Security audit

qwenz-image-gen

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill mostly matches its stated purpose, but it should be reviewed because its script searches multiple local TOOLS.md files, including a hardcoded path, for an API key before calling Alibaba Cloud.

Review this before installing if your environment contains shared TOOLS.md files or organization-managed API keys. Prefer setting DASHSCOPE_API_KEY explicitly in the environment for the session, avoid putting confidential prompts into this tool, and be aware that generated-image requests are sent to Alibaba Cloud.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior goes beyond image generation by directing the runtime to source secrets from TOOLS.md, which implies local file inspection for credentials not reflected in the high-level description. This mismatch is dangerous because users may authorize an image tool without realizing it can traverse local configuration files and harvest API keys from hardcoded locations, increasing secret-exposure risk.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises environment-variable requirements and instructs users to place credentials in TOOLS.md, but it does not declare any explicit tool scope such as allowed network access or file reads. That creates an authorization/visibility gap: the skill can reasonably be expected to read local files and contact a third-party API without those capabilities being clearly constrained or disclosed in the skill manifest.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description does not clearly warn that user prompts are transmitted to Alibaba Cloud’s external image-generation service. That omission matters because prompts may contain sensitive personal, business, or regulated data, and users cannot make an informed decision about third-party disclosure without an explicit notice.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The README says certain keywords trigger automatic selection of z-image-turbo, but the listed triggers include very broad terms like “人”, “女”, “男”, and “photo”. These common words can appear in many unrelated prompts, making activation boundaries unclear and increasing the chance of unintended model selection.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script retrieves `DASHSCOPE_API_KEY` not only from the environment but also by scanning multiple local `TOOLS.md` paths for a matching secret. This broadens secret access beyond the skill's stated purpose and can unintentionally consume credentials from unrelated local files, increasing the risk of unauthorized secret use or accidental cross-project credential exposure.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill collects credentials from the environment or local files and sends user-provided prompts to Alibaba Cloud's remote API, but it provides no explicit user-facing disclosure about secret sourcing or prompt transmission. In practice, users may unintentionally submit sensitive prompts or allow the tool to use locally discovered credentials without realizing the privacy and data-handling implications.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: Exposing a --no-watermark option without any warning can facilitate removal of provenance signals and may conflict with platform policy, compliance requirements, or downstream authenticity expectations. While not a direct system-compromise issue, it increases the risk of misuse and deceptive redistribution of generated content.

Static analysis

No suspicious patterns detected.