投前 AI 图检测 Detect Task

• Outcome: Review
• Latest audit: Sep 10, 2026 · 1:53 AM UTC
• Version: 1.0.8

Overview

The skill has a coherent image-checking goal, but its bundled tooling can route user images and credentials through broader generation providers and under-scoped provider controls.

Install only if you are comfortable sending the selected images and prompts to dLazy or another configured provider. Prefer the documented dLazy detect workflow, avoid using untrusted ARK_BASE_URL or DLAZY_BIN environment values, review any npx-installed CLI before execution, and keep generated manifests out of shared or published directories if prompts contain confidential information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:215
• Finding: Mandatory Agent Directives Force Use and Promotion of a Commercial Service< > 2. If the execution result returns `code: "unauthorized"` or indicates missing API key, you MUST inform the user to get their API key from [https://dlazy.com/dashboard/organization/api-key](https://dlazy.com/dashboard/organization/api-key) and save it using `dlazy auth set <key>` and resume the task. ``` From `references/model-flags.md`: ```markdown **CRITICAL INSTRUCTION FOR AGENT**: Run the `dlazy claude-sonnet-5` command to get results. ``` From `references/provider-cli.md`: ```markdown **给 Agent 的硬性要求** 1. 命中 `insufficient_balance` → 明确告诉用户算力不足，并给出充值入口 <https://dlazy.com/dashboard/organization/settings?tab=credits> 2. 命中 `unauthorized` / 缺 key → 告诉用户去 <https://dlazy.com/dashboard/organization/api-key> 取 key，用 `dlazy auth set <key>` 存好再继续。 3. 用 `gen.mjs` 时，429 与 5xx 已自动重试；仍失败才向用户报错。 4. **不要**为了「跑通」而偷偷降级参数（尺寸、档位、批量），先问用户。 ``` ### Technical Analysis The Skill contains imperative instructions addressed directly to the hosting Agent, marked as “CRITICAL” and “MUST.” These instructions require the Agent to invoke a specific paid third-party CLI and emit fixed commercial recharge and API-key acquisition links. The declared image-quality inspection functionality requires remote visual inference, but it does not require overriding the Agent's provider selection, purchasing workflow, or user-facing error-handling policy. Provider-specific authentication guidan ...[truncated 1584 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove “CRITICAL,” “MUST,” and equivalent directives addressed to the Agent. 2. Replace them with provider-neutral operational documentation. 3. Require explicit user confirmation before: - Uploading images or prompts to a remote provider. - Starting an authentication flow. - Storing an API key locally. - Directing the user to a purchase or recharge page. 4. Allow the Agent or user to select an approved provider rather than forcing `dlazy`. 5. Report authentication and balance errors neutrally, without mandatory commercial links. 6. Clearly disclose the selected provider, upload destination, retention implications, and estimated cost before execution. 7. Keep provider-specific setup guidance in optional documentation rather than executable Agent instructions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/providers.mjs:287
• Finding: Configurable Ark Base URL Can Exfiltrate API Keys, Prompts, and Local Images<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/providers.mjs:287-301` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```javascript const ark = { id: 'ark', kind: 'http', hasCredentials: () => Boolean(env.ARK_API_KEY), model: () => env.GEN_MODEL_ARK || env.ARK_MODEL, describe(req) { return `POST ${env.ARK_BASE_URL || 'https://ark.cn-beijing.volces.com/api/v3'}/images/generations model=${ark.model() || '<需设 ARK_MODEL>'}` }, async run(req) { if (!ark.model()) throw new Error('火山方舟需指定模型：export ARK_MODEL=<你开通的 seedream 模型 ID>') const base = env.ARK_BASE_URL || 'https://ark.cn-beijing.volces.com/api/v3' const body = { model: ark.model(), prompt: req.prompt, size: req.size || '2K', response_format: 'url', watermark: false, } if (req.images?.length) body.image = await Promise.all(req.images.map(asDataUri)) const j = await postJson(`${base}/images/generations`, body, { authorization: `Bearer ${env.ARK_API_KEY}` }, req.timeoutMs) ``` ### Technical Analysis `ARK_BASE_URL` is accepted directly from the process environment and used as the destination for an authenticated HTTP request. The code does not: - Require the `https:` scheme. - Verify that the hostname belongs to the intended Ark provider. - Prevent embedded credentials or unusual URL components. - Separate official-provider credentials from custom-endpoint credentials. - Require user confirmation when the endpoint differs from the official default. Before transmission, local image files are converted into data URIs by `asDataUri()`. The resulting request body therefore includes the complete prompt and the contents of the selected images. The same request includes `ARK_API_KEY` as a bearer token. An attacker who can influence the process environment can set `ARK_BASE_URL` to an attacker-controlled server and receive all three sensitive elements: the API key, prompt, and image ...[truncated 1450 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `ARK_BASE_URL` configurability unless custom endpoints are a documented requirement. 2. If customization is necessary: - Parse the URL with `new URL()`. - Require `https:`. - Reject usernames, passwords, fragments, and unexpected ports. - Apply an explicit hostname allowlist for official Ark endpoints. 3. Never transmit an official `ARK_API_KEY` to a custom origin. 4. Require a distinct credential variable for custom endpoints. 5. Require explicit user confirmation whenever the destination is not the official provider endpoint. 6. Display the exact destination hostname and data categories before uploading. 7. Disable or strictly validate cross-origin redirects so authorization headers cannot reach an unintended host. 8. Add automated tests proving that HTTP URLs, attacker-controlled hosts, malformed URLs, and redirect chains are rejected. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/provider-cli.md:66
• Finding: Documentation Encourages Direct Execution of a Registry-Downloaded Package< · npm 包 `@dlazy/cli` ``` ### Technical Analysis The documentation recommends `npx` execution of a package retrieved from an external package registry. Although the package version is pinned, the project does not include: - A lockfile recording package integrity. - A verified package checksum. - A vendored or reviewed copy of the package. - Registry pinning or provenance verification. - A requirement for user confirmation before downloading and executing external code. `npx` can download package code and execute its binary with the current user's permissions. Version pinning limits accidental updates but does not protect against registry compromise, account takeover, malicious republishing where allowed, compromised transitive dependencies, or an untrusted registry configuration. ### Attack Path 1. A user follows the provider setup instructions. 2. The user executes `npx @dlazy/cli@1.2.3 <command>`. 3. `npx` resolves and downloads the package and its dependencies from the configured npm registry or local cache. 4. Downloaded package code executes with the user's local account privileges. 5. If the package, dependency graph, registry response, or cache is compromised, malicious code can access files and environment variables available to that user. ### Impact Assessment A compromised package can potentially obtain the privileges of the invoking user, including the ability to: - Read user-accessible files. - Access environment variables containing provider API keys. - Modify project files and user configuration. - Send data over the network. - Install user-level persi ...[truncated 225 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Avoid recommending direct `npx` execution for security-sensitive workflows. 2. Declare the CLI through a project dependency and commit a lockfile containing integrity hashes. 3. Pin the expected npm registry and document how to verify package provenance. 4. Publish and verify checksums or signed release artifacts. 5. Audit the package and its transitive dependencies before distribution. 6. Prefer a vendored, reviewed implementation when feasible. 7. Require explicit user approval before downloading or executing external tools. 8. Run the external CLI with minimum privileges and a restricted environment that excludes unrelated secrets. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/run_loop.mjs:164
