AIGC图像生成

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.2.2

Overview

The skill can generate images as advertised, but it also handles login, API-token creation, and payment orders with limited scoping and confirmation controls.

Review this skill carefully before installing. It is not just an image generator: it can help create or retrieve account credentials and create payment orders for credits. Use it only if you trust LinkFox, are comfortable sending prompts/reference image URLs to its services, and understand where API keys and generated files will be stored. Avoid overriding LinkFox endpoint environment variables unless you are intentionally testing with non-production credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

• Confidence: 93% confidence
• Finding: The script downloads arbitrary URLs from `resultList` using `download_media()`, and those URLs originate from a remote API response rather than a trusted local constant. Because only the scheme is checked, a compromised service or attacker-controlled response could force the skill to make outbound requests to unexpected hosts and download unbounded content, enabling SSRF-like network access and local disk consumption.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The POST target is derived from environment-controlled base URLs, so a modified runtime environment can redirect login and token requests to an attacker-controlled endpoint. Because these requests can carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, this becomes a credential exfiltration path rather than a harmless configurability feature.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and then used in urlopen with the Authorization header containing the API key. If an attacker can influence environment variables, they can redirect authenticated gateway traffic and capture the bearer token, user/account data, and order-related operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes use of environment variables, network calls, and local file writes, but no explicit permissions are declared. This creates a transparency and consent problem: the runtime can access sensitive credentials, call external services, and persist files without a clear permission boundary for users or reviewers. In this context, the lack of declaration is risky because the skill also performs automatic execution and downloads.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: There is a significant description-behavior mismatch: the skill is presented as an image generator, but the referenced behavior includes SMS-based login, API key acquisition, plan lookup, order creation, QR-code payment generation, and payment-status polling. Hidden account, billing, and payment flows materially change the trust and risk profile, and could lead to credential harvesting, unauthorized purchases, or financial abuse if invoked unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The API reference adds a separate feedback submission endpoint unrelated to the core image-generation flow, which expands the skill's data-sharing surface. Because the feedback payload can contain free-form user content and is sent to a different external domain, this creates a risk of unintended exfiltration of user data or conversation details if the skill invokes it without explicit user awareness and purpose limitation.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements phone-based login, API-key issuance, package discovery, ordering, and payment QR creation, which is materially unrelated to an image-generation skill's declared purpose. That mismatch increases the likelihood of unnecessary credential collection and monetization flows being embedded in a skill where users would not reasonably expect them.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code creates orders, renders payment QR codes, and queries payment state despite the skill being described as image generation. Billing capability in an unrelated skill broadens abuse potential, including unexpected charges, social engineering, and covert monetization workflows presented under a different user expectation.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script logs users in with SMS verification and then retrieves or generates platform API tokens, effectively turning a phone login flow into credential issuance. In the context of an image-generation skill, this is especially dangerous because it can bootstrap long-lived API access that exceeds what a user would expect from a simple content-generation tool.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases are broad and common, such as '帮我画', '做张图', and 'generate image', increasing the chance of accidental invocation during ordinary conversation. Because the skill can perform external API calls and write files, unintended triggering can lead to unapproved network activity, consumption of quota, and unexpected local artifacts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that it will automatically poll external APIs and download generated images into a local session directory, but it does not prominently warn users about network access and disk writes before doing so. This weakens informed consent and can expose users to unwanted data transfers, local storage of potentially sensitive content, or quota/cost consumption.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instruction to 'immediately execute' without waiting for user confirmation is unsafe because the skill performs external API calls and local file writes, and may also interact with authentication or billing-related flows per the broader skill context. Removing the confirmation barrier makes accidental or manipulated invocation much more dangerous and increases the likelihood of unauthorized actions and resource consumption.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The documentation instructs the skill to send authorization credentials and user-supplied prompts/reference image URLs to a remote gateway but provides no privacy, minimization, or handling guidance. In an agent setting, prompts and image URLs may contain sensitive personal or proprietary data, so the absence of warnings or constraints increases the chance that sensitive content is transmitted off-platform without informed handling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The feedback API section describes sending feedback content to a separate public endpoint but does not warn that user content may leave the primary tool environment. This is dangerous because operators may include user statements, transcripts, or sensitive context in the `content` field, causing unnecessary disclosure to a third-party service outside the main image-generation API path.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The onboarding instructions direct the agent to handle sensitive authentication data, including a user's phone number, SMS verification code, and API key, and to guide persistence of that key into shell startup files. Even if intended for legitimate setup, this creates a real security risk because it normalizes collection of personal data and long-lived credential storage without explicit consent, minimization, masking, or warnings about persistent system changes.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script silently writes full API responses to session storage and automatically downloads generated media to disk without an explicit user-facing warning. In an agent environment, this can create privacy and storage risks because prompts, metadata, and generated assets may persist locally longer than the user expects.

Static analysis

No suspicious patterns detected.