ClawHub
Back to skill

Security audit

scene-replace

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can upload local images to a permanent public URL and handles API keys through shell command examples that may expose them.

Review this before installing if you may use private, confidential, regulated, or identifying images. Treat any local image passed to this skill as potentially uploaded to a permanent public URL, and use a revocable Flyelep key that you can rotate if it appears in logs or command history.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:94
Finding

Local Images Are Uploaded as Permanent, Unauthenticated Public Resources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:94-105
Vulnerability Type: Permanent public data exposure caused by insecure upload configuration
Risk Level: High

Vulnerable Code Snippet

The following is an English translation of the relevant Skill instructions:

text
If the user provides a local file path instead of a public direct URL,
upload the file to obtain a direct URL before calling this API.

On success, use data.fullPath as the public direct URL. It is permanently
valid and has no signature.

The documented upload service returns a public object URL:

json
{
  "code": 200,
  "msg": null,
  "data": {
    "relativePath": "cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png",
    "fullPath": "https://agent-1404002717.cos.ap-guangzhou.myqcloud.com/cos_ai_agent/2026-08-11/3f2a9c1b7d84e6f5a012.png",
    "serviceProvider": null
  }
}

Technical Analysis

The Skill directs the Agent to upload local user images to an external storage service and explicitly states that the resulting data.fullPath URL is permanent and unsigned. An unsigned public URL does not require authentication or authorization to retrieve the object.

The workflow does not specify:

  • Expiration or retention limits
  • Signed, time-limited access controls
  • A deletion or revocation mechanism
  • Explicit informed consent immediately before public upload
  • Checks for sensitive image content or metadata
  • Metadata removal before disclosure
  • Restrictions preventing sensitive local files from being uploaded

The randomness of an object name does not constitute access control. The URL can be exposed through API requests, responses, chat history, application telemetry, browser history, proxy logs, or accidental sharing. Once disclosed, the documented permanent URL remains usable indefinitely.

Attack Path

  1. A user provides a local image path to the Agent.
  2. Following the Skill instru ...[truncated 1142 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace permanent public URLs with private objects accessed through short-lived signed URLs.
  2. Enforce a minimal retention period and automatically delete source and generated images after task completion.
  3. Provide a documented deletion and revocation API.
  4. Obtain explicit user consent immediately before uploading a local file, clearly stating the destination, retention period, access model, and purpose.
  5. Warn users not to upload confidential, regulated, or personally sensitive images unless the service provides suitable contractual and technical protections.
  6. Strip unnecessary EXIF, GPS, device, and author metadata before upload, subject to user approval.
  7. Avoid displaying or logging source-image URLs when they are not needed.
  8. Ensure application, proxy, and Agent logs redact object URLs or restrict access to those logs.
  9. Validate that the upload destination enforces tenant isolation, encryption at rest, and authenticated deletion.
  10. If private storage cannot be implemented, clearly document permanent public disclosure as a prerequisite and require an explicit opt-in rather than uploading automatically.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:121
Finding

API Secret Is Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:121-126
Additional Locations: SKILL.md:136, SKILL.md:159-173
Vulnerability Type: Insecure credential handling through shell command arguments
Risk Level: Medium

Vulnerable Code Snippet

The following commands reproduce the documented invocation pattern with the secret placeholder normalized to English:

bash
curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" \
  -H "secretKey: YOUR_API_KEY" \
  --max-time 120 \
  -F "file=@C:/path/to/product.png"

curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" \
  -H "secretKey: YOUR_API_KEY" \
  --max-time 120 \
  -F "file=@./product.png"

The scene-replacement example uses the same unsafe pattern:

bash
curl -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/poster/aiTool/sceneReplace" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "secretKey: YOUR_API_KEY" \
  --max-time 300 \
  --data-binary '{"sourceUrl":"https://example.com/product.jpg","replaceImageUrl":"https://example.com/scene1.jpg","modelType":9,"textPrompt":"Replace the background with the supplied scene image"}'

Technical Analysis

The Skill instructs the Agent to interpolate the user-provided secretKey directly into a curl command-line argument. Although the document advises users not to hard-code or persist the key, passing it directly on the command line may still expose it through:

  • Shell command history
  • Agent tool-call logs and execution transcripts
  • Terminal recording and diagnostic logs
  • Process command-line inspection while curl is running
  • Crash reports or endpoint monitoring products
  • Shell tracing such as set -x
  • CI/CD or automation logs

The long request timeout of up to 300 seconds can increase the period during which the command and its secret-bearing arguments are observable in proc ...[truncated 1432 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer an HTTP client integration that accepts secrets through a protected credential field rather than generating shell commands.
  2. Store the key in an operating-system secret manager or the Agent platform's runtime secret store.
  3. Prevent secret values from appearing in tool-call transcripts, debug output, telemetry, and error messages.
  4. If curl must be used, obtain the header from a protected, temporary configuration mechanism rather than interpolating it into an interactive command.
  5. Create any temporary credential file with owner-only permissions and delete it immediately after use, including on errors and timeouts.
  6. Disable shell tracing and command-history persistence for secret-bearing operations.
  7. Configure process and observability tooling to redact the secretKey header.
  8. Use narrowly scoped, short-lived, and revocable API credentials where supported.
  9. Rotate any key that may already have appeared in command history or execution logs.
  10. Document a credential revocation procedure and ensure users can promptly invalidate a compromised key.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

判断成功只看 code，业务失败时 HTTP 状态码仍是 200，code 为 500 或 9999，原因在 msg 里。

bash
# Windows/PowerShell（用 curl.exe，PowerShell 里的 curl 是 Invoke-WebRequest 的别名）
curl.exe -X POST "https://www.flyelep.cn/prod-api/poster-design/api/v1/file/upload" -H "secretKey: 你的密钥" --max-time 120 -F "file=@C:/path/to/product.png"

# macOS/Linux

Static analysis

No suspicious patterns detected.