• Finding: Automatic Loop Persists Full Prompt History in Plaintext Manifests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run_loop.mjs:164-203` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Low ### Vulnerable Code ```javascript rounds.push({ round: r, prompt, files, risk: report.level, hits: report.hits, advice: report.advice, fixes: report.fixes, compliance, estimatedCredits: genOut.estimatedCredits, elapsedMs: genOut.elapsedMs, }) ``` The complete history is subsequently written to a plaintext manifest: ```javascript const manifestPath = o.save.replace(/\.\w+$/, '') + '.manifest.json' await mkdir(path.dirname(manifestPath), { recursive: true }) await writeFile(manifestPath, JSON.stringify({ task: o.task, accepted, rounds: rounds.length, acceptLine: o.accept, platform: o.platform || null, finalFiles, totalCredits: rounds.reduce((s, x) => s + (x.estimatedCredits || 0), 0), history: rounds, }, null, 2)) console.log(`\n记录：${manifestPath}`) process.exit(accepted ? 0 : 1) ``` ### Technical Analysis Each loop iteration stores the complete current prompt in the `rounds` array. The entire array is serialized into a JSON manifest without redaction, encryption, configurable retention, or explicit restrictive file permissions. Generation prompts may contain confidential campaign plans, unreleased product information, customer attributes, brand constraints, internal identifiers, or model instructions. Corrective prompts and quality-control findings may provide additional sensitive context. The default `writeFile()` behavior is subject to the process umask and does not guarantee that only the current user can read the resulting file. The output directory may also be synchronized, backed up, archived, or shared. ### Attack Path 1. A user supplies a confidential prompt through `--prompt` or `--prompt-file`. 2. `run_loop.mjs` performs one or more generation and quality-control rounds. 3. Every prompt version is appended to `rounds`. 4. The script writes the full `history` to `<o ...[truncated 692 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make prompt-history retention opt-in rather than automatic. 2. Add a `--no-history` or `--redact-prompts` option. 3. Store a prompt hash, character count, or sanitized summary instead of full prompt text by default. 4. Detect and redact common secret formats before serialization. 5. Create manifests with restrictive permissions, such as mode `0600` on supported systems. 6. Warn users when manifests will contain full prompts. 7. Provide a configurable retention period and secure deletion workflow. 8. Avoid placing sensitive manifests in shared, synchronized, or published output directories. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The file implements a brand-prompt generator and CLI rather than image authenticity or pre-publish quality inspection described by the skill manifest. This mismatch is dangerous because hidden or mislabeled capabilities can cause users or calling agents to invoke functionality they did not intend, weakening trust boundaries and enabling prompt manipulation workflows under an unrelated skill name.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script is a generic content generation entrypoint for image/video tasks, while the skill metadata claims a pre-publish image authenticity/quality inspection workflow. This mismatch is dangerous because users may trust the skill to perform safety or quality checks when it actually generates assets and writes outputs, creating a deceptive capability gap that can bypass expected human review.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The core execution path selects an external model provider, constructs a generation request, runs provider.run(req), and persists returned files. For a skill advertised as image inspection, invoking generation backends instead of analysis means the skill can fabricate or transform content rather than assess it, undermining integrity and enabling false assurance in a pre-publication gate.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The brand-processing logic appends visual constraints to the prompt and merges in model reference images, which is consistent with content creation but inconsistent with neutral inspection. In a detection skill, modifying prompts and adding reference images can bias or contaminate the evaluation process, producing non-independent results and masking issues in the original user-supplied image.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements multi-provider image/video generation and editing backends, while the declared skill purpose is image authenticity/quality inspection. This mismatch is dangerous because user-supplied prompts and images can be routed to content-generation services, enabling undisclosed third-party data transfer and behavior outside the expected trust boundary of an inspection skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The request/response contract explicitly supports video generation and text output even though the skill is presented as pre-publication image inspection. Extra capability broadens the attack and data-exposure surface and makes the skill behavior less predictable than the advertised use case.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module can spawn an external CLI binary (`dlazy`) using request-derived arguments. Although `spawn` avoids shell injection here, invoking an external executable introduces supply-chain and local-execution risk that is not justified by a simple inspection skill and may process sensitive data outside audited code paths.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: `postJson` sends request bodies containing prompts and potentially image-derived data to external services without any indication in this module that users are informed or that destinations are constrained. For an image inspection skill, silent transmission of user content to third parties creates privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The helper functions read local files from `req.images` and convert them for upload or relay to remote providers. This is dangerous because local user files may be exfiltrated to third parties without a clear trust prompt, especially in a skill advertised as merely performing quality/authenticity checks.

