AI-Image-Matting

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:52 AM UTC
• Version: 1.0.4

Overview

This background-removal skill is coherent, but it uploads local images to a third-party service that returns permanent unsigned public URLs without a documented deletion or explicit informed-consent step.

Review before installing. Use this skill only for images you are comfortable sending to Flyelep and potentially exposing through a permanent public URL. Avoid private photos, identity documents, credentials, medical images, or confidential business material unless the provider gives you deletion and access-control guarantees. Provide the API key only at runtime and do not store it in prompts, files, or logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:75

Finding

Permanent Public Exposure of Uploaded Local Images

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 75–89
Vulnerability Type: Permanent unauthenticated publication of user-provided files
Risk Level: Medium

Vulnerable Code Snippet

The following is an English translation of the relevant skill instructions:

markdown

If the user provides a local file path instead of a public direct link, first
upload the file to obtain a direct link, and then call this API.

- URL: POST https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload
- Request method: multipart/form-data
- The fixed file field name is `file`
- Authentication: pass `secretKey` in the request header

Use `data.fullPath` from a successful response as the public direct link.
It is permanently valid and does not contain a signature.

{
  "code": 200,
  "data": {
    "relativePath": "cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png",
    "fullPath": "https://agent-1404002717.cos.ap-guangzhou.myqcloud.com/cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png"
  }
}

Technical Analysis

The skill directs the agent to upload local user images to a third-party storage service whenever the user supplies a local path. The resulting fullPath is explicitly described as permanently valid and unsigned. Consequently, access to the stored image is controlled only by possession of its URL; no authentication, expiration, or revocation mechanism is documented.

This creates an insecure data-handling condition because a user requesting image matting may not reasonably expect the original image to be published through a permanent public URL. The skill does not require informed consent immediately before upload, identify a retention period, offer deletion, or prevent sensitive images from being submitted.

Attack Path

1. A user supplies a local image to the agent for background removal.
2. The agent follows SKILL.md and uploads the file to Flyelep's upload API using the user' ...[truncated 1098 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit informed consent immediately before uploading a local file. Clearly state that the current service creates a permanently accessible, unsigned public URL.
2. Replace public permanent objects with private storage protected by authentication and short-lived signed URLs.
3. Establish and document a minimal retention period, followed by automatic deletion of both source and processed images.
4. Provide a verified deletion endpoint and invoke it after processing unless the user explicitly requests retention.
5. Avoid returning or logging full object URLs in persistent transcripts, telemetry, and diagnostic output.
6. Add a sensitivity check and refuse uploads involving credentials, identity documents, medical images, private photographs, or confidential business material when private storage and deletion guarantees are unavailable.
7. Document the third-party processor, storage region, retention policy, access controls, and privacy implications before collecting user consent.
8. If the provider cannot support access control, expiration, and deletion, require users to supply their own appropriately secured image URL rather than uploading local files through this endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill adds a local file upload workflow that is broader than the declared purpose of background removal. Allowing the agent to take local file paths, upload files externally, and reuse returned permanent public URLs introduces a distinct data-exfiltration capability that could expose sensitive local files if the agent is tricked or the path handling is weak.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This skill explicitly instructs transmitting a local file to an external service using curl and a secret-bearing header. That is a real external data transfer path; in context it is intended for image processing, but it still creates exfiltration risk because local content and credentials are sent to a third-party endpoint outside the agent environment.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

判断成功只看 code，业务失败时 HTTP 状态码仍是 200，code 为 500 或 9999，原因在 msg 里。

bash

# Windows/PowerShell（用 curl.exe，PowerShell 里的 curl 是 Invoke-WebRequest 的别名）
curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: 你的密钥" --max-time 120 -F "file=@C:/path/to/product.png"

# macOS/Linux

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill includes instructions to create and delete a local temporary file and run shell commands (curl.exe, rm) as part of normal operation. Even though this is presented as a Windows encoding workaround, it expands the skill from a pure API invocation into local filesystem and shell manipulation, which increases risk if the surrounding inputs are ever influenced by untrusted data or copied into an execution-capable agent flow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.