T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate.py:205- Finding
Unrestricted and Unbounded Download from an API-Controlled URL
- Content
View full analysis
- Remediation
View remediation
Security audit
qwenz-image-gen
Security checks for vulnerabilities and agentic risk
Overview
The skill does generate images as advertised, but it automatically searches local TOOLS.md files for an API key and downloads API-provided URLs without enough validation or limits.
Review before installing. Prefer providing DASHSCOPE_API_KEY through a controlled environment variable, avoid storing it in shared TOOLS.md files, and do not use sensitive prompts unless sending them to Alibaba Cloud is acceptable. The image download code should ideally validate allowed hosts, response type/status, and maximum size before saving files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented purpose is image generation, but the skill also indicates it may read TOOLS.md to obtain API credentials and write files locally, which expands its effective privilege beyond what the description suggests. Hidden or under-documented credential harvesting from local files is especially risky because users may not realize the skill inspects local configuration material rather than only using explicit inputs.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises network, environment-variable, and file-reading behavior but does not declare any tool scope such as permissions or allowed-tools. That omission weakens user visibility and policy enforcement, making it easier for the skill to access credentials and local files without clear consent boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill description does not clearly tell users that prompts and possibly sensitive creative content are transmitted to a third-party cloud service for processing. Without that disclosure, users may unknowingly send confidential, personal, or regulated information off-host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The setup instructions tell users to store an API key in environment variables or TOOLS.md without warning about the security implications of plaintext credential storage and accidental disclosure. This can lead to credential leakage through source control, shared configs, logs, or broader local file access by other tools.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script retrieves DASHSCOPE_API_KEY not only from the environment but also by scanning several local TOOLS.md paths, including a fixed absolute path. That behavior exceeds the stated purpose of image generation and creates an unexpected local secret-reading capability that can silently consume credentials from the host environment without explicit user consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code reads credentials from local TOOLS.md files automatically and gives no user-facing warning that it is accessing local secret material. In an agent-skill context, hidden credential discovery is risky because users may run the skill expecting only network access for image generation, not filesystem inspection for reusable secrets.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The feature list specifically emphasizes Chinese text rendering, and the document is entirely written in Chinese, but it does not explicitly offer users a language choice or explain that the skill is intentionally limited to a Chinese-language context. This can be interpreted as a locale-specific preference without clear opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.