AIGC商品图生成

• Outcome: Review
• Latest audit: Aug 7, 2026 · 10:51 AM UTC
• Version: 1.2.5

Overview

This product-image skill is mostly disclosed, but it bundles account/payment onboarding and contains prompt rules that infer or exclude protected traits, so users should review it carefully before installing.

Install only if you are comfortable with LinkFox receiving product images and related planning data, and with this skill helping manage LinkFox account setup, API keys, and paid plan orders. Avoid using the SMS-login/payment helper inside the agent unless you trust the environment and endpoints. Review or remove the templates that infer ethnicity or require non-Asian models before using this for human-containing product scenes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (32)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data to them via requests.post. Because this file handles SMS login, access tokens, refresh tokens, phone numbers, and API key generation, a poisoned environment can redirect those secrets to an attacker-controlled host, turning configuration into credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway path uses a URL derived from environment variables and attaches the API key in the Authorization header before calling urlopen. If an attacker can influence the runtime environment, they can redirect authenticated requests to their own server and capture the API key and related account data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is product image generation, but the file also references an onboarding/payment flow for SMS login, API key retrieval, token handling, plan listing, order creation, QR-code payments, and payment-status queries. That is a major scope expansion into credential and billing operations, which can expose users to unauthorized account actions, secret handling, and financial transactions outside the stated skill purpose.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The planner accepts a caller-supplied textgen_script path and later passes it into run_textgen, only checking that the file exists. This creates a script/path injection boundary where an untrusted job can cause execution of arbitrary local code or an unintended sibling script, which is especially dangerous in an agent skill that processes external requests.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: brand_gene_save_script is caller-controlled and is forwarded into extract_brand_gene without visible validation in this file. If the downstream function executes or imports that script, an attacker can influence what code runs during brand-gene extraction or where sensitive derived data is handled.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The template is explicitly designed for apparel image planning ('服饰套图内容规划师', model-wearing guidance, apparel-specific scene rules) while the skill metadata says this skill is for non-apparel products only. This mismatch can cause the agent to generate incorrect or inappropriate outputs, route apparel requests through the wrong workflow, and produce misleading content that violates product or business constraints.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The inline documentation and role definition actively instruct apparel-specific behavior, reinforcing processing assumptions that conflict with the skill's declared non-apparel purpose. In an agent pipeline, such hidden prompt divergence is dangerous because downstream components may trust metadata while the model follows the stronger in-template instructions, leading to persistent misclassification and unsafe or policy-breaking generation behavior.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This onboarding script performs account login, token issuance, subscription lookup, order placement, and payment QR generation, which is materially broader than a product image generation skill. That scope expansion increases the blast radius from simple image processing to account access and billing operations, making compromise or misuse far more damaging.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The file includes SMS-based authentication and API key retrieval/generation logic unrelated to the stated image-generation purpose. Embedding account bootstrap and token issuance inside a content-creation skill creates unnecessary access to user identities and long-lived credentials, which could be abused if the skill is compromised or misused.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The script implements package listing, order creation, payment-link handling, and QR rendering despite the skill being described as an image-generation tool. Billing and purchasing functions introduce financial risk, social-engineering potential, and unnecessary sensitive processing that is out of scope for the declared capability.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The template first requires each output to be JSON containing a selling_point field, then later instructs the model to output only raw prompt text and no JSON. Conflicting format rules can cause downstream parsers or safety wrappers to fail unpredictably, which may lead to dropped metadata, malformed outputs, or bypass of controls that rely on structured fields.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The template explicitly derives and enforces a model’s race/ethnicity from sales region or language, which is a protected-trait inference used to control generated human depictions. This creates discriminatory output behavior and can systematically exclude or misrepresent people without user opt-in or a legitimate necessity tied to the product image task.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This instruction goes beyond inference and imposes strict racial matching, including an explicit 'non-Asian' requirement. Hard-coding exclusionary protected-trait constraints is discriminatory by design and can produce biased, harmful, and policy-violating outputs at scale.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The template first frames sales region and audience as inputs for model selection, then introduces conflicting mandatory racial constraints later. This inconsistency masks discriminatory logic inside otherwise normal prompt-engineering guidance, making the behavior harder to detect and more likely to propagate into production use.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The workflow operationalizes ethnicity selection from locale and culminates in a mandatory non-Asian requirement for any human-containing concept. Because this appears in stepwise generation logic, it is likely to be applied systematically rather than incidentally, increasing the risk of repeated discriminatory outputs.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The template hard-codes apparel-specific logic such as clothing audience selection and model usage, which conflicts with the skill’s declared non-apparel product scope. This mismatch can cause the agent to generate outputs for the wrong domain, bypass expected routing boundaries, and produce unsafe or noncompliant content when invoked for unrelated products.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The constraints explicitly optimize for fashion marketing outcomes like lifestyle, fabric texture, and fit advantages, directly contradicting the non-apparel description of the skill. In practice this can systematically mis-handle user requests, leak capability boundaries, and create unreliable behavior that downstream systems may trust incorrectly.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The template claims outputs must be strictly based on provided inputs, but elsewhere authorizes automatic scenario transformation when inputs do not fit the audience. That contradiction weakens input integrity guarantees and allows the model to invent or alter salient content, which is risky in a system expected to preserve user-supplied constraints.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill sends user-supplied local files and image URLs to downstream upload and image-generation services, but the user-facing instructions do not clearly disclose that data will leave the local environment. This creates a privacy and data-governance risk, especially if the images contain proprietary product assets, internal drafts, or sensitive metadata.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to persist the final `imagePlanList` to `$DATADIR/image-plan.json` and related task files, but provides no requirement to disclose this storage to the user, obtain consent, or define retention limits. Because the plan content may include product descriptions, marketing claims, image concepts, and other potentially sensitive commercial data, silent persistence creates a privacy and data-governance risk, especially if the storage is reused across runs or accessible by other components.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The document explicitly instructs the system to persist user-provided planning data, image URLs, brand-related data, and task results to disk, but it provides no retention, access-control, minimization, or user-notice guidance. In an image-generation workflow, these files may contain sensitive business assets or proprietary product information, so undocumented persistence increases the risk of unintended exposure, reuse across sessions, or leakage through logs, shared storage, or later tasks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The onboarding instructions tell operators to ask users for a phone number and drive an automated registration flow, but they provide no privacy notice, consent guidance, retention limits, or safe handling instructions for that personal data. In a support/onboarding context, collecting phone numbers and verification codes without explicit data-handling safeguards increases the risk of unnecessary exposure of personal information and account compromise.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The template hard-codes English as the default when language is missing, which can override user expectations and produce outputs in the wrong language or market context without explicit consent. In this skill, that creates a policy and UX risk rather than a direct security exploit, but it can still lead to incorrect branded content and unintended cross-region behavior.

Vague Triggers

Medium

• Confidence: 71% confidence
• Finding: The skill describes broad behavior and transformation logic without precise trigger boundaries or exclusion conditions. Overbroad activation can cause the wrong template to run for ambiguous requests, producing inappropriate or policy-violating content in contexts where a different, safer skill should have been selected.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The skill instructs the system to infer and enforce model ethnicity from language, sales region, or audience, without explicit user request or consent. This introduces sensitive-attribute profiling and stereotyping into image generation, which can result in discriminatory or non-compliant outputs and may violate platform or legal policy requirements.

Static analysis

No suspicious patterns detected.