创意生图 Creative Scene

• Outcome: Review
• Latest audit: Sep 10, 2026 · 1:52 AM UTC
• Version: 1.0.8

Overview

The skill is mostly a coherent image-generation helper, but its bundled provider code allows credential-bearing requests and image downloads to unvalidated URLs, which deserves review before use.

Install only if you are comfortable with this skill sending prompts and reference images to external generation providers. Prefer trusted local image paths or known public image URLs, avoid running it in networks with sensitive internal HTTP services, do not set ARK_BASE_URL unless you fully trust the endpoint, and use a sandboxed environment with only the provider API keys needed for the selected backend.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/providers.mjs:290
• Finding: Ark API Credential Exfiltration Through an Unrestricted Custom Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/providers.mjs:290-301` **Vulnerability Type**: Arbitrary credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```js describe(req) { return `POST ${env.ARK_BASE_URL || 'https://ark.cn-beijing.volces.com/api/v3'}/images/generations model=${ark.model() || '<需设 ARK_MODEL>'}` }, async run(req) { if (!ark.model()) throw new Error('火山方舟需指定模型：export ARK_MODEL=<你开通的 seedream 模型 ID>') const base = env.ARK_BASE_URL || 'https://ark.cn-beijing.volces.com/api/v3' const body = { model: ark.model(), prompt: req.prompt, size: req.size || '2K', response_format: 'url', watermark: false, } if (req.images?.length) body.image = await Promise.all(req.images.map(asDataUri)) const j = await postJson(`${base}/images/generations`, body, { authorization: `Bearer ${env.ARK_API_KEY}` }, req.timeoutMs) ``` ### Technical Analysis The Ark provider permits `ARK_BASE_URL` to override the official service endpoint without validating the URL scheme, hostname, port, resolved IP address, or redirect behavior. The code then unconditionally attaches `ARK_API_KEY` as a bearer credential to the selected endpoint. As a result, any party capable of influencing the process environment can redirect an otherwise legitimate Ark request to an attacker-controlled server. The request may contain: - The Ark API key in the `Authorization` header. - The user's generation prompt. - Base64-encoded local reference images. - Remote image URLs supplied as references. - Generation parameters and model identifiers. Supporting a completely arbitrary credential-bearing endpoint is not required for the Skill's declared image-generation functionality. It exceeds the minimum network privileges needed to communicate with the official Ark service. ### Attack Path 1. The attacker gains influence over the environment used to invoke the Skill, such as through a wrapper script, CI configuration, inherite ...[truncated 1225 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `ARK_BASE_URL` configurability unless it is operationally necessary. 2. If custom endpoints are required, parse the endpoint with `new URL()` and enforce: - HTTPS only. - An explicit hostname allowlist. - Approved ports only. - No embedded username or password. - No loopback, private, link-local, multicast, or cloud metadata destinations. 3. Revalidate every redirect destination or disable automatic redirects. 4. Attach `ARK_API_KEY` only when the final destination exactly matches an approved Ark hostname. 5. Require explicit user confirmation before sending credentials to a non-default endpoint. 6. Document the endpoint override and associated data flow. 7. Avoid including credentials or request contents in error messages and logs. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/providers.mjs:24
• Finding: Server-Side Request Forgery and Sensitive Data Relay Through Unrestricted Image URLs<![CDATA[ ## Vulnerability Details **File Locations**: `scripts/lib/providers.mjs:24-39`, `scripts/lib/providers.mjs:146-153`, `scripts/lib/providers.mjs:201-209`, and `scripts/gen.mjs:218-233` **Vulnerability Type**: Unrestricted URL fetching, SSRF, and unbounded remote content processing **Risk Level**: High ### Vulnerable Code From `scripts/lib/providers.mjs:24-39`: ```js const isUrl = (s) => /^https?:\/\//i.test(s) const MIME = { '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.png': 'image/png', '.webp': 'image/webp', '.gif': 'image/gif', } const mimeOf = (p) => MIME[path.extname(p).toLowerCase()] || 'image/jpeg' async function asBase64(p) { if (isUrl(p)) { const r = await fetch(p) if (!r.ok) throw new Error(`拉取参考图失败 ${r.status}: ${p}`) return Buffer.from(await r.arrayBuffer()).toString('base64') } return (await readFile(p)).toString('base64') } ``` From `scripts/lib/providers.mjs:146-153`: ```js if (req.quality) fd.append('quality', req.quality) for (const p of req.images) { const buf = isUrl(p) ? Buffer.from(await (await fetch(p)).arrayBuffer()) : await readFile(p) fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p)) } r = await fetch('https://api.openai.com/v1/images/edits', { method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd, }) ``` From `scripts/lib/providers.mjs:201-209`: ```js const key = env.GEMINI_API_KEY || env.GOOGLE_API_KEY const parts = [{ text: req.prompt }] for (const p of req.images || []) { parts.push({ inline_data: { mime_type: mimeOf(p), data: await asBase64(p) } }) } const j = await postJson( `https://generativelanguage.googleapis.com/v1beta/models/${gemini.model()}:generateContent`, { contents: [{ parts }] }, { 'x-goog-api-key': key }, req.timeoutMs, ) ``` From `scripts/gen.mjs:218-233`: ```js async function persist(files, savePath, req) { if (!files?.length) return [] const out = [] for (const [i, f] of files.entries()) { let ...