易企秀H5制作

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:22 AM UTC
• Version: 1.0.4

Overview

The skill is mostly coherent for Eqxiu H5 creation, but it needs Review because it can upload local files remotely and can send a saved Eqxiu token to configurable network endpoints.

Install only if you intend to automate an Eqxiu account. Keep commands on the default Eqxiu service hosts, avoid untrusted endpoint or environment overrides, approve the exact local file before using upload, and remove or rotate the saved token when you no longer need the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/eqxiu_aigc/client.py:34

Finding

Authentication Token Can Be Forwarded to Arbitrary Configurable Endpoints

Content

View full analysis

None: self.base_url = base_url.rstrip("/") self.timeout = timeout self._session = requests.Session() if access_token: self._session.headers.update({CONFIG_TOKEN_KEY: access_token}) ``` ```python r = self._session.post( f"{self.base_url}/aigc/draw/ai/create/stream", json={"userPrompt": prompt, "productCodeSub": product_code_sub}, headers=headers, stream=True, timeout=self.timeout, ) ``` From `scripts/eqxiu_aigc/upload_material.py`: ```python def _http_get( url: str, *, access_token: str | None = None, params: Mapping[str, Any] | None = None, extra_headers: MutableMapping[str, str] | None = None, timeout: int = DEFAULT_UPLOAD_TIMEOUT, ) -> requests.Response: headers: dict[str, str] = dict(extra_headers or {}) if access_token: headers["X-Openclaw-Token"] = access_token return requests.get(url, params=dict(params) if params else N ...[truncated 2875 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/eqxiu_aigc/upload_material.py:266

Finding

Unpinned Runtime Installation of COS SDK Creates Supply-Chain Exposure

Content

View full analysis

dict[str, Any]: try: from qcloud_cos import CosConfig, CosS3Client except ImportError as e: raise ImportError("Please install the Tencent Cloud COS SDK first: pip install cos-python-sdk-v5") from e ``` ### Technical Analysis The project instructs users to install `cos-python-sdk-v5` without specifying a reviewed version, hashes, a lockfile, or an authenticated package source. Consequently, the installed code and transitive dependency set can vary over time. Python packages can execute code during installation and later execute imported module-level code under the privileges of the user running the Skill. If a future package release or transitive dependency is compromised, users following the documented command could install and execute malicious code. No evidence was found that the currently named dependency is itself malicious. The finding concerns the absence of dependency pinning and integrity controls. ### Attack Path 1. An attacker compromises a future release of the named package or one of its transitive dependencies, or influences dependency resolution through an unsafe package index configuration. 2. A user invokes the upload feature and receives the instruction to run `pip install cos-python-sdk-v5`. 3. pi ...[truncated 886 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description centers on generating and editing H5 pages, but the documented behavior also includes uploading local files to remote object storage, extracting authenticated user identifiers, saving assets into a material library, and enumerating previously uploaded materials. This mismatch is dangerous because users may authorize a seemingly narrow content-generation skill without realizing it can transfer local data and access broader account-scoped resources.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes capabilities that imply shell, filesystem, environment, and network access, but it does not declare any tool restrictions or scoped permissions. In practice this weakens least-privilege controls and makes accidental or abusive use of powerful operations more likely, especially because the documented workflow includes authenticated API use and local file handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

该技能在触发词中列出“制作H5、生成H5、创建H5、做一个H5”等较宽泛表述，以及在 read_when 中使用“做个邀请函”“做一张年会海报”等自然口语。这些短语缺少明确边界、排除条件或上下文限制，容易与普通对话需求重叠，增加非预期调用风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The upload functionality sends a local file to Tencent COS and registers it with a remote material service, but the skill text does not provide a clear warning that local files leave the user's machine and are stored remotely. This creates a real risk of unintended disclosure of sensitive local content, especially in an agent context where users may assume edits remain local unless told otherwise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file describes a local-file upload workflow that sends data to external services (emw-api.eqxiu.com, COS, and saveFile) but does not include any warning about transmitting user files off-system. For markdown files, missing disclosures about behaviors affecting user data or privacy should be flagged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow instructions and labels are fully presented in Chinese, which effectively forces a specific language for users and operators reading this skill. The file does not provide an opt-in, alternative language, or justification that the skill is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code persists configuration data, including the access token set in login_interactive, to ~/.eqxiu/config.json. Although the interactive flow mentions where the token is saved, the file-writing function itself has no user-facing disclosure or inline warning that sensitive credentials are being written to disk, which is relevant for a safety-critical credential storage operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The methods update_editable_text and replace_body_image send user-provided content and image source data over the network via POST requests, but the file contains no confirmation prompt, logging, or explanatory comments/docstrings disclosing that these remote modifications occur. Because these operations alter remote content and transmit user data, they meet the code-file criteria for missing user warnings.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/eqxiu_aigc/upload_material.py (reported line 62)May include surrounding context.

python

headers: dict[str, str] = dict(extra_headers or {})
    if access_token:
        headers["X-Openclaw-Token"] = access_token
    return requests.post(url, json=dict(json_body), headers=headers or None, timeout=timeout)


_COS_TOKEN_HEADERS = {

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The code streams a local file directly into cloud object storage using temporary credentials, which is the core mechanism for data exfiltration if an unsafe or overly broad file path is supplied. Although the feature is intended for legitimate image/material upload, in an agent environment this capability is sensitive because any accessible local file could be transferred off-host to remote storage under service-controlled credentials.

Content

Scanner excerpt · scripts/eqxiu_aigc/upload_material.py (reported line 287)May include surrounding context.

python

key = object_key.lstrip("/")
    with local_path.open("rb") as fp:
        resp = client.put_object(Bucket=bucket, Body=fp, Key=key, EnableMD5=False)

    etag = (resp.get("ETag") or resp.get("Etag") or "").strip('"')
    out: dict[str, Any] = {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The function uploads a caller-specified local file to remote cloud storage and then registers it with multiple external EQXIU APIs, but there is no built-in consent gate, destination allowlisting, or user-facing disclosure in this code path. In an agent skill context, that creates a real exfiltration risk because the agent could be induced to upload sensitive local files while appearing to perform a normal 'material upload' action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language strings entirely in Chinese, including the module docstring, CLI description, and command help text. Under the policy, forcing a specific language without user opt-in or an explicit region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The module docstring and error messages use Chinese exclusively, which can impose a language constraint on users or operators without any opt-in or justification visible in this file. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.