ClawHub
Back to skill

Security audit

语音文本转表情包

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it sends user text to an external image service and follows server-supplied image URLs without enough safeguards.

Review before installing. Use this only with a trusted image-model endpoint and avoid sending sensitive dictated text. Prefer configuring the API for b64_json responses or adding URL allowlisting, size limits, content-type checks, and dependency pinning before using it in a networked or corporate environment.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_meme.py:151
Finding

Unrestricted Download of a Server-Supplied URL Enables SSRF

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_meme.py, lines 151–162
Vulnerability Type: Server-Side Request Forgery through an unvalidated image URL
Risk Level: Medium

Vulnerable Code

python
def _download_image(url: str) -> bytes:
    image_resp = requests.get(url, timeout=120)
    image_resp.raise_for_status()
    return image_resp.content


def _extract_image_bytes(result: dict) -> bytes:
    data = result.get("data") or []
    if not data:
        raise RuntimeError("图片接口未返回 data")
    first = data[0]
    if first.get("url"):
        return _download_image(first["url"])

Technical Analysis

The image API response controls data[0].url, which is passed directly to requests.get without validating:

  • The URL scheme
  • The destination hostname
  • The resolved IP address
  • Redirect destinations
  • The response content type
  • The response body size
  • Whether the body is a valid image

The configured model endpoint can therefore cause the runtime to make arbitrary outbound requests. This risk is amplified because requests.get follows redirects by default and MEME_MODEL_BASE_URL is configurable.

This is an SSRF vulnerability rather than remote payload execution: the downloaded bytes are written to disk, but the audited code does not execute them.

Attack Path

  1. An attacker controls or compromises the configured OpenAI-compatible model endpoint.
  2. The victim invokes the Skill to generate an image.
  3. The malicious endpoint returns a response whose data[0].url points to a loopback, private-network, link-local, or cloud metadata address.
  4. _extract_image_bytes forwards the URL to _download_image.
  5. requests.get accesses the target and follows any redirects without destination validation.
  6. The target response is returned as image content and written to the configured output path.

Impact Assessment

An attacker controlling the ...[truncated 568 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer b64_json API responses so the client does not need to retrieve a second server-selected URL.
  2. If URL downloads remain necessary, require HTTPS and enforce an explicit allowlist of trusted image-host domains.
  3. Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6.
  4. Disable redirects with allow_redirects=False, or validate every redirect target using the same scheme, hostname, and resolved-address rules.
  5. Account for DNS rebinding by ensuring that the validated address is the address used for the connection.
  6. Stream the response and enforce a strict maximum download size.
  7. Accept only expected image media types and verify the file signature and decodability before saving it.
  8. Apply outbound network controls that prevent the Skill process from reaching internal services and cloud metadata endpoints.
  9. Reject URLs containing embedded credentials or unsupported ports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill explicitly relies on environment variables, invokes a script that writes image files, and sends user text to an external model endpoint, yet it declares no tool scope or allowed-tools restrictions. This creates unnecessary ambiguity about what the skill is permitted to access and increases the risk of over-broad execution capabilities if the hosting platform grants defaults more permissive than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description states that it uses an external OpenAI-compatible image API and writes output images to disk, but it does not clearly warn users that their input text may be transmitted off-box and persisted as files. If users provide sensitive dictated content, this omission can lead to unintended disclosure to third-party services and local retention of generated artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document instructs users to send prompts and image-generation requests, authenticated by an API key, to a third-party remote endpoint but does not clearly warn that user text and related generation data will leave the local environment. In a skill that may process speech-recognition text or polished user text, this can expose potentially sensitive user content and credentials-handling expectations without informed consent or privacy guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The prompt construction explicitly instructs the model to generate a Chinese meme image and render Chinese text, and other strings in the file assume Chinese-language behavior. There is no option for the user to choose language or any documented justification that this skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends user-provided text to an external model endpoint via client.images.generate(...) without any disclosure, consent flow, or data-minimization guard. Because the input may originate from voice recognition or polished personal text, this can expose sensitive user content to a third-party service unexpectedly, creating a privacy and compliance risk rather than a code-execution flaw.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script downloads image content from a remote URL returned by the model API and writes it to disk automatically, with no user warning, content validation, or safety checks. This can store untrusted remote data locally and may expose users to inappropriate, malicious, or unexpectedly large content, especially if the upstream service or response is compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest uses a Chinese-only display name, "语音文本转表情包", with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific context. This can violate language/locale policy expectations when users are not given a choice or explanation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The phrase '会强制往' describes a mandatory output-style constraint in natural language rather than offering a user-selectable option. While this is a style constraint rather than a region-specific locale, it is still a natural-language policy-like restriction presented without opt-in or documented choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown guidance forces a specific language/locale experience by presenting the integration instructions entirely in Chinese, with no indication that other language options are available. Under the stated policy, language-specific content should either be optional, user-selected, or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency specification openai>=1.0.0 is unpinned, so builds may resolve to different versions over time. This creates supply-chain and stability risk because a future incompatible or vulnerable release could be installed without review, even though the manifest itself does not prove an immediately exploitable flaw.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
openai>=1.0.0
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The dependency requests>=2.31.0 is unpinned, which means installation may pull in any newer release, including one with unreviewed changes or known vulnerabilities. For a skill that likely makes outbound API calls for image generation, this increases supply-chain exposure and can affect confidentiality or reliability if a bad version is resolved.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
openai>=1.0.0
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The manifest includes requests without an exact version, and the package has multiple published advisories affecting some releases. Because the installed version is not pinned, it is impossible to verify from this file alone whether deployment will use a vulnerable release; in a networked skill, that uncertainty matters more because HTTP client flaws can expose credentials, request integrity, or sensitive data.

Content

No source excerpt is available for this finding.