ClawHub
Back to skill

Security audit

image-translate

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its image-translation purpose, but local images may be uploaded to a third party as permanent public links without a deletion or explicit consent workflow.

Review before installing if you may translate private, regulated, customer, internal, or identity-related images. Use only images you are comfortable sending to Flyelep and potentially exposing through a permanent public URL, and avoid sharing sensitive API keys outside the runtime prompt.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:113
Finding

Permanent Public Disclosure of Uploaded Local Images

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:153
Finding

Predictable Temporary File Enables File Clobbering and Race Conditions

Content
View full analysis
- **Windows/PowerShell**：因 GBK 编码问题，必须先将 JSON 写入临时文件 `payload_temp.json`（UTF-8 无 BOM），再用 `curl.exe --% --data-binary @payload_temp.json` 发送请求。使用 Write 工具创建文件，或用 .NET API `[System.IO.File]::WriteAllText("payload_temp.json", $json, [System.Text.UTF8Encoding]::new($false))`。调用后用 `rm payload_temp.json` 清理。 ```powershell [System.IO.File]::WriteAllText("payload_temp.json", '{"imageUrl":"https://example.com/poster_cn.jpg","to":1,"from":"auto"}', [System.Text.UTF8Encoding]::new($false)) ``` ```bash curl.exe --% -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/poster/aiTool/translate" -H "Content-Type: application/json; charset=utf-8" -H "secretKey: 你的密钥" --max-time 300 --data-binary @payload_temp.json ``` ```bash rm payload_temp.json ``` ``` The same fixed filename and cleanup pattern is repeated at lines 200–223 for the second example. ### Technical Analysis The workflow creates `payload_temp.json` under a fixed name in the current working directory. It does not use an operating-system-generated temporary path, exclusive file creation, restrictive permissions, ownership verification, or atomic cleanup. Concurrent skill executions in the same directory can overwrite one another's payloads, causing the wrong image URL or language parameters to be sent. If an attacker can write to the working directory, a pre-created file or filesystem link may cause the write or cleanup operation to affect an unintended target, depending on operating-system and filesystem behavior. Cleanup is also performed only as a later command. If the API request, shell, or agent workflow terminates early, the file may remain on disk. Although the illustrated payload does not contain the API key, it can disclose source image URLs and translation metadata. ### Attack Pat ...[truncated 1231 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description is written as mandatory usage guidance in Chinese and does not offer any language choice or indicate that responses may follow the user's preferred language. Because this skill file consistently imposes a single language/locale context without opt-in or justification, it creates a natural-language policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill explicitly instructs the agent to transmit user-supplied images and a secret API key to a third-party service and upload endpoint. This is expected for the skill's purpose, but it still creates a real data-exfiltration and credential-handling risk because sensitive images may be sent off-platform, stored externally, and processed by a remote provider.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

判断成功只看 code，业务失败时 HTTP 状态码仍是 200，code 为 500 或 9999，原因在 msg 里。

bash
# Windows/PowerShell（用 curl.exe，PowerShell 里的 curl 是 Invoke-WebRequest 的别名）
curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: 你的密钥" --max-time 120 -F "file=@C:/path/to/product.png"

# macOS/Linux

Static analysis

No suspicious patterns detected.