[truncated 3834 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Centralize all remote downloads in a hardened URL-fetching function. 2. Parse URLs with `new URL()` and permit only `https:` unless HTTP is explicitly required. 3. Resolve hostnames before connecting and reject: - IPv4 and IPv6 loopback ranges. - RFC 1918 private ranges. - Link-local ranges. - Carrier-grade NAT ranges. - Multicast and unspecified addresses. - Known cloud metadata destinations. 4. Disable redirects or validate the hostname and resolved address after every redirect. 5. Apply an allowlist for provider-returned asset hosts. 6. Set strict connection, header, and body timeouts. 7. Stream response bodies while enforcing a maximum byte count instead of using unrestricted `arrayBuffer()`. 8. Validate that the response content type is an expected image or video type. 9. Verify file signatures rather than trusting URL extensions. 10. Avoid forwarding remotely fetched content to another provider unless the user explicitly authorized that data flow. 11. Run generation code in a network-restricted sandbox that cannot access local services or cloud metadata. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/provider-cli.md:63
• Finding: Execution of Registry-Downloaded Code Through the Documented npx Workflow< · npm 包 `@dlazy/cli` ``` ### Technical Analysis The documented `npx` workflow downloads and executes code from the npm registry. The package version is pinned, which reduces unintended upgrades, but the documentation does not provide a cryptographic checksum, signature-verification procedure, committed lockfile, vendored artifact, or locally reviewed package copy. Execution through `npx` gives the downloaded package code the same operating-system privileges as the invoking user. This includes runtime code and any applicable npm package lifecycle behavior. If the registry account, published package artifact, registry resolution path, or local npm configuration is compromised, the effective code executed by the user may differ from the code reviewed in this project. The audit did not establish that `@dlazy/cli@1.2.3` is malicious. The finding concerns the unsafe supply-chain execution pattern and lack of local integrity controls. ### Attack Path 1. The user follows the Skill's documented setup or invocation instructions. 2. The user runs: ```bash npx @dlazy/cli@1.2.3 <command> ``` 3. `npx` resolves and retrieves the package through the configured npm registry. 4. npm executes package code with the current user's privileges. 5. If the retrieved artifact or registry path has been compromised, attacker-controlled code executes locally. 6. The code may access files, environment variables, locally stored API credentials, and network resources available to that user. ### Impact Assessment A compromised package can execut ...[truncated 566 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a locally installed, reviewed dependency recorded in a committed lockfile with npm integrity hashes. 2. Provide a cryptographic checksum or signed release artifact and require verification before execution. 3. Pin both the package version and the expected artifact integrity value. 4. Publish reproducible-build instructions that allow users to compare registry artifacts with the linked source repository. 5. Run the CLI in a sandbox or container with: - No unnecessary filesystem access. - Only required environment variables. - Restricted outbound network access. - No administrative privileges. 6. Avoid exposing unrelated API keys or credentials to the CLI process. 7. Consider vendoring a reviewed CLI implementation when package size and licensing permit. 8. Clearly warn users that `npx` retrieves and executes third-party code. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description includes very broad trigger phrases such as “生成一张” and “随便来张图”, which are common conversational expressions and can cause the skill to activate outside the user's intended context. In an agent environment, overbroad activation can route unrelated user requests into an image-generation workflow, leading to unintended tool use, cost incurrence, or confusing behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The configuration hard-codes a model ethnicity ('East Asian woman') into a shared brand file that is reused across image-generation skills, which can systematically constrain outputs by race without user opt-in or documented business/legal necessity. In a generative media pipeline, this creates bias, exclusion, and potential discriminatory treatment across many SKUs or campaigns because the setting is centralized and automatically injected into prompts.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/lib/providers.mjs:104

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/gen.mjs:118

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/lib/providers.mjs:21