image-clarity-enhance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.4

Overview

The skill does what it claims, but it can upload local images to a third-party service as permanent public URLs without requiring explicit user consent first.

Install only if you are comfortable sending images and a Flyelep API key to Flyelep. Do not use it for sensitive, private, regulated, or confidential images unless the user explicitly agrees that local files may be uploaded and may remain accessible through long-lived public URLs. Prefer already-hosted non-sensitive image URLs and rotate the API key if it appears in logs or command history.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:98

Finding

Permanent Public Exposure of Uploaded Local Images

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 98–122
Vulnerability Type: Persistent unauthenticated data exposure
Risk Level: Medium

Vulnerable Code Snippet

The following is an English translation of the relevant instructions:

markdown

## Local File Upload

If the user provides a local file path instead of a publicly accessible direct
link, first upload the file to obtain a direct link, and then invoke this API.

- URL: POST https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload
- Request format: multipart/form-data
- Authentication: Pass secretKey in the request header.

Use data.fullPath from a successful response as the publicly accessible direct
link. It is permanently valid and has no signature:

{
  "code": 200,
  "data": {
    "relativePath": "cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png",
    "fullPath": "https://agent-1404002717.cos.ap-guangzhou.myqcloud.com/cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png"
  }
}

Technical Analysis

The skill instructs the agent to upload a user-supplied local image to third-party Flyelep infrastructure and use the resulting data.fullPath URL. The document explicitly states that this URL is permanently valid and unsigned.

An unsigned public URL does not require authentication or authorization when accessed. Anyone who obtains the URL can retrieve the uploaded image. The workflow does not require the agent to obtain explicit informed consent before transferring the local file, warn the user that the image will become permanently accessible, or provide a deletion and retention mechanism.

Although a high-entropy object path may make a URL difficult to guess, URL secrecy is not an adequate access-control mechanism. URLs may be disclosed through agent transcripts, application logs, proxy logs, browser history, referrer headers, monitoring systems, support tickets, or accidental sharing.

Attack Path

1. A ...[truncated 1118 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before uploading any local file to third-party infrastructure.
2. Clearly identify the destination service and disclose that the file leaves the local environment.
3. Do not use permanently public objects. Store uploads privately and return short-lived, cryptographically signed URLs.
4. Apply the shortest practical expiration period and restrict access to the minimum required service identity.
5. Add a documented deletion endpoint and automatically delete source and generated images after processing.
6. Warn users not to upload sensitive, regulated, confidential, or personally identifying images.
7. Avoid printing full image URLs in logs. Redact object identifiers and query parameters from diagnostics.
8. Document the third party's retention, geographic storage, content-review, and privacy policies.
9. If the external API cannot provide private storage, require the user to provide an already-hosted URL after acknowledging the privacy implications rather than silently uploading local files.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:132

Finding

API Secret Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 132–137 and 170–178
Vulnerability Type: Insecure credential handling
Risk Level: Medium

Vulnerable Code Snippet

bash

curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: YOUR_KEY" --max-time 120 -F "file=@C:/path/to/product.png"

curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: YOUR_KEY" --max-time 120 -F "file=@./product.png"

bash

curl.exe --% -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/poster/aiTool/imageClarityEnhance" -H "Content-Type: application/json; charset=utf-8" -H "secretKey: YOUR_KEY" --max-time 300 --data-binary @payload_temp.json

bash

curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/poster/aiTool/imageClarityEnhance" -H "Content-Type: application/json; charset=utf-8" -H "secretKey: YOUR_KEY" --max-time 300 --data-binary '{"imgUrls":"https://example.com/img1.jpg","enhanceStrength":"standard"}'

Technical Analysis

The examples instruct users or agents to substitute the real API credential directly into a curl command-line argument. The secretKey value consequently becomes part of the process invocation.

Depending on the operating system and execution environment, command-line arguments may be visible through process-inspection utilities, shell history, terminal capture, audit frameworks, CI/CD logs, agent tool-call records, telemetry, or error reports. The use of HTTPS protects the credential in transit but does not mitigate local disclosure before the request is sent.

The document correctly warns against storing credentials in the skill file or persistent configuration, but the provided invocation pattern still creates avoidable local and operational exposure.

Attack Path

1. The user provides a valid Flyelep API key.
2. The key is substituted into the documented curl ...[truncated 970 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place the real API key directly in command-line arguments.
2. Prefer an execution framework that supports dedicated secret parameters and redacts them from tool calls, logs, traces, and errors.
3. Where supported, obtain the secret through a non-echoing interactive prompt and construct the HTTP request in memory.
4. If curl must be used, generate a temporary curl configuration containing the sensitive header, assign owner-only permissions, and delete it immediately after use. Confirm that the environment does not log file contents.
5. Disable command echoing and ensure shell history is not written for credential-bearing operations.
6. Redact secretKey from diagnostic output, exception messages, screenshots, agent transcripts, and observability systems.
7. Use narrowly scoped, short-lived, and revocable API credentials with account-level spending and rate limits.
8. Rotate the key immediately if it may have appeared in process listings, shell history, CI logs, or agent execution records.
9. Add explicit platform-specific secure examples instead of examples that encourage literal substitution of the credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation description says to use this skill when the user asks to '提升图片清晰度' or similar, which is a common everyday request and does not clearly bound when this skill should activate versus related image-editing skills. Although one negative example appears later for upscaling, the primary trigger description in the manifest remains broad and lacks explicit exclusion conditions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to upload user-provided local image files to a third-party service in order to obtain a public URL, but it does not require an explicit privacy warning or consent flow before transfer. This can cause unintentional disclosure of sensitive images or metadata to an external provider, especially because the returned URL is described as permanently valid and public.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This skill is explicitly designed to transmit images and API credentials to an external service, and the upload example reinforces that local files may be sent off-platform. In context this is intended functionality, but it is still a real security/privacy risk because sensitive local content and secrets are being disclosed to a third party, with no mandatory consent gate or restrictions on what may be uploaded.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

判断成功只看 code，业务失败时 HTTP 状态码仍是 200，code 为 500 或 9999，原因在 msg 里。

bash

# Windows/PowerShell（用 curl.exe，PowerShell 里的 curl 是 Invoke-WebRequest 的别名）
curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: 你的密钥" --max-time 120 -F "file=@C:/path/to/product.png"

# macOS/Linux

Static analysis

No suspicious patterns detected.