangerous.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · core/image_generator.py (reported line 344)May include surrounding context.

python

else:
            prompt = f"{base_prompt}, {style_desc}, {shot_desc}, high quality, professional photography"
        
        return prompt
    
    def build_negative_prompt(self) -> str:
        """构建负面提示词"""

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module contains a hard-coded API key in the main test block. Embedding a live secret in source code is a real credential exposure risk because anyone with repository or package access can reuse the key to make unauthorized API calls, incur cost, or access associated account resources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A hardcoded external API key is embedded directly in source and automatically used to initialize the image generator. Embedded secrets are easily exposed through source distribution, logs, or repository history, enabling unauthorized use of the external service and potentially access to billing-linked or sensitive account capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The Feishu app ID and secret are hardcoded in source, exposing reusable credentials to anyone with code access and enabling unauthorized token issuance. This can allow abuse of the associated Feishu application for message sending, file upload, or other API actions, and it also demonstrates unsafe secret-handling practices.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The code explicitly accesses Feishu credentials to mint access tokens, which is a sensitive capability and becomes dangerous when paired with hardcoded secrets and message-sending functions. In this skill context, credential use is not transparently limited to the stated purpose, increasing the chance of unauthorized external communication or account abuse.

Content

Scanner excerpt · utils/feishu_sender.py (reported line 19)May include surrounding context.

python

APP_SECRET = "V40tXt3QwXuDBJKlGPN9pdwFqxgBhwYh"

def get_access_token():
    """获取飞书 access token"""
    url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    headers = {"Content-Type": "application/json"}
    data = {"app_id": APP_ID, "app_secret": APP_SECRET}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The configuration explicitly sends data to third-party API endpoints, but there is no accompanying user-facing disclosure that prompts, product images, or related content may leave the local environment. For a product-image-generation skill, users may upload proprietary marketing assets or sensitive business content, so undisclosed external transmission increases privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains module documentation, class/method docstrings, comments, and display strings in Chinese only, with no indication that the user can choose another language or that the skill is intentionally region-specific. The policy explicitly flags language or locale constraints when they are imposed without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code presents its primary description and user-facing text in a single forced language, which can violate language/locale policy when no user opt-in or alternative is offered. The file contains no indication that Chinese-only behavior is intentional, configurable, or limited to a region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code base64-encodes local reference images and sends them, along with prompts, to a third-party remote API without any consent check, warning, or data-classification guard at the transmission point. In a product-image workflow, those files may contain proprietary product photos, unreleased designs, or sensitive branding assets, so silent exfiltration to an external service creates a genuine privacy and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · core/image_generator.py (reported line 228)May include surrounding context.

python

) -> List[str]:
        """调用 API（内部方法）"""
        
        response = requests.post(
            self.endpoint,
            headers=headers,
            json=payload,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file’s natural-language descriptions and user-facing intent are entirely Chinese (for example, the module and class docstrings), which indicates a fixed language/locale choice. Under the policy, forcing a specific language without offering user choice or documenting a justified region-specific constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

When reference mode is enabled, user-provided images are passed to the external generator service without any explicit disclosure at the point of use that the files leave the local environment. Because product images may contain proprietary designs, branding, or customer data, silent transfer to a third party creates a real privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill includes a built-in capability to send generated images and metadata to Feishu, including a hardcoded default recipient when no user_id is supplied. That creates an outbound data-transfer path unrelated to the core image-generation function and risks accidental disclosure of user content to an unintended party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code sends generated images plus product metadata to Feishu without a clear privacy notice or explicit confirmation immediately before transmission. This can leak commercially sensitive assets and descriptive metadata to external messaging infrastructure or to the wrong recipient, especially given the default recipient fallback.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.