Doubao Maliang Image Gen

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:00 AM UTC
• Version: 1.0.1

Overview

This image-generation skill is mostly coherent, but it needs review because it can send the user's API key to a configurable endpoint and download unvalidated URLs returned by that endpoint.

Review this skill before installing. Use only trusted Volcano Engine ARK endpoints, do not let prompts or untrusted configuration set SEEDREAM_API_ENDPOINT or --endpoint, and use a narrowly scoped API key with quota limits. Avoid sensitive prompt content unless you are comfortable sending it to the configured remote image service and storing it locally in manifest.json.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gen.py:64

Finding

API Credential Disclosure Through an Unrestricted Configurable Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gen.py:81

Finding

Unvalidated API-Controlled Image Download Enables SSRF and Resource Exhaustion

Content

View full analysis

None: req = urllib.request.Request( url, headers={ "User-Agent": "doubao-maliang-image-gen/1.0", }, ) with urllib.request.urlopen(req, timeout=300) as resp: target.write_bytes(resp.read()) ``` ```python if isinstance(image_url, str) and image_url: download_url(image_url, target) ``` ### Technical Analysis The script trusts the `url` field in the image-generation API response and passes it directly to `urllib.request.urlopen()`. It does not validate: - The URL scheme. - The destination hostname or port. - Whether the resolved address is loopback, private, link-local, or otherwise internal. - Redirect destinations. - The response `Content-Type`. - The response size. - Whether the downloaded data is a valid image. Because the configured API endpoint is unrestricted, an attacker-controlled endpoint can reliably provide a malicious image URL. A compromised legitimate service or manipulated response could produce the same result. The use of `resp.read()` reads the entire response into memory before writing it to disk. A large or indefinitely streamed response can therefore consume excessive memory, while repeated or large downloads can consume disk space. Content is saved using an inferred or default image extension without decoding and validating the image format. ### Attack Path 1. The attacker controls or compromises the selected image-generation endpoint, or otherwise causes it to return a crafted response. 2. The endpoint returns a nonempty `data` list containing a malicious `url`. 3. The URL points to one of the following: - A service accessible only from the Agent's network. - A loopback, private, or link-loc ...[truncated 1493 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises capabilities that imply access to environment variables, network calls, and local file writes, but it does not declare any explicit tool scope or permissions. This creates an authorization transparency gap: users and the host may not be able to clearly constrain or review what the skill can access, increasing the risk of over-privileged execution and unintended data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The trigger list includes broad vendor/model terms like 'Doubao', 'Seedream', 'Volcano ARK', and generic requests to use the Maliang path, which can match ordinary image-generation conversations rather than an explicit invocation of this specific skill. Over-broad routing can cause the skill to activate unexpectedly, sending user prompts to an external API and writing local artifacts without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that outputs are saved locally and that a manifest contains the prompt, model, and timestamp, but it does not clearly warn users that their prompts and related metadata are persistently stored on disk. Because prompts may contain sensitive personal, business, or creative information, this omission can lead to privacy leakage, unintended retention, and later disclosure through local access or backups.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description begins in Chinese and then switches to English, which may impose a language expectation on users without any opt-in or documented locale scope. Under the language/locale policy check, this is a natural-language issue because the file does not explain whether the skill is intended only for Chinese-speaking users or offer alternative localization behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code sends the user-provided prompt to an external HTTP endpoint via request_images, which is a privacy-relevant network operation. Although the CLI description names the remote service, there is no explicit runtime warning, confirmation, or comment disclosing that the prompt text will be transmitted off-box.

Content

No source excerpt is available for this finding.