AIGC服饰电商图生成专家

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:52 PM UTC
• Version: 1.0.0

Overview

This clothing image-generation skill mostly matches its purpose, but it needs Review because it mixes in under-scoped script execution, contradictory upload behavior, credential/payment onboarding, and biased model-generation rules.

Install only if you trust LinkFox with apparel images, prompts, API credentials, and any account or billing actions. Before use, review the upload contradiction, avoid providing arbitrary script paths in job/state files, keep LINKFOX_* endpoint variables pointed only at trusted LinkFox hosts, and require explicit user consent before phone-login, API-key, payment, upload, or child-model generation flows.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (75)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_textgen(textgen_script: str, params: dict, task_id: str) -> str:
    """调官方 aigc_textgen.py --stdin --content-only，返回单行 content（换行为 ⏎ 占位符）。"""
    proc = subprocess.run(
        [sys.executable, textgen_script, "--stdin", "--content-only"],
        input=json.dumps(params, ensure_ascii=False),
        text=True,

• Confidence: 94% confidence
• Finding: proc = subprocess.run( [sys.executable, textgen_script, "--stdin", "--content-only"], input=json.dumps(params, ensure_ascii=False), text=True, capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_imagegen(imagegen_script: str, params: dict, task_id: str) -> list[str]:
    """调官方 aigc_imagegen.py '<json>'，解析 'Saved full response:' 判定成败。"""
    proc = subprocess.run(
        [sys.executable, imagegen_script, json.dumps(params, ensure_ascii=False)],
        text=True,
        capture_output=True,

• Confidence: 95% confidence
• Finding: proc = subprocess.run( [sys.executable, imagegen_script, json.dumps(params, ensure_ascii=False)], text=True, capture_output=True, timeout=IMAGEGEN_TIMEOUT, )

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill claims in its execution constraints that it does not involve local file upload operations, yet step 1 explicitly instructs the agent to upload local file paths through `linkfox-file-upload` to obtain public URLs. This contradiction can mislead reviewers and operators about data egress, causing unintended upload of local content and weaker user consent and policy controls around file exfiltration.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The document instructs the agent to write finalized planning data to local disk and invoke shell/Python helpers even though this skill is presented as a user-facing clothing image planning/generation workflow. This expands the skill's operational scope into filesystem persistence and command execution, creating unnecessary attack surface and increasing the chance of unsafe tool use or unintended data retention.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The instructions explicitly direct execution of Bash and Python helper commands that are not necessary for merely presenting or confirming an image plan. In an agent setting, unnecessary command execution is dangerous because it can be repurposed for broader system interaction, create command-injection opportunities in adjacent components, and normalize privileged behaviors unrelated to the stated task.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The plan phase accepts user/job-controlled paths for helper scripts such as textgen_script, imagegen_script, run_one_task_script, and brand_gene_save_script, validates only existence for textgen_script, and then persists these paths into state for later execution. In an agent system, this creates a script/path injection surface that can redirect execution to arbitrary local programs or attacker-chosen sibling components, which is unrelated to the clothing-image-generation business logic and can lead to arbitrary code execution in downstream phases.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: `_load_skill_module` prepends `skill_root/scripts` to `sys.path` and dynamically imports `build_textgen_params` and `build_imagegen_prompt` from that location. If `skill_root` is attacker-controlled through state or caller input, import-time code in those modules will execute immediately, enabling arbitrary code execution and possible module shadowing of trusted imports.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This file executes externally supplied `textgen_script` and `imagegen_script` paths taken from task/state data. In a skill execution environment, that creates a straightforward arbitrary code execution primitive if an attacker can influence configuration files or pipeline state, and the executed code inherits access to local files, network, and any credentials available to the agent.

Description-Behavior Mismatch

Low

• Confidence: 78% confidence
• Finding: The template instructs the model to infer whether products are for children or adults, generate personas such as '阳光儿童', and synthesize models/scenes not explicitly requested in the manifest. In an image-generation skill handling apparel and model imagery, this increases risk of producing sensitive age-related depictions and unbounded outputs that the user did not opt into, especially when combined with automatic model generation and scene inference.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The template contains an explicit default prohibition on Black models unless specially requested, which is discriminatory and unrelated to any legitimate clothing-image-generation safety requirement. In a consumer marketing/image generation skill, this can systemically produce biased outputs, exclude protected groups, and create legal, policy, and reputational exposure.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The template explicitly instructs generation of child models for kids apparel, which expands the skill from apparel image generation into synthetic child-person image generation. That materially changes the safety profile by introducing a minors-related content path that may require separate policy controls, disclosure, gating, and review that are not reflected in the skill metadata.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This onboarding document embeds authentication recovery, phone-based registration, and billing/payment flows inside a skill whose stated purpose is clothing image generation. That scope expansion creates an unnecessary trust boundary crossing: an image-generation skill should not be directing credential provisioning and payment handling unless this is explicitly part of the product design and reviewed as such. In skill ecosystems, unrelated onboarding logic can be abused for phishing, unauthorized account creation, or steering users into sensitive actions outside the expected task flow.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The document instructs operators to collect a user's phone number and run a script to send verification codes and log in on the user's behalf. For an image-generation skill, this is unrelated sensitive-data handling and account access workflow that could enable impersonation, unauthorized account creation, or account takeover if misused. The mismatch between declared capability and actual instructions makes the behavior more suspicious, not less.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The documented ability to list plans, create orders, and guide payment-method selection introduces commerce and payment orchestration into a clothing image-generation skill. Even without directly processing card data, steering users through purchase flows from an unrelated skill increases phishing and fraud risk and may cause unauthorized charges or social engineering around payment. This scope mismatch makes the capability dangerous in context.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This onboarding script performs phone-based login, API key acquisition, plan discovery, order creation, payment QR generation, and order-status querying, which is materially unrelated to the declared clothing image-generation skill purpose. The mismatch increases risk because users or reviewers may grant trust to an image tool while the bundled code actually handles account access and payment operations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can fetch or generate a persistent API token for the user's account and then return it to the caller. For a clothing image-generation skill, issuing durable credentials is unnecessary and expands the blast radius from a single action to broad account/API compromise if the token is exposed, logged, or misused.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Billing features such as package listing, order creation, and payment QR rendering are outside the stated image-generation scope and create unnecessary financial-risk surface. In this context, unrelated purchase flows increase the chance of deceptive UX, accidental charges, and credential/payment abuse under the guise of a benign media tool.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file documents a separate external Feedback API that is unrelated to the core clothing image-generation workflow. This expands the skill's effective capabilities to include outbound reporting of user-related content to a third-party endpoint, creating an unjustified data-flow surface that could be abused to exfiltrate prompts, user comments, or operational metadata.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documentation exposes an external reporting endpoint not justified by the stated image-generation function, meaning an agent implementing this reference could send data off-platform for reasons unrelated to fulfilling the user's request. In a skill that processes user images and prompts, any undocumented extra egress path materially increases privacy and trust risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.