ClawHub
Back to skill

Security audit

Chenyu Aigc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Chenyu Studio API helper, with expected third-party media upload and task-management risks users should understand.

Install only if you trust Chenyu Studio with the prompts, images, videos, and task metadata you submit. Verify CHENYU_BASE_URL before use, prefer a scoped API key if available, avoid sensitive local media, use a private temporary file instead of /tmp/payload.json for base64 payloads, delete it after submission, and confirm task IDs before canceling or deleting completed tasks.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes very broad phrases such as 'generate video', 'create AI video', and '生成图片', which can match many ordinary user requests and cause the skill to activate when the user did not specifically intend to use this external API integration. Because this skill can submit remote generation jobs that consume credits and send user prompts or media to a third-party service, unintended invocation has both cost and data-exposure implications.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation explicitly instructs users to base64-encode a local image, write it into a JSON file, and submit it to a remote API using an authenticated request, but it provides no warning that this transfers local file contents off-device. In an agent skill context, that omission is security-relevant because users may not realize sensitive local images are being exfiltrated to an external service.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill documents a DELETE operation for completed tasks without any warning, confirmation pattern, or guidance about irreversible deletion. In an agent context, this increases the chance of accidental destructive actions, causing loss of execution history, outputs, or auditability if a user or upstream instruction triggers cleanup unexpectedly.

External Transmission

Medium
Category
Data Exfiltration
Content
When a local image needs to be sent as a data URI:

- **Do NOT** inline large base64 strings directly in `curl -d '...'` shell arguments — this will fail due to OS/shell argument length limits before the request even reaches the API.
- **Do** write the full JSON body to a temporary file, then submit with `curl --data @payload.json`.

```bash
Confidence
88% confidence
Finding
This section specifically guides users to package local image data as a data URI and send it to the external API, which creates a real risk of unintentionally transmitting sensitive local content. The danger is amplified by the lack of any disclosure, consent, retention, or handling guidance for the local data being exported.

External Transmission

Medium
Category
Data Exfiltration
Content
EOF

# 2. Submit using @file reference
curl -s -X POST "$CHENYU_BASE_URL/api/v1/aigc/recipes/{recipe_id}/execute" \
  -H "Authorization: Bearer $CHENYU_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
Confidence
87% confidence
Finding
The concrete `curl --data @/tmp/payload.json` example operationalizes exfiltration of local image contents to a remote endpoint using an API key, again without any warning to the user. It also introduces a secondary local exposure risk because sensitive base64 image data is written to a predictable temporary file path.

Static analysis

No suspicious patterns detected.