agnes-图片生成

• Outcome: Review
• Latest audit: Jul 30, 2026 · 4:34 AM UTC
• Version: 1.0.3

Overview

The skill matches its image-generation purpose, but it bundles and automatically uses a hardcoded Agnes API key while sending prompts and optional images to external Agnes endpoints.

Review before installing. Use your own Agnes API key through secure configuration, avoid sending sensitive images or proprietary prompts, and treat the bundled key as exposed and unsuitable for shared distribution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs network access to external Agnes endpoints and references built-in API key usage, yet no permissions are declared. This creates a transparency and control gap: users and the host system may not understand that prompts, source images, and generated outputs involve external transmission and local handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is image generation, but the skill also embeds a default credential and directs automatic saving of outputs to local storage. That mismatch is dangerous because it hides secret use and file-writing behavior from users and reviewers, reducing informed consent and making abuse or unintended data handling easier.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The markdown exposes a hardcoded Agnes API key directly in example requests. Embedded credentials are sensitive secrets that can be reused by anyone who reads the skill, leading to unauthorized API consumption, quota theft, account abuse, and possible attribution of malicious activity to the key owner.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The note explicitly states that the API key is hardcoded and requires no user input, confirming intentional built-in secret use. This normalizes unsafe credential handling and encourages deployment of a skill that silently spends a shared account's API quota without clear ownership or access controls.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds a hardcoded Agnes API key and uses it automatically as a fallback when the user does not provide one. This exposes a live credential to anyone who can read the skill, enables unauthorized use of the associated account/quota, and normalizes secret leakage inside distributed code.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill description does not clearly warn that user prompts and source images will be sent to a third-party Agnes service. For image-to-image workflows this can expose potentially sensitive user-provided images or proprietary prompts to an external processor without adequate notice.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Using an embedded default API key without explicit opt-in or strong warning can cause users to unknowingly consume a shared credential and encourages insecure secret handling. In practice, this also makes the credential easy to extract from the code and abuse against the remote service.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The image-to-image flow reads a local file, base64-encodes it, and sends its contents to remote endpoints, including a disaster-recovery endpoint, without an upfront consent/privacy warning. This can result in accidental transmission of sensitive local images to third-party services, which is especially relevant in an agent skill context where users may not expect file exfiltration behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/agnes_gen.py:39

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:97