ClawHub
Back to skill

Security audit

Black Forest Labs FLUX

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent BFL image-generation helper, but its API-key handling and response-controlled polling URL create enough credential-risk to require review before installation.

Install only if you are comfortable sending prompts to Black Forest Labs and using a BFL API key from this environment. Prefer a restricted key with spending limits, avoid sensitive prompts, review the output path before use, and consider fixing the script to parse dotenv safely and validate polling/download URLs before attaching credentials.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bfl-generate.sh:41
Finding

API Key Disclosure Through an Unvalidated Polling URL

Content
View full analysis

Vulnerability Details

File Location: scripts/bfl-generate.sh, lines 41-61
Vulnerability Type: Server-side request forgery and credential disclosure
Risk Level: High

bash
POLLING_URL=$(python3 - "$REQUEST_JSON" <<'PY'
import json,sys
obj=json.loads(sys.argv[1])
print(obj.get('polling_url',''))
PY
)
REQUEST_ID=$(python3 - "$REQUEST_JSON" <<'PY'
import json,sys
obj=json.loads(sys.argv[1])
print(obj.get('id',''))
PY
)

if [[ -z "$POLLING_URL" ]]; then
  echo "BFL request failed:" >&2
  echo "$REQUEST_JSON" >&2
  exit 1
fi

echo "Request ID: $REQUEST_ID" >&2

for _ in $(seq 1 240); do
  sleep 1
  RESULT_JSON=$(curl -sS -X GET "$POLLING_URL" \
    -H 'accept: application/json' \
    -H "x-key: ${BFL_API_KEY}")

Technical Analysis

The script obtains polling_url from a remote JSON response and passes it directly to curl without verifying its scheme, hostname, port, or destination address. The request also includes the sensitive BFL_API_KEY in the x-key header.

This crosses a critical trust boundary: data supplied by a remote service controls the destination of a subsequent authenticated request. If the initial response is compromised or unexpectedly contains an attacker-controlled URL, the script will transmit the API key to that destination. The URL could also reference an internal or loopback service, causing the script to make requests using the host's network access.

Attack Path

  1. An attacker compromises, manipulates, or otherwise controls the initial BFL API response received by the script.
  2. The attacker supplies a polling_url pointing to an attacker-operated HTTPS endpoint or a service reachable only from the execution environment.
  3. The script accepts the URL without validation.
  4. During polling, curl sends a request to the supplied destination with x-key: ${BFL_API_KEY}.
  5. For an attacker-operated end ...[truncated 617 chars]
Remediation
View remediation

Remediation Suggestions

  • Parse polling_url with a URL-aware parser before using it.
  • Require the https scheme and an explicit allowlist of expected Black Forest Labs API hostnames.
  • Reject URLs containing user information, unexpected ports, fragments, loopback addresses, link-local addresses, private network destinations, or hostnames that resolve to such addresses.
  • Do not attach BFL_API_KEY to any destination that has not passed validation.
  • If supported by the API, construct the polling endpoint locally from the trusted request ID instead of trusting a complete response-provided URL.
  • Apply strict connection and overall timeouts to the polling request.
  • Avoid following redirects for credential-bearing requests. If redirects are required, validate every redirect destination before forwarding credentials.
  • Use a restricted API key with minimal scope and spending limits, and rotate the key if exposure is suspected.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bfl-generate.sh:4
Finding

Arbitrary Shell Execution Through Sourced Environment File

Content
View full analysis

Vulnerability Details

File Location: scripts/bfl-generate.sh, lines 4-6
Vulnerability Type: Unsafe configuration-file execution
Risk Level: Medium

bash
if [[ -f /root/.clawdbot/.env ]]; then
  # shellcheck disable=SC1091
  source /root/.clawdbot/.env
fi

Technical Analysis

The Bash source command executes the target file as shell code; it does not restrict processing to dotenv-style variable assignments. Consequently, command substitutions, function definitions, redirections, external commands, and other shell constructs placed in /root/.clawdbot/.env execute whenever the skill runs.

