Volcengine Image Generation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:36 AM UTC
• Version: 0.1.1

Overview

This image-generation skill appears purpose-aligned, but it can send API keys and local images to arbitrary configured endpoints and has weak controls around downloads and error output.

Review before installing. Use this only with a trusted HTTPS Volcengine/ARK-compatible endpoint, avoid sensitive local images or confidential prompts, and be aware that API keys are sent to the configured endpoint. Consider disabling automatic downloads and avoid sharing logs from failed runs because they may contain encoded reference images.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_image.py:49

Finding

Unrestricted API endpoint can receive credentials and local image contents over plaintext or attacker-controlled connections

Content

View full analysis

str: base = base.strip().rstrip("/") if not base: raise SystemExit("Missing VOLCENGINE_ENDPOINT / ARK_BASE_URL / OPENAI_BASE_URL") if base.endswith("/images/generations"): return base if base.endswith("/api/v3"): return base + "/images/generations" if base.endswith("/v1"): return base + "/images/generations" return base + "/v1/images/generations" ``` ```python def local_file_to_data_url(path_str: str) -> str: path = pathlib.Path(path_str).expanduser().resolve() if not path.exists(): raise SystemExit(f"Local image not found: {path}") mime = mimetypes.guess_type(str(path))[0] or "application/octet-stream" encoded = base64.b64encode(path.read_bytes()).decode("ascii") return f"data:{mime};base64,{encoded}" ``` ```python parser.add_argument("--endpoint", default=getenv("VOLCENGINE_ENDPOINT", "ARK_BASE_URL", "OPENAI_BASE_URL")) parser.add_argument("--api-key", default=getenv("VOLCENGINE_API_KEY", "ARK_API_KEY", "OPENAI_API_KEY")) ``` ```python url = build_url(args.endpoint) output_dir = pathlib.Path(args.output_dir).expanduser().resolve() ensure_dir(output_dir) download_dir = pathlib.Path(args.download_dir).expanduser().resolve() images = collect_images(args.image, args.image_file) payload = { "model": args.model, "prompt": args.prompt, "size": args.size, "n": args.n, "quality": args.quality, "response_format": args.response_format, "sequential_image_generation": args.sequential_image_generation, "stream": parse_bool(args.stream), "watermark": parse_bool(args.watermark), } if images: payload["image"] = images[0] if len(images) == 1 else images if ...[truncated 2782 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:175

Finding

Error handling prints complete base64-encoded reference images to logs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:102

Finding

Automatic result download permits server-directed network requests without destination or size restrictions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly instructs execution of a bundled Python script that uses environment variables, local file inputs, network requests, and local file downloads, but it declares no explicit tool scope or permission boundary. That mismatch increases the chance an agent will invoke shell, read local files, and send data externally without transparent consent or least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill says local image paths are automatically converted to base64 data URLs and then sent to a remote image API, but it does not prominently warn that this uploads local content off-device. Users may provide sensitive screenshots, personal photos, or proprietary artwork believing processing is local, resulting in unintended data exfiltration to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Local files supplied via --image or --image-file are automatically read, base64-encoded, and embedded into the API request, which causes file contents to be transmitted to a remote service. In a skill designed for image generation and upload workflows this is expected functionality, but the lack of prominent disclosure or confirmation increases the risk of accidental exfiltration of sensitive local images.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_image.py (reported line 119)May include surrounding context.

python

def reveal_in_finder(path: pathlib.Path) -> None:
    try:
        subprocess.run(["open", str(path)], check=False, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    except Exception:
        pass

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends prompts and optional reference images in an authenticated POST to an external endpoint, but it does not provide a clear user-facing warning at execution time that potentially sensitive content is leaving the local machine. Given the skill context, remote transmission is core behavior, yet insufficient disclosure can still lead to privacy and data-handling mistakes, especially if prompts or images contain confidential material.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The file includes a dedicated Chinese instruction section and multiple Chinese-only command examples, but it does not tell users whether output language is optional or whether the skill is intended specifically for Chinese-speaking users. Under the language/locale policy, forcing or implying a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.