AIGC服装图生成

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:50 PM UTC
• Version: 1.2.3

Overview

The skill mostly matches its apparel image-generation purpose, but it also includes high-impact account, credential, billing, upload, and persistence behavior that is only partly scoped and disclosed.

Review this skill before installing in shared or sensitive environments. Use it only with trusted LinkFox endpoints, avoid overriding service base-url environment variables, do not provide phone numbers or payment choices unless you intend to use the LinkFox onboarding/billing flow, and prefer session-scoped or secret-store API keys instead of writing keys into shell startup files. Treat uploaded clothing/model images, image URLs, brand data, and generated plans as locally persisted session artifacts that may need cleanup.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used to send authentication material, including SMS-login tokens and authorization headers. In an agent/skill environment, env vars may be host- or deployment-controlled rather than trusted, so this creates a credential exfiltration path to an attacker-controlled endpoint via SSRF-style redirection of outbound auth traffic.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request destination is built from environment variables and used with the bearer API key from environment headers. If an attacker can influence LINKFOX_AGENT_API_URL or fallback variables, the CLI will transmit the API key and order/account requests to an arbitrary server, exposing credentials and enabling unauthorized account actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs the agent to use shell, read and write local files, access environment variables, and make networked calls, yet it declares no permissions. This creates a governance and review gap: operators and policy systems may treat it as less privileged than it really is, while the skill can still manipulate files and invoke downstream tools with network access.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The skill states there is no upload step, yet an earlier runtime step explicitly uploads non-URL local file paths via `linkfox-file-upload`. This inconsistency can mislead reviewers and users about data egress, increasing the chance that local or sensitive files are transmitted to remote storage without clear consent or proper scoping.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: download_media fetches arbitrary attacker-controlled HTTP(S) URLs and writes the response to local storage with no hostname/IP allowlist, size limit, or redirect control. In an agent environment this creates an SSRF-style primitive that can be used to reach internal services or download unexpected content, which is more dangerous than the skill's stated upload-driven image workflow suggests.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements account onboarding, SMS login, API-key issuance, package purchase, and payment QR generation, which is unrelated to the declared clothing image-generation purpose of the skill. That mismatch materially increases risk because users and reviewers may grant the skill broader trust than warranted while it performs credential and billing-sensitive operations.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code can list purchasable plans, create orders, and generate payment QR codes despite the skill being described as an image-generation tool. Embedding billing capabilities in an unrelated skill expands abuse potential to unauthorized purchases, social engineering, and hidden monetization flows, especially when combined with token handling.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The prompt explicitly supports generating child-associated model imagery via terms like “阳光儿童” and child-clothing detection logic, which extends the skill from apparel visualization into human image generation involving minors. In an image-generation context, this increases safety risk because the system is being guided to create realistic child model depictions without strong age-gating, consent, or stricter policy constraints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to persist brand gene outputs and image plan data to session-local files and to retain absolute file paths in context, but it provides no user notice, consent boundary, retention rule, or minimization guidance. Because the inputs are user-uploaded product images and derived brand metadata, this creates a real privacy and data-governance risk if sensitive commercial or personal data is stored longer than necessary or exposed to other components.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The document explicitly instructs the runtime to persist confirmed planning data to `$DATADIR/image-plan.json`, and the broader skill handles user-uploaded clothing/model images plus descriptive metadata. Persisting user-derived workflow data to local storage without any retention, access-control, or user-notice guidance increases the risk of unintended exposure of potentially sensitive commercial assets, model photos, or customer content if the host environment is shared or logs/artifacts are later accessed.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: These fields enumerate multiple intermediate files containing task specs, script paths, result fragments, brand data, and uploaded image URL sets, but provide no safeguards around storage, sensitivity classification, or cleanup. In this skill context, those artifacts can reveal proprietary product plans, brand information, and references to user-uploaded imagery, creating a broader attack surface through residual files and metadata leakage.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The onboarding flow instructs collecting a user's phone number and using it to send login codes and register an account, but it provides no privacy notice, consent language, retention limits, or guidance on how that personal data is handled. In an agent skill context, this creates unnecessary privacy and compliance risk because operators may solicit and process sensitive contact data without clear safeguards or minimization.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document tells users to persist API keys in shell startup files and even source them immediately, but it does not warn that these files may be readable by other local users, synced, backed up, or later exposed through support bundles and terminal history. Persisting credentials without contextual security guidance increases the chance of long-term secret exposure and misuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code persists user-supplied image URLs plus derived planning metadata, brand information, script paths, and task state to disk in a session data directory without any visible minimization, retention control, or consent mechanism in this component. In an image-generation skill handling potentially sensitive product assets or private URLs, this creates unnecessary data exposure risk if the host environment is multi-tenant, logs/backups are accessible, or the data directory is reused.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The template hard-codes default language/platform/region values (English / Amazon / US) whenever those fields are empty, without requiring user confirmation. This can cause unintended localization, marketplace targeting, and compliance or branding mismatches, especially in cross-border e-commerce workflows where output content may be generated for the wrong audience.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The template is defined as a powerful general-purpose prompt without explicit activation boundaries or narrow invocation conditions inside the file itself. In a larger agent system, this broad reusability can cause the template to be invoked in unintended contexts, increasing the chance of prompt misuse, data overreach, or policy-bypassing behavior when unrelated inputs are routed into it.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The rule forcing selling_point to always be output in Chinese directly conflicts with the user-selected {language} and other language-consistency rules. This creates a prompt-level policy contradiction that can produce mixed-language output, break downstream parsers or compliance assumptions, and cause the system to ignore caller intent in multilingual commerce workflows.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The template describes broad clothing-image analysis capabilities and does not impose tight activation boundaries inside the prompt itself. That can cause the skill to be selected for loosely related image-analysis requests, increasing the chance of unintended invocation, overreach into adjacent tasks, or misrouting user data into a workflow that was not explicitly requested.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: Forcing Chinese-only output without user choice reduces user control and can cause the system to ignore the user's language preference or accessibility needs. While not a classic security bug, it can contribute to unsafe or misleading interactions if users cannot understand important size, care, or limitation information.

Static analysis

No suspicious patterns detected.