Although exploitation requires the attacker to modify or influence this file, configuration files can have broader write or provisioning paths than executable scripts. Treating such a file as executable code increases the effect of any permission error, deployment compromise, or unsafe configuration-writing mechanism. The hard-coded path under /root also indicates that execution may occur in a highly privileged context.

Attack Path

  1. An attacker obtains a way to modify /root/.clawdbot/.env, such as through incorrect ownership or permissions, a compromised configuration process, or another file-write vulnerability.
  2. The attacker inserts shell syntax into the file, for example a command substitution or direct command invocation.
  3. A user or automated process invokes scripts/bfl-generate.sh.
  4. The script sources the file before processing the image-generation request.
  5. The injected shell commands execute with the operating-system privileges and environment of the skill runner.

Impact Assessment

Exploitation permits arbitrary command execution in the skill runner's security context. Depending on that context, an attacker could read accessible secrets, alter files, invoke network tools, or take over the generation workflow. If the script runs as root, the commands would execute with root p ...[truncated 105 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer requiring BFL_API_KEY through the process environment rather than automatically loading a file.
  • If dotenv loading is necessary, use a parser that accepts only a strict set of expected keys and literal values; never evaluate the file as shell code.
  • Permit only BFL_API_KEY and any explicitly supported configuration variables, rejecting unknown keys, command substitutions, shell metacharacters, multiline constructs, and malformed records.
  • Verify that the file is a regular file rather than a symbolic link.
  • Check that the file is owned by the expected account and is not writable by group or other users before reading it.
  • Store the secret with restrictive permissions, such as mode 0600, and avoid running the skill as root where possible.
  • Consider using a dedicated secret manager and a minimally privileged service account for the skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bfl-generate.sh (reported line 4)May include surrounding context.

sh
#!/usr/bin/env bash
set -euo pipefail

if [[ -f /root/.clawdbot/.env ]]; then
  # shellcheck disable=SC1091
  source /root/.clawdbot/.env
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bfl-generate.sh (reported line 6)May include surrounding context.

sh
#!/usr/bin/env bash
set -euo pipefail

if [[ -f /root/.clawdbot/.env ]]; then
  # shellcheck disable=SC1091
  source /root/.clawdbot/.env
fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill invokes a shell script that performs network requests and writes files, but the manifest declares no explicit tool scope or allowed-tools. This weakens least-privilege controls and can allow broader shell execution than reviewers or orchestrators expect, increasing the blast radius if the skill is misused or modified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bfl-generate.sh (reported line 34)May include surrounding context.

sh
PY
)

REQUEST_JSON=$(curl -sS -X POST "https://api.bfl.ai/v1/${MODEL}" \
  -H 'accept: application/json' \
  -H "x-key: ${BFL_API_KEY}" \
  -H 'Content-Type: application/json' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bfl-generate.sh (reported line 34)May include surrounding context.

sh
PY
)

REQUEST_JSON=$(curl -sS -X POST "https://api.bfl.ai/v1/${MODEL}" \
  -H 'accept: application/json' \
  -H "x-key: ${BFL_API_KEY}" \
  -H 'Content-Type: application/json' \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code sends the supplied prompt to https://api.bfl.ai/v1 using curl, which is a network operation that transmits user-provided data off-system. While the script's purpose is image generation, the file itself contains no user-facing disclosure such as a comment, prompt, or log indicating that the prompt will be sent to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill instructs users to send prompts to a third-party API and save downloaded images locally, but it does not warn that prompts leave the local environment or that the output path may create or overwrite files. This can cause accidental disclosure of sensitive prompt content or unintended file modification, especially when users supply arbitrary prompts or output paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script downloads the generated image and saves it to OUTFILE, performing a filesystem write that may create or overwrite user-visible output. Although writing an output file is expected for this kind of tool, the file contains no explicit warning, confirmation, or descriptive comment around this behavior beyond the positional outfile argument.

Content

No source excerpt is available for this finding.