ClawHub
Back to skill

Security audit

Image Gen Cheap

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it sends image prompts or image URLs to the LaoZhang API and saves returned images locally, with some credential-handling and privacy caveats users should understand.

Install only if you are comfortable sending prompts, image URLs, and your LaoZhang bearer token to LaoZhang's API. Store `~/.laozhang_api_token` with restrictive permissions such as `chmod 600`, avoid putting tokens on the command line, do not submit sensitive or confidential images without reviewing the provider's policies, and consider using a pinned dependency environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:15
Finding

API Token File May Be Created with Overly Permissive Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15-18; README.md:13-16; scripts/generate_image.py:33,38-41; scripts/edit_image.py:24,45-49
Vulnerability Type: Insecure local credential storage
Risk Level: Medium

Vulnerable Code

SKILL.md:15-18 and README.md:13-16 instruct users to store the token as follows:

bash
echo "sk-your-token" > ~/.laozhang_api_token

scripts/generate_image.py:33,38-41:

python
DEFAULT_TOKEN_PATH = Path.home() / ".laozhang_api_token"

def get_api_token():
    """Get API token from file"""
    if DEFAULT_TOKEN_PATH.exists():
        return DEFAULT_TOKEN_PATH.read_text().strip()
    return None

scripts/edit_image.py:24,45-49:

python
DEFAULT_TOKEN_PATH = Path.home() / ".laozhang_api_token"

def get_api_token():
    """Get API token from file"""
    if DEFAULT_TOKEN_PATH.exists():
        return DEFAULT_TOKEN_PATH.read_text().strip()
    return None

Technical Analysis

Shell redirection creates ~/.laozhang_api_token according to the user's current umask. With a common umask of 022, the file may be created with mode 0644, making it readable by other local users. Neither script verifies the file owner or rejects group-readable or world-readable permissions before loading the credential.

The alternative --token option also places the token in the process command line. Depending on the operating system and process-monitoring configuration, command-line arguments may be observable by other users, monitoring agents, shell history, or diagnostic tooling.

The token is intentionally transmitted as a bearer credential to https://api.laozhang.ai/v1/chat/completions; that transmission is required for the declared functionality and occurs over HTTPS. The weakness is the local storage and handling of the credential, not the disclosed API request itself.

Attack Path

  1. A user follows the documented command t ...[truncated 941 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the documented redirection command with permission-safe creation:

    bash
    install -m 600 /dev/null "$HOME/.laozhang_api_token"
printf '%s\n' "sk-your-token" > "$HOME/.laozhang_api_token"
chmod 600 "$HOME/.laozhang_api_token"

  2. Before reading the file, verify that it is a regular file, is owned by the current user, and has no group or other permission bits:

    python
    import os
import stat

def get_api_token():
    path = DEFAULT_TOKEN_PATH
    if not path.is_file():
        return None

    info = path.stat()
    if info.st_uid != os.getuid():
        raise PermissionError("Token file is not owned by the current user")
    if stat.S_IMODE(info.st_mode) & 0o077:
        raise PermissionError("Token file must have permissions 0600")
    return path.read_text(encoding="utf-8").strip()

  3. Prefer an operating-system credential manager or a protected environment-variable injection mechanism.

  4. Discourage --token for routine use because process arguments and shell history can expose credentials.

  5. Document token rotation and revocation procedures in case the credential is exposed.

T08 · Insecure Dependencies

Note
Location
SKILL.md:104
Finding

Unpinned Third-Party Dependency Produces Non-Reproducible Installations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:104-108; README.md:100-104
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

SKILL.md:104-108 and README.md:100-104 instruct users to install an unconstrained package:

bash
pip install requests

Technical Analysis

The installation command does not constrain the version of requests, provide integrity hashes, or use a reviewed lockfile. Consequently, installations performed at different times may retrieve different package releases and transitive dependency versions.

This creates a supply-chain exposure because package code obtained from the configured Python package index executes within the user's Python environment. Exploitation would require compromise of the package distribution channel, a maintainer account, an improperly configured package index, or acceptance of a future compromised release. No evidence was found that the current project intentionally references a malicious or typosquatted package.

Attack Path

  1. An attacker compromises a relevant package publication account, package index, mirror, or dependency resolution source.
  2. A malicious or compromised package version becomes the version selected by the unconstrained installation command.
  3. A user follows the project documentation and runs pip install requests.
  4. The package manager downloads and installs the attacker-controlled release or affected transitive dependency.
  5. Malicious package code executes during installation or later when either script imports requests.

Impact Assessment

Successful supply-chain compromise could execute code with the privileges of the user running pip. Depending on those privileges, this could expose files, environment variables, API credentials, generated images, and network access available to that account.

The practical likelihood is reduced because requests is a well-establishe ...[truncated 161 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a reviewed dependency file with an exact version rather than installing an unconstrained latest release.

  2. Generate and verify cryptographic hashes for the package and its transitive dependencies.

  3. Install using hash enforcement:

    bash
    python -m pip install --require-hashes -r requirements.txt

  4. Use a lockfile generated by a dependency-management tool and review dependency updates before merging them.

  5. Configure trusted package indexes explicitly and avoid untrusted mirrors or additional indexes.

  6. Run the scripts in a dedicated virtual environment with only the permissions required to save generated images and access the API token.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose focuses on image generation/editing, but the behavior also includes reading a local token file and saving generated content to the local filesystem without clearly declaring those resource accesses. This mismatch can mislead users and orchestration systems about the skill's real privileges and data flows, creating a risk of unauthorized local data access and unexpected persistence.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/generate_image.py (reported line 139)May include surrounding context.

python
%(prog)s "A cute cat playing in a garden"
  %(prog)s "Sunset beach" --ratio 3:2
  %(prog)s "A puppy" --output dog.png
  %(prog)s "Futuristic city" --model gpt-4o-image
        """
    )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README recommends storing the API token in a plaintext file under the user’s home directory without any warning about file permissions, multi-user systems, backups, shell history, or accidental disclosure. This can expose a reusable secret that grants access to a paid external service, leading to unauthorized usage, billing abuse, or token leakage through local compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to submit image URLs and editing prompts to a third-party API without warning that the remote service will receive the image content and any potentially sensitive data embedded in it. In this skill context, users may reasonably provide private or internal images for editing, so the omission creates a real privacy and data-sharing risk even though it is documentation-level rather than code-execution behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documentation indicates capabilities that require local file reads/writes and outbound network access, but it declares no explicit tool scope or permissions. In an agent environment, missing scope declarations can cause the skill to operate with broader-than-expected privileges, reducing transparency and increasing the chance of unintended data access or exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad, generic terms for common user requests such as generating or editing images. Overbroad triggers can cause the skill to activate in situations the user did not intend, increasing the likelihood that prompts or images are sent to an external provider without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill does not clearly warn users that their prompts, and potentially images for editing, will be transmitted to a third-party external API. In this context, the omission is security-relevant because image-editing requests may contain sensitive personal or proprietary content, and users may not realize that data leaves the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code performs an outbound HTTPS request containing the prompt and referenced image URLs to a third-party endpoint. While external transmission is expected for this feature, it is still a real security/privacy issue if users are not clearly informed, especially when inputs may contain confidential image content or sensitive instructions.

Content

Scanner excerpt · scripts/edit_image.py (reported line 105)May include surrounding context.

python
}
    
    try:
        response = requests.post(API_URL, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        result = response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script sends user-supplied image URLs and edit prompts to a third-party API, but it does not provide an explicit warning or consent mechanism before transmitting potentially sensitive data. In a skill context, users may assume local processing, so this can cause unintended disclosure of private images, prompts, or embedded metadata to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md
sys.exit(1)

# API Configuration
API_URL = "https://api.laozhang.ai/v1/chat/completions"

# Available Models
AVAILABLE_MODELS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
sys.exit(1)

# API Configuration
API_URL = "https://api.laozhang.ai/v1/chat/completions"

# Available Models
AVAILABLE_MODELS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/edit_image.py (reported line 22)May include surrounding context.

python
sys.exit(1)

# API Configuration
API_URL = "https://api.laozhang.ai/v1/chat/completions"

# Available Models
AVAILABLE_MODELS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 21)May include surrounding context.

python
sys.exit(1)

# API Configuration
API_URL = "https://api.laozhang.ai/v1/chat/completions"

# Available Models
AVAILABLE_MODELS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 90)May include surrounding context.

python
}
    
    try:
        response = requests.post(API_URL, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        result = response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script transmits the user's prompt and bearer token to a third-party API, but it does not provide an explicit warning at execution time that user content leaves the local environment. This can expose sensitive prompts or regulated data if users mistakenly assume image generation is local or privacy-preserving.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

All user-facing instructions, parameter descriptions, and usage guidance are presented only in Chinese. This can constitute a language-policy issue when the skill forces a single language without user opt-in or an explicit statement that the skill is intended for a Chinese-only audience.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest frames this skill as a low-cost image generation and editing tool, but the code also accesses a credential file in the user's home directory (~/.laozhang_api_token). Reading local secrets is not described in the stated purpose and is an extra capability beyond straightforward image-generation logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The script silently reads credentials from ~/.laozhang_api_token without prominently disclosing that behavior in the help text or usage flow. This reduces transparency and can surprise users who did not expect stored credentials to be accessed automatically.

Content

No source excerpt is available for this finding.