T09 · Insecure Skill Coding Practices
Warning
- Location
generate.py:84- Finding
Reference images and sensitive URLs are exposed through console logging
- Content
View full analysis
- Remediation
View remediation
Security audit
image-generator
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it unnecessarily exposes reference image data in logs and accepts unvalidated download URLs from the API.
Review before installing. Avoid passing private local images, data URLs, or signed URLs until logging is fixed, because those values may be retained in transcripts or logs. Use a limited API key and run in a network-contained environment if you do not fully trust API-returned download URLs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
generate.py:147- Finding
Unvalidated API-controlled image URL permits server-side request forgery
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose says the skill generates images from text prompts, but the documented behavior also includes reading local files, accepting arbitrary URLs/data URLs, and writing output files. This mismatch is dangerous because users and policy systems may underestimate the skill's ability to access local content or interact with untrusted remote resources, which can enable data exposure, SSRF-like fetches, or unintended file handling.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documentation describes use of environment-derived API credentials and outbound network access, but it does not declare any tool scope or permission boundaries. This is dangerous because an agent may grant broader-than-necessary capabilities implicitly, making credential access and external data exfiltration harder to review or constrain.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description claims text-to-image generation, but the implementation also supports image-to-image workflows by accepting reference images and converting local files into data URLs for upload. This mismatch expands the data-handling surface beyond what users would reasonably expect, increasing the risk of unintentionally sending sensitive local image content to a remote service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The helper reads arbitrary local files identified as image paths, base64-encodes them, and sends their contents to a remote API as data URLs. In the context of an agent skill, this can lead to unintentional exfiltration of local sensitive files if a user or upstream agent passes a path without understanding that the file contents will leave the system.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Inline comments, the argparse description, and the --image-prompt help text all state that image-to-image prompting is supported. In practice, image_prompt is only printed and never added to the API payload or otherwise used to affect generation, so the documentation actively overstates what the code does.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python print(f" 端点: {api_base}") try: response = requests.post(api_base, json=payload, headers=headers, timeout=120, stream=True) image_url = None
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file contains substantial user-facing content in both Chinese and English, including headings, parameter descriptions, and examples, but does not state any language-selection behavior or let the user opt into a preferred language. Under the policy rule for language or locale constraints, user-facing language assumptions should be explicit or optional rather than imposed implicitly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code unconditionally reconfigures stdout and stderr to UTF-8. This enforces a specific encoding choice regardless of the user's locale or terminal preferences, which matches the language/locale policy concern for forced settings without opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The code accesses an API credential and sends it in an Authorization header for external network calls. While this is functionally expected for an API client, the file lacks any explanatory comment or user-facing warning about reading the key from GRSAI_API_KEY or passing secrets on the command line.
- Content