Back to skill

Security audit

AI服装人台换模特图专家

Security checks across malware telemetry and agentic risk

Overview

This appears to be a working mannequin-to-model image skill, but it bundles broader generation, public upload, credential onboarding, and payment flows that need review before installation.

Review this before installing. Use it only if you trust LinkFox with API keys, uploaded images, prompts, generated