Security audit

AI 火宝

Security checks for vulnerabilities and agentic risk

Overview

This is a user-run image generation skill, but it sends prompts, image URLs, and an API key to an undisclosed chatfire.site endpoint despite Volcengine branding.

Review this skill carefully before installing. Use only a narrowly scoped, disposable API key, prefer the HUOBAO_API_KEY environment variable over --api-key, avoid sensitive prompts or private/signed image URLs, and do not enable debug mode in shared terminals, CI, or logged environments. The publisher should clearly disclose why chatfire.site receives credentials and user content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/t2i.py:15
Finding: API Credentials and User Content Transmitted to an Undisclosed Third-Party Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/t2i.py:31
Finding: API Secret Accepted Through Process Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Tainted flow: 'req' from os.environ.get (line 81, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/i2i.py (reported line 92)May include surrounding context.
python
) try: with urllib.request.urlopen(req, timeout=120) as response: result = json.loads(response.read().decode("utf-8")) except urllib.error.HTTPError as e: error_body = e.read().decode("utf-8")

Tainted flow: 'req' from os.environ.get (line 75, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/t2i.py (reported line 86)May include surrounding context.
python
) try: with urllib.request.urlopen(req, timeout=120) as response: result = json.loads(response.read().decode("utf-8")) except urllib.error.HTTPError as e: error_body = e.read().decode("utf-8")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill documents sending prompts and image URLs to external scripts/API endpoints and requires an API key, but it does not warn users that their inputs, referenced images, and credentials are transmitted off-system. This can lead to unintentional disclosure of sensitive prompts, private image URLs, or unsafe handling of API keys, especially when users copy examples directly with secrets on the command line.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Debug mode prints the input image URL, prompt, model, size, and full JSON request body to stderr, which can leak sensitive prompts, private asset URLs, or business data into terminal histories, CI logs, and centralized log systems. Although the API key is not printed, the logged content itself may be confidential and is emitted without any warning or redaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends the user-provided image URL and prompt to an external service, which may disclose sensitive image content, private URLs, or confidential prompt text to a third party. While this is core functionality, the absence of an explicit privacy/data-sharing warning increases the risk that users unknowingly transmit sensitive data outside their environment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/i2i.py (reported line 15)May include surrounding context.
python
import urllib.error API_URL = "https://api.chatfire.site/v1/images/generations" # 支持的模型 MODELS = [

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/t2i.py (reported line 15)May include surrounding context.
python
import urllib.error API_URL = "https://api.chatfire.site/v1/images/generations" # 支持的模型 MODELS = [

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script sends both user-provided prompts and an API credential to a third-party remote service, but it does not clearly warn the user at runtime or in structured output that their input leaves the local environment. In an agent-skill context, this can cause unintended disclosure of sensitive prompts, internal data, or secrets embedded in prompts if users assume the tool is local-only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The description string is written entirely in Chinese and gives no indication that the skill supports user language selection or is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without opt-in or documented locale justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The user-facing description, errors, warnings, and CLI help are written exclusively in Chinese, which effectively imposes a single language for interacting with the skill. There is no indication that this locale restriction is optional or required for a region-specific compliance reason.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.