Security audit

Doubao Image

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but its documentation says Zhipu web search while the shipped script sends prompts and a bearer token to a different Doubao/Volcengine image-generation service.

Review before installing. Only use this skill if you are comfortable with prompts and the configured API token being sent to Volcengine/Doubao for image generation, not just to Zhipu for web search. The publisher should align the name, description, endpoint, credential instructions, script name, and user-consent language before this is treated as a normal install.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: skill/scripts/search.sh:25
Finding: Undisclosed API and Functionality Substitution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose says this skill performs internet/web search via Zhipu for current information. The actual code does not search the web at all. Instead, it sends a prompt to an image generation model (doubao-image-v1) hosted at a Volcengine/Doubao endpoint and returns an image URL. This is a materially different primary purpose and uses different resources and credentials than described, so it is a clear mismatch.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The script is an executable shell program that performs networked actions, but the metadata reportedly does not declare shell capability/permissions. This mismatch is dangerous because it hides the true execution surface from reviewers and users, increasing the chance that powerful behavior is approved without appropriate scrutiny or sandboxing.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill metadata says this is a Zhipu web search skill, but the implementation calls Doubao's image-generation API instead. This capability mismatch is dangerous because it defeats informed consent and policy review: a user or platform may authorize a search tool while actually exposing prompts to a different third-party service for a different purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is named 'doubao-image' while the manifest and instructions describe a Zhipu web search capability. This identity mismatch can mislead reviewers, routing logic, or users into invoking the skill under false assumptions, which increases the chance of inappropriate tool use and weakens trust in the skill's declared behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The skill transmits user-supplied query content and an authorization bearer token to an external third-party API over the network. Even when this is the intended function, it is security-relevant because sensitive prompts or identifiers may be disclosed outside the local environment, and the token handling model increases exposure if logs, process inspection, or misuse occur.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
bash
export DOUBAO_API_KEY="your_key" curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \ -H "Authorization: Bearer $DOUBAO_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example request hardcodes the user message content as "搜索: YOUR_QUERY", which imposes a specific language/locale behavior in the skill instructions. The document does not indicate that users may choose their preferred language or that Chinese is required for a justified region-specific reason.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger guidance is broad enough to match many ordinary requests for general information, latest news, or fact-finding. Over-broad activation can cause the agent to send user queries externally when a local answer would suffice, creating unnecessary data exposure and unexpected use of third-party services.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The package metadata is internally inconsistent: the skill is named 'doubao-image' while the description states it performs Zhipu web search. This can mislead reviewers, users, or automated policy systems about the skill's real capability, increasing the chance that networked search behavior is installed or approved under an image-related label. In an agent-skill ecosystem, such mislabeling weakens trust boundaries and can conceal higher-risk behaviors behind a less suspicious package identity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description uses broad triggers like web image, latest news, and current information, which can cause the skill to be invoked for loosely related requests. Over-broad routing increases the chance that user prompts or sensitive context are sent to an external API unnecessarily, creating avoidable data exposure and unintended tool use.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The skill sends user-supplied query content to https://open.bigmodel.cn/api/paas/v4/chat/completions, which is an external third-party service. External transmission is expected for this skill, but it is still a real security/privacy concern because ambiguous routing and lack of explicit guardrails can result in unnecessary disclosure of user data or sensitive context.
Content: Scanner excerpt · skill/SKILL.md (reported line 40)May include surrounding context.
bash
export DOUBAO_API_KEY="your_key" curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \ -H "Authorization: Bearer $DOUBAO_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The 'When to Use' section lists generic phrases such as 'look up' and 'latest news about,' which are common across many benign queries and can trigger unnecessary external calls. In agent settings, ambiguous activation criteria raise the risk of data being transmitted to a third party without clear need or user awareness.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The inline comment explicitly identifies the script as an image-generation tool, contradicting the manifest's stated web-search purpose. While a comment alone is not exploit code, in this context it reinforces that the skill is misrepresented, which can mislead reviewers and mask undeclared external processing of user input.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: The script performs outbound network transmission of user-controlled content to an external API endpoint. External transmission is expected for many integrations, but here it is risk-relevant because the destination and function contradict the declared skill purpose, making the data flow less transparent and more likely to violate user expectations or platform policy.
Content: Scanner excerpt · skill/scripts/search.sh (reported line 33)May include surrounding context.
sh
prompt: $prompt }') RESULT=$(curl -s --proto =https --tlsv1.2 -m 60 -X POST "https://ark.cn-beijing.volces.com/api/v3/images/generations" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script forwards the user-supplied prompt to an external third-party API without any user-facing disclosure in the skill itself. This creates a privacy and consent risk because users may provide sensitive text believing they are using a search skill, while their content is actually transmitted to an unrelated image-generation endpoint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: L22 states that the API key will be visible in ps aux, which actively misdescribes the demonstrated command usage. In the examples at L40-L42, the shell expands $DOUBAO_API_KEY before invoking curl, so the key does appear in the process arguments; however this depends on execution context and is not a guaranteed property of the script itself as documented here, making the statement overbroad and misleading as written.
Content: No source excerpt is available for this finding.