Yu Product Image Generator

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 1.0.0

Overview

This image-generation skill has real external-service behavior and embedded credentials that are not fully disclosed to users.

Review carefully before installing. Use only with non-sensitive product images, assume prompts and reference images may leave your machine, and do not rely on the bundled credentials or Feishu integration without rotating/removing secrets and making recipients explicit.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tainted flow: 'image_url' from requests.get (line 139, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

images = result_data.get('images', [])
                        if images:
                            image_url = images[0]
                            img_resp = requests.get(image_url, timeout=30)
                            output_path = os.path.join(OUTPUT_DIR, output_name)
                            with open(output_path, 'wb') as f:
                                f.write(img_resp.content)

• Confidence: 92% confidence
• Finding: The script takes an image URL returned by the external API and immediately fetches it without validating the scheme, host, or expected CDN domain. If the upstream service is compromised or returns attacker-controlled URLs, this can trigger server-side requests to unintended destinations, leak network metadata, or download untrusted content.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions, yet static analysis indicates capabilities for environment access, file read/write, and network use. That mismatch is dangerous because it hides the true trust boundary of the skill and can enable data exfiltration, local file access, or unintended external communication without informed user or platform approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is image generation, but the analyzed behavior includes sending messages/images to Feishu, uploading local files to external services, and using hardcoded credentials. This is dangerous because it introduces undisclosed outbound data flows and embedded secrets, creating risk of credential compromise, unauthorized data sharing, and abuse of connected third-party accounts.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module advertises analysis of uploaded product images, but the implementation does not inspect image contents and instead derives outputs from filename keywords. This can mislead downstream users or agents into trusting fabricated product attributes and selling points, causing incorrect business decisions or unsafe automation based on false data.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The function reads and encodes the image but then ignores that data and returns simulated results, creating a deceptive implementation gap between apparent and actual behavior. In an agent skill, this is dangerous because other components may assume genuine visual analysis occurred and act on unverified metadata.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file contains a hardcoded API key in the test block, which is a real secret-exposure vulnerability. Anyone with access to the code can reuse the credential to make unauthorized API calls, incur cost, and potentially access account-associated data or service quotas.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can transmit generated images and product metadata to Feishu, and if no user_id is supplied it defaults to a hard-coded recipient. That creates an unauthorized external sharing path that can leak customer assets or sensitive product information without informed user action, which is more dangerous because the skill's stated purpose is image generation rather than third-party exfiltration or notification routing.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: A live API key is hard-coded directly in the test script, which exposes the credential to anyone with repository or artifact access and makes accidental leakage very likely. Exposed keys can be abused for unauthorized API usage, billing fraud, and access to associated tenant resources.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The file contains direct enterprise messaging to a specific Feishu open_id by default, enabling generated images or messages to be sent to a fixed recipient without runtime confirmation. In the context of an image-generation skill, this creates a real risk of unauthorized disclosure of generated outputs or user-supplied text to an unintended third party.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains live-looking hardcoded API credentials for two external services directly in source code. Embedding secrets in a shipped skill makes them accessible to anyone with repository, package, or runtime access, enabling unauthorized API use, quota theft, billing abuse, and potential compromise of connected service data or generation workflows.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code reads local reference image files, base64-encodes them, and uploads them to a third-party API without any built-in consent, filtering, or sensitivity checks. This creates a real data-exfiltration risk if callers pass sensitive local files or do not understand that local content is being transmitted off-host.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A hard-coded API key in source code is a credential exposure vulnerability: anyone with repository or package access can reuse the key, incur costs, impersonate the service, or access associated provider resources. Because this skill invokes an external image generator, compromise of the key can directly enable unauthorized third-party API use and uncontrolled data submission.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function sends user-supplied reference images to an external generator when reference mode is enabled, but there is no explicit notice, consent flow, or data-handling disclosure. This can expose proprietary product photos or customer content to a third-party service unexpectedly, which is especially relevant in a commercial product-image workflow where source assets may be confidential pre-release materials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends generated images plus product metadata such as product type and chosen style to Feishu without a clear disclosure or confirmation step. This creates a covert external sharing channel and may leak commercially sensitive creative assets or business information to unintended recipients, amplified by the hard-coded default recipient behavior in the same method.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script base64-encodes a local image and transmits it to a third-party API, but provides no explicit consent prompt, privacy notice, or safeguards around what local content may be uploaded. This creates a data exfiltration/privacy risk, especially because the file path points to a user-local workspace that may contain proprietary or personal media.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The Feishu APP_ID and APP_SECRET are hardcoded in source, allowing anyone with code access to reuse them to mint tenant access tokens and interact with the associated Feishu tenant. Embedded secrets are easily leaked through repositories, logs, backups, or package distribution and can lead to unauthorized messaging or broader API abuse.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Local image files are uploaded to Feishu without any explicit warning, confirmation, or data-classification check. In this skill context, generated or source product images may contain sensitive business assets, customer data, or internal materials, so silent external transmission increases confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The function sends arbitrary text content to Feishu without clear disclosure that user-provided or system-generated content leaves the local environment. That creates a real data leakage risk if prompts, metadata, or sensitive business text are passed through this helper in an image-generation workflow.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.