External Transmission

Medium

• Category: Data Exfiltration

Content

: await readFile(p)
        fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
      }
      r = await fetch('https://api.openai.com/v1/images/edits', {
        method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {

• Confidence: 98% confidence
• Finding: The OpenAI images edit request uploads user prompts and image content to an external provider. In the context of an image-inspection skill, this constitutes third-party data transmission outside the expected scope and may expose sensitive images or metadata to an unnecessary processor.

External Transmission

Medium

• Category: Data Exfiltration

Content

method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {
      r = await fetch('https://api.openai.com/v1/images/generations', {
        method: 'POST',
        headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
        body: JSON.stringify({

• Confidence: 98% confidence
• Finding: The OpenAI image generation request sends user prompts to a remote service unrelated to the advertised inspection-only purpose. This creates privacy and trust-boundary issues and may cause the skill to perform content generation instead of analysis.

External Transmission

Medium

• Category: Data Exfiltration

Content

: await readFile(p)
        fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
      }
      r = await fetch('https://api.openai.com/v1/images/edits', {
        method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {

• Confidence: 98% confidence
• Finding: The OpenAI images edit request uploads user prompts and image content to an external provider. In the context of an image-inspection skill, this constitutes third-party data transmission outside the expected scope and may expose sensitive images or metadata to an unnecessary processor.

External Transmission

Medium

• Category: Data Exfiltration

Content

method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {
      r = await fetch('https://api.openai.com/v1/images/generations', {
        method: 'POST',
        headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
        body: JSON.stringify({

• Confidence: 98% confidence
• Finding: The OpenAI image generation request sends user prompts to a remote service unrelated to the advertised inspection-only purpose. This creates privacy and trust-boundary issues and may cause the skill to perform content generation instead of analysis.

External Transmission

Medium

• Category: Data Exfiltration

Content

const input = { prompt: req.prompt, num_outputs: req.batch }
    if (req.images?.length) input.input_image = await asDataUri(req.images[0])
    const j = await postJson(
      `https://api.replicate.com/v1/models/${replicate.model(req)}/predictions`,
      { input },
      { authorization: `Bearer ${env.REPLICATE_API_TOKEN}`, prefer: 'wait' },
      req.timeoutMs,

• Confidence: 97% confidence
• Finding: The Replicate prediction request transmits prompts and possibly an input image to an external third-party model API. In this skill context, that is risky because the module can export user images to a generation provider despite being described as an authenticity inspection tool.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/lib/providers.mjs:104

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/run_loop.mjs:61

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/gen.mjs:118

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/lib/providers.mjs:21