SGLang-Diffusion Image Generation

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:16 PM UTC
• Version: 1.0.1

Overview

This skill coherently generates images through a user-selected SGLang-Diffusion server, with no evidence of hidden persistence, destructive behavior, or unrelated data access.

Install only if you intend to use a SGLang-Diffusion server. Prefer the default localhost server or HTTPS for remote servers, and set SGLANG_DIFFUSION_API_KEY through environment or protected configuration rather than putting real keys directly on the command line.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.py:63

Finding

Remote API credentials and image prompts may be transmitted over plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/generate.py:63-88
Vulnerability Type: Plaintext transmission of sensitive data
Risk Level: Medium

Vulnerable code:

python

url = f"{server.rstrip('/')}/v1/images/generations"

body: dict = {
    "prompt": prompt,
    "size": size,
    "n": 1,
    "response_format": "b64_json",
}
if negative_prompt:
    body["negative_prompt"] = negative_prompt
if steps is not None:
    body["num_inference_steps"] = steps
if guidance_scale is not None:
    body["guidance_scale"] = guidance_scale
if seed is not None:
    body["seed"] = seed

data = json.dumps(body).encode("utf-8")
headers = {"Content-Type": "application/json"}
if api_key:
    headers["Authorization"] = f"Bearer {api_key}"

req = urllib.request.Request(url, method="POST", headers=headers, data=data)

The documentation also explicitly demonstrates a remote plaintext endpoint:

bash

python3 {baseDir}/scripts/generate.py --prompt "photo" --server http://192.168.1.100:30000 --out ./my-image.png

Technical Analysis

The server address is supplied directly by the user and is not validated to ensure that remote connections use HTTPS. When an API key is configured, it is placed in the Authorization header regardless of the selected URL scheme. The request body contains the image prompt, negative prompt, dimensions, seed, and generation settings.

Sending this request to a non-loopback HTTP endpoint exposes the bearer credential and request content to any party able to observe or alter traffic between the client and server. The default loopback endpoint is appropriate for a genuinely local service, but the documented remote-server mode causes sensitive information to cross the network without transport encryption.

Network communication is necessary for the declared image-generation functionality. However, permitting authenticated remote communication over plaintext HTTP e ...[truncated 1373 chars]

Remediation

View remediation

Remediation Suggestions

• Require https:// for every non-loopback server address.
• Permit plaintext HTTP only for verified loopback destinations such as 127.0.0.1, ::1, and localhost.
• If remote plaintext HTTP must remain available for exceptional development use, require an explicit opt-in flag and display a clear warning. Reject sending an API key unless TLS is enabled.
• Update SKILL.md so all remote-server examples use HTTPS.
• Parse the URL with urllib.parse.urlparse and validate its scheme and hostname before constructing the request.
• Continue using standard certificate verification for HTTPS and do not introduce options that silently disable certificate validation.
• Consider allowing administrators to restrict requests to an approved hostname or endpoint allowlist.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate.py:136

Finding

API key may be exposed through command-line arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/generate.py:136
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Low

Vulnerable code:

python

ap.add_argument(
    "--api-key",
    "-k",
    default=None,
    help="API key (optional; only needed if server uses --api-key).",
)

The documentation encourages this usage:

bash

python3 {baseDir}/scripts/generate.py --prompt "hello" --api-key sk-my-key

Technical Analysis

Passing secrets through command-line arguments can expose them through shell history, process inspection facilities, terminal recordings, debugging output, and automation logs. The script already supports obtaining the credential from SGLANG_DIFFUSION_API_KEY, so command-line credential handling is not required for its core functionality.

The script does not print the API key itself. Nevertheless, the key can be recorded before or while Python processes the arguments, meaning that application-level redaction cannot reliably eliminate this exposure.

Attack Path

1. A user follows the documented example and supplies the API key using --api-key.
2. The shell records the complete command in its history, or a process-monitoring or automation system records the process arguments.
3. Another local user, administrator, support operator, or party with access to the retained logs retrieves the argument value.
4. The party reuses the exposed key against the configured SGLang-Diffusion service.
5. If the service is reachable and the key remains valid, the party receives the same API authorization associated with that credential.

Impact Assessment

Exposure can allow unauthorized use of the image-generation API within the permissions assigned to the compromised key. Possible consequences include consumption of compute resources, generation of unauthorized content, and access to any additional operations authorized by the ...[truncated 238 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the documentation example that places an API key directly on the command line.
• Prefer the existing SGLANG_DIFFUSION_API_KEY environment-based configuration over command-line arguments.
• For stronger protection, support reading the credential from a permission-restricted file or from standard input without terminal echo.
• Consider deprecating and eventually removing --api-key.
• If backward compatibility requires retaining the option, clearly warn users that command-line secrets may be visible in shell history, process listings, and logs.
• Ensure deployment and automation systems source the credential from a protected secret manager rather than embedding it in command strings.
• Apply least privilege and short expiration periods to API keys so that disclosure has limited impact.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 30)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
   """Get API key from argument first, then environment."""
   if provided_key:
       return provided_key
   return os.environ.get("SGLANG_DIFFUSION_API_KEY")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes a Python script that can use environment variables, write files, and make network requests, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: a host may permit broader execution than intended, and users or auditors cannot easily assess the skill's capabilities from the manifest alone.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.