Z.ai 图片理解

• Outcome: Pass
• Latest audit: Jul 20, 2026 · 7:57 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed cloud image-analysis integration, but users should only send images they are comfortable sharing with Z.ai and should review saved output files.

Install only if you are comfortable sending selected images, image URLs, and prompts to Z.ai's cloud API. Avoid confidential screenshots or private documents unless that data handling is acceptable, review any Markdown/output paths for sensitive retained content, and prefer installing with patched pinned dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities that require environment variable access, local file reads, persistent file writes, and outbound network access, yet no permissions are declared. In an agent ecosystem, undeclared capabilities undermine user consent and policy enforcement because the skill can access local images, write files under the user's home directory, and contact an external API without an explicit permission boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The stated purpose is image understanding, but the documented behavior also includes fetching arbitrary HTTP/HTTPS URLs, reading arbitrary local paths, creating persistent config files, and writing output files. That mismatch is security-relevant because users may treat the skill as a simple analyzer while it actually has broader data access and persistence behaviors that can expose sensitive local content or create unintended data retention.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill prominently advertises image understanding via a cloud Vision API but does not clearly warn users that provided images and image URLs are transmitted to an external third-party service for analysis. This creates a real privacy and data-handling risk, especially if users supply confidential screenshots, documents, or internal URLs under the assumption processing is local.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function transmits user-supplied image content to a third-party cloud API via provider.analyze(image_base64, prompt) without any inline warning, consent check, or explicit disclosure at call time. This can expose sensitive local images, screenshots, or embedded metadata to an external service, which is especially relevant because the function accepts local paths, URLs, and base64 data and can be called programmatically without the user seeing the package documentation.

Missing User Warnings

Medium

• Confidence: 71% confidence
• Finding: The optional Markdown export persists both the input image reference and the generated analysis to a predictable location under the user's home directory, which can expose sensitive URLs, data URIs, or derived content if the source image contains private information. Because the feature lacks an explicit privacy warning or redaction step, users may unintentionally leave sensitive artifacts on disk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The provider sends both the user prompt and the base64-encoded image to a third-party API endpoint, which creates a real privacy and data-governance risk if users are not clearly informed or if sensitive images are processed unexpectedly. In this skill’s context, external transmission is core functionality, but the absence of visible disclosure, consent handling, or data-classification controls still makes it a legitimate security/privacy weakness rather than a false positive.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
        
        try:
            response = requests.post(
                self.chat_endpoint,
                json=payload,
                headers=headers,

• Confidence: 94% confidence
• Finding: requests.post( self.chat_endpoint, json=

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
Pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 92% confidence
• Finding: requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
Pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 92% confidence
• Finding: Pillow>=10.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
Pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 89% confidence
• Finding: python-dotenv>=1.0.0

Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: requests==2.31.0

Known Vulnerable Dependency: Pillow==10.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2023-4863 (libwebp: OOB write in BuildHuffmanTable) +7 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: Pillow==10.0.0

Known Vulnerable Dependency: python-dotenv==1.0.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: python-dotenv==1.0.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.