ClawHub
Back to skill

Security audit

intelligent-extension

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its image-extension purpose, but its local-file workflow can publish user images as permanent public URLs and handles API keys in a way users should review carefully.

Install only if you are comfortable sending images and a Flyelep API key to the Flyelep service. Do not use local-file upload for sensitive, private, regulated, or confidential images unless you accept that the returned URL may be public and permanent. Prefer a secure secret-entry mechanism for the API key, and rotate the key if it appears in logs, command history, or shared transcripts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:113
Finding

Permanent Public Exposure of Uploaded User Images

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:113-124
Vulnerability Type: Permanent unsigned public object exposure
Risk Level: High

Vulnerable Documentation Snippet

The instructions require local files to be uploaded to a third-party service and specify that data.fullPath is a permanently valid, unsigned public URL:

json
{
  "code": 200,
  "msg": null,
  "data": {
    "relativePath": "cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png",
    "fullPath": "https://agent-1404002717.cos.ap-guangzhou.myqcloud.com/cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png",
    "serviceProvider": null
  }
}

Technical Analysis

When a user supplies a local image, the Skill directs the agent to upload it to Flyelep and use the returned data.fullPath as a publicly accessible image URL. The documentation explicitly describes this URL as permanent and unsigned.

An unsigned public URL operates as a bearer credential: anyone who obtains the URL can access the object without authentication. No expiration, deletion procedure, access control, retention policy, or explicit privacy-consent step is defined. Consequently, a temporary image-processing request can produce persistent third-party storage and long-term public availability.

URL entropy may reduce accidental discovery, but it is not an access-control mechanism. URLs can leak through agent transcripts, browser history, proxy logs, terminal output, API responses, monitoring systems, support records, or subsequent sharing.

Attack Path

  1. A user supplies a local image, potentially containing private or sensitive information.
  2. The agent follows the Skill and uploads the image to the third-party Flyelep endpoint.
  3. Flyelep returns a permanent, unsigned fullPath URL.
  4. The URL is included in API traffic, agent context, output, logs, or conversation history.
  5. An unauthorized party obtains the URL from any of these locations.
  6. The p ...[truncated 737 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user consent before transferring any local file to a third party.
  2. Clearly disclose the destination service, retention behavior, and whether the resulting object is publicly accessible.
  3. Store uploaded objects privately and provide short-lived signed URLs with narrowly scoped read access.
  4. Add a documented deletion API and automatically delete source and generated images after processing or after a short retention period.
  5. Avoid returning permanent public URLs in agent output. Return authenticated or expiring links instead.
  6. Redact object URLs from telemetry and application logs where feasible.
  7. Apply unpredictable object identifiers as defense in depth, while not treating identifier entropy as authorization.
  8. Permit users to opt out of upload-based processing when local or privacy-preserving alternatives are unavailable.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:142
Finding

API Secret Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:142-145
Additional Occurrences: SKILL.md:155, 182, 192, 221, 231
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code Snippet

The documented command pattern places the API key directly in a command-line header argument:

bash
curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: YOUR_API_KEY" --max-time 120 -F "file=@C:/path/to/product.png"

curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: YOUR_API_KEY" --max-time 120 -F "file=@./product.png"

The same pattern is repeated for the image-extension endpoint:

bash
curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/poster/aiTool/intelligentExtension" -H "Content-Type: application/json; charset=utf-8" -H "secretKey: YOUR_API_KEY" --max-time 300 --data-binary '{"imgUrlList":["https://example.com/image1.jpg"],"ratio":"16:9"}'

Technical Analysis

Substituting the real API key directly into curl arguments can disclose the credential through operating-system process listings, shell history, terminal recording, debugging output, command auditing, CI/CD logs, agent tool logs, or monitoring systems.

HTTPS protects the credential while it is transmitted to the remote endpoint, but it does not protect the credential before execution or from local records of the command. Any local user or monitoring component able to inspect process arguments or retained command logs may recover the key.

The Skill warns against storing real keys in repositories or persistent configuration, but its prescribed execution pattern still creates local disclosure channels.

Attack Path

  1. The user provides a valid Flyelep secretKey.
  2. The agent interpolates the key into the documented curl -H command.
  3. The command or p ...[truncated 1004 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not interpolate API keys directly into interactive command lines.
  2. Use a secrets manager or protected runtime secret injection supported by the execution environment.
  3. Where curl must be used, create a permission-restricted temporary configuration or header file, pass it to curl, and securely remove it immediately afterward.
  4. Ensure temporary secret-bearing files are accessible only to the current user and are excluded from backups and source control.
  5. Disable or suppress shell history for secret-handling commands where supported.
  6. Configure agent, CI/CD, process-auditing, and observability systems to redact the secretKey header.
  7. Prevent verbose command echoing and never include the complete command containing the real key in user-visible output.
  8. Use narrowly scoped, short-lived, and revocable API credentials where the service supports them.
  9. Rotate the key immediately if it has appeared in command history, process telemetry, transcripts, or logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs the agent to collect and handle a user's API secretKey, which expands behavior from image extension into credential handling. Even if intended for legitimate API authentication, this creates unnecessary secret exposure risk inside the agent workflow, especially if the agent may log, persist, echo, or reuse the key across steps or tools.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill adds a separate local-file upload workflow that is broader than the manifest's stated image-extension purpose and causes user files to be transmitted to an external service. This increases attack surface and data-handling risk, especially because the upload step creates publicly accessible URLs and may process sensitive local content before users fully understand the exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that uploaded files become permanent public URLs without providing a prominent privacy warning or requiring explicit user acknowledgment. This can expose sensitive images, documents, or metadata to unintended parties, and the permanence materially raises the severity because accidental disclosure may not be revocable.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill instructs transmission of local files and authentication material to an external domain, which is expected for the feature but still security-relevant because it moves user data off-platform to a third party. In this context the danger is amplified by the companion documentation indicating public permanent hosting, making the transmission not just external but potentially broadly exposed.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

判断成功只看 code，业务失败时 HTTP 状态码仍是 200，code 为 500 或 9999，原因在 msg 里。

bash
# Windows/PowerShell（用 curl.exe，PowerShell 里的 curl 是 Invoke-WebRequest 的别名）
curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: 你的密钥" --max-time 120 -F "file=@C:/path/to/product.png"

# macOS/Linux

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes an image-extension API skill, but the documented execution path on Windows/PowerShell requires writing a temporary JSON payload file and later deleting it. Local filesystem modification is an additional operational capability not reflected in the skill's stated scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.