ClawHub
Back to skill

Security audit

电商图片裂变专家

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent image-generation purpose, but it also uploads local images publicly, handles credentials and billing flows, and contains under-scoped network and credential behavior that users should review carefully.

Install only if you are comfortable sending product images, prompts, and account credentials to LinkFox services, making local image files publicly accessible when uploaded, and using billing/onboarding flows from inside the skill. Use non-sensitive test assets first, avoid endpoint override environment variables unless you control them, and rotate any API key that appears in logs, chat transcripts, shell history, or startup files.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aigc-imagegen/scripts/aigc_imagegen.py:38
Finding

Environment-Controlled API Endpoints Can Receive Production Credentials and Sensitive User Data

Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.c ...[truncated 3228 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aigc-imagegen/scripts/aigc_imagegen.py:170
Finding

Untrusted Result URLs Permit Server-Side Request Forgery and Unbounded File Downloads

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
skills/linkfox-file-upload/scripts/file_upload.py:24
Finding

Upload Skill Loads an Unaudited External Module and Relies on Unpinned Runtime Dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skills/linkfox-aigc-imagegen/scripts/onboarding.py:478
Finding

Onboarding Exposes Complete API Keys Through Standard Output and Plaintext Shell Configuration

Content
View full analysis
dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: invalid phone format: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: invalid verification-code format: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']}", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token( lg["access_token"], lg["user_id"], info["group_id"], ) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The entire object is printed to standard output: ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get ...[truncated 2272 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (45)

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/scripts/aigc_imagegen.py (reported line 202)May include surrounding context.

python
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/scripts/aigc_imagegen.py (reported line 298)May include surrounding context.

python
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=30) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The script builds request destinations from environment variables and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those URLs. If an attacker can influence the environment, they can redirect authentication traffic to an attacker-controlled server and capture credentials, making this effectively an exfiltration primitive.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The gateway URL is also sourced from environment variables and used with an Authorization header containing the API key. An attacker who controls environment configuration can redirect these requests to a malicious endpoint and harvest the API key or manipulate order and account operations.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill performs file uploads to cloud storage and produces public URLs, but this data-handling behavior is not clearly surfaced in the core declaration. Undisclosed publication of user-supplied images materially increases confidentiality and privacy risk, especially when inputs may contain proprietary product assets or sensitive embedded metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill performs file uploads to cloud storage and produces public URLs, but this data-handling behavior is not clearly surfaced in the core declaration. Undisclosed publication of user-supplied images materially increases confidentiality and privacy risk, especially when inputs may contain proprietary product assets or sensitive embedded metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill performs file uploads to cloud storage and produces public URLs, but this data-handling behavior is not clearly surfaced in the core declaration. Undisclosed publication of user-supplied images materially increases confidentiality and privacy risk, especially when inputs may contain proprietary product assets or sensitive embedded metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The workflow converts local images into publicly accessible URLs but does not present a clear user-facing warning at the point of use. This is dangerous because users may upload proprietary, copyrighted, or sensitive commercial assets expecting private processing, while the skill silently republishes them to public storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction to immediately execute the Python script without waiting for confirmation removes an important safety boundary before making network requests and writing files. In this skill's context, that is especially dangerous because execution can incur cost, process user-supplied image URLs, store results locally, and facilitate policy-sensitive use cases such as large-scale image variation for anti-association across storefronts.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/references/onboarding.md (reported line 14)May include surrounding context.

md
证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill is described as image-fission for e-commerce images, but the file implements account onboarding, SMS login, API key generation, plan listing, ordering, and payment flows. That scope mismatch increases risk because it collects credentials and enables billing actions unrelated to the user-visible purpose, which can surprise users and enlarge the attack surface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code can create orders, determine pricing, and generate payment QR codes despite the skill being presented as an image manipulation tool. Even if intended for account setup, embedding purchase flows in the skill raises the chance of unauthorized or unexpected billing operations and makes the overall package more dangerous than its stated function suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

This login flow transmits phone number and SMS code, receives access and refresh tokens, and returns an API key, but the file itself provides no strong in-band warning or consent checkpoint for handling these sensitive credentials. Because the skill's advertised purpose is unrelated to authentication or billing, this mismatch makes credential harvesting or inadvertent over-collection more concerning.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill file documents a public file uploader to Alibaba OSS, while the surrounding skill metadata describes an unrelated image-fission capability. This mismatch is dangerous because it can cause the agent or reviewers to invoke a data-publication skill under false expectations, increasing the chance of unintended exfiltration or public exposure of local files.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares no explicit tool scope despite requiring network, file-write, and environment-backed capabilities. That weakens least-privilege controls and makes it easier for a compromised or misrouted invocation to access broader capabilities than users would reasonably expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill description and prescribed user-facing text are written only in Chinese, including a fixed Chinese notification message for parameter conflicts. There is no indication that the user can choose language or that the skill is intentionally limited to Chinese-speaking contexts.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly markets itself as a way to evade platform duplicate-detection and store-linkage controls. Even if not a classic software exploit, this is abuse-enabling functionality that helps users circumvent third-party trust and enforcement systems, increasing fraud, policy evasion, and account-risk exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger condition allows activation from generic user-intent matching, which can cause the skill to run in contexts the user did not clearly intend. Over-broad activation increases the chance of accidental uploads, unintended image processing, or invocation of downstream networked tools without sufficiently specific consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This is a markdown file, so SQP-2 applies to documented behaviors that may affect user data or system integrity. Lines L39-L45 state that outputs are organized and written to disk ('落盘') and expose saved file paths, but the document does not warn users that files will be created or persisted locally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad phrases such as general requests to draw or generate images, which can cause the skill to activate in situations where the user did not specifically intend to invoke this particular tool. Because this skill performs external API calls and can write files automatically, unintended invocation increases the chance of unwanted network actions, storage of user-provided content, and accidental spending or policy-evading use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly states that generated images are downloaded locally and that full API responses, including task IDs, status, and temporary URLs, are silently persisted to disk. Storing these artifacts without clear user notice or consent creates data exposure risk, especially if images contain sensitive commercial assets or URLs that grant temporary access to generated content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
76% confidence
Finding

This file documents routine transmission of user-supplied image URLs, prompts, and API credentials to external endpoints, which is an external data flow that can expose sensitive business or user content if invoked without disclosure or data minimization. In this skill's context, the purpose is remote image generation, so outbound transfer is expected, but it still creates privacy and confidentiality risk because product images and prompts may be proprietary.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/references/api.md (reported line 118)May include surrounding context.

{"errcode": 401, "errmsg": "authorized error"}

text

## curl 示例

创建任务：
```bash

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Feedback API instructs callers to send arbitrary free-form content to an external service but does not warn that this text leaves the local environment. In an agent setting, that omission can cause user prompts, internal context, or sensitive data to be forwarded off-platform without informed consent or redaction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest says this skill is for generating visually different e-commerce product images while keeping the product unchanged. This file documents built-in flows for authentication troubleshooting, phone-based registration/login, plan listing, order creation, and payment status queries, which are business-account onboarding and billing operations rather than image generation behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documented flow asks the user to provide a phone number and then uses a script to send a verification code and log in. Collecting contact data and performing account registration/login is not an obvious requirement of transforming product images, and it introduces identity/account management capability outside the stated purpose.

Content

No source excerpt is available for this finding.