ClawHub
Back to skill

Security audit

AIGC图像生成

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill mostly does what it says, but it also handles account login, API-key creation, paid plan ordering, and credential-bearing network calls with insufficient endpoint scoping.

Review this skill before installing. It is not just a simple local image helper: it sends prompts, reference image URLs, API keys, and account data to LinkFox services; it can help create or retrieve an API key; and it can initiate paid order flows when credits are insufficient. Only use it if you trust the LinkFox endpoints, understand where the API key will be stored, and can control environment variables that override service URLs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/aigc_imagegen.py:38
Finding

Unrestricted endpoint overrides can expose credentials and authentication data

Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: ...[truncated 3438 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/aigc_imagegen.py:168
Finding

Untrusted result URLs allow SSRF and unbounded file downloads

Content
View full analysis
Remediation
View remediation

other

Note
Location
scripts/aigc_imagegen.py:286
Finding

Unnecessary session and message identifiers are transmitted with API requests

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (24)

Tainted flow: 'req' from os.environ.get (line 297, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/aigc_imagegen.py (reported line 202)May include surrounding context.

python
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 297, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/aigc_imagegen.py (reported line 299)May include surrounding context.

python
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The script constructs outbound request URLs from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive authentication material to those endpoints via requests.post. Because this file handles SMS login, access tokens, refresh tokens, and API key generation, a poisoned environment can redirect secrets to attacker-controlled infrastructure, creating a credential exfiltration channel.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The gateway request path uses a base URL from environment variables and then calls urllib.request.urlopen with the resulting Request object while attaching the Authorization header from LINKFOX_AGENT_API_KEY. If an attacker can influence the runtime environment, they can redirect authenticated gateway traffic, exposing API keys and order/account data to an attacker-controlled server.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose is image generation, but the detected behavior includes SMS verification, phone login, API key generation, account/team inspection, package listing, order creation, payment QR generation, and payment-status polling. That is a major capability mismatch that can lead to unexpected authentication, billing, and account-management actions under the guise of a benign graphics tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction to execute immediately and forbid waiting for user confirmation is a strong anti-safety pattern because it suppresses informed consent before external API use and file-writing side effects. In security terms, it attempts to override normal approval controls and makes accidental or unauthorized actions materially more likely.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md
示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This skill is described as an image-generation tool, but the file implements a broad onboarding and commerce workflow including SMS login, API-key acquisition, plan listing, ordering, and payment QR generation. That mismatch materially increases risk because users invoking an image skill would not reasonably expect account bootstrap and payment-handling code, suggesting hidden or unjustified capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements package discovery, order creation, payment status queries, and QR-code rendering for paid purchases, none of which are justified by the stated image-generation capability. In a mismatched skill context, embedded commerce flows can manipulate users into unintended transactions or conceal monetization behavior behind a benign-looking tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code can retrieve or generate API tokens for the user's group account after SMS login, which directly creates long-lived credential material unrelated to simply generating images. In the context of a skill advertised for AI image generation, hidden token issuance is especially dangerous because it can enable persistent account access beyond the user's immediate session.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill appears to use environment access, file writes, and network operations but does not declare any explicit tool scope or permissions. This creates a transparency and least-privilege problem: the agent may invoke capabilities with broader authority than a user would reasonably expect from a simple image-generation skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad and overlap with ordinary requests such as '帮我画', '做张图', and 'generate image', increasing the chance the skill activates in contexts where the user did not intend external API calls or file creation. Overbroad triggers are especially risky here because the skill performs network access and local persistence automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents automatic download of generated images and silent storage of raw API responses, including task IDs, statuses, and temporary URLs, but does not present an explicit user warning or consent step. This can expose sensitive artifacts to local disk unexpectedly and increase data-retention risk, especially in shared or monitored environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The API reference instructs the agent to send image URLs and prompts to a remote gateway but does not provide any user-facing disclosure that their content will be processed by an external service. For an agent handling potentially sensitive prompts or private image URLs, this creates a privacy and data-handling risk because users may not understand their data leaves the local system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 118)May include surrounding context.

{"errcode": 401, "errmsg": "authorized error"}

text

## curl 示例

创建任务：
```bash

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation adds a separate feedback-submission API that is unrelated to the core image-generation function and sends data to a different public endpoint. In an agent skill context, this expands the skill's data-exfiltration surface and creates a path for user content to be transmitted off-service without a clear necessity tied to the requested task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Feedback API section allows free-text content to be sent to a separate public endpoint without warning that user-provided feedback may be transmitted externally. Free-form text often contains sensitive details, so this can leak user data, conversation context, or operational information beyond the image-generation service boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The onboarding flow explicitly instructs collecting a user's phone number and sending it to a local script for registration, but it does not require a clear privacy notice, consent language, data-retention limits, or explanation of where the number is transmitted. This creates a real privacy and compliance risk because users may disclose sensitive personal data without being told how it will be processed or protected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill automatically downloads remote generated media into local session storage without explicit user notice. In this context, generated images may embed sensitive prompts or user-supplied references, and silent persistence increases privacy exposure and local storage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill silently writes full raw API responses to local session storage regardless of success or failure. Those responses may contain prompts, member identifiers, task metadata, generated asset URLs, or other sensitive data, creating a privacy and retention risk if local storage is accessible to other users, processes, or later workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This code transmits user-supplied and credential-bearing data to external services, including phone numbers, SMS codes, access tokens, and refresh tokens during login-related flows. External transmission is expected for networked services, but here it becomes security-relevant because the destinations are partly environment-configurable and the skill scope does not clearly justify these sensitive exchanges.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The CLI help text specifies "11 位国内手机号", and the implementation hard-codes Chinese phone format and area code (+86), indicating the skill is restricted to a Chinese locale. There is no visible user opt-in, language/locale choice, or explicit justification in this file for enforcing that locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The text advises users to use English prompts for better output, which nudges a specific language choice without offering an explicit user preference or alternative. This can conflict with language/locale neutrality expectations unless the constraint is clearly justified and optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Natural-language strings in the module docstring and user-facing messages are presented in Chinese only, with no indication that the user can choose another language. This can violate language/locale policy when a skill forces a specific language without opt-in.

Content

No source excerpt is available for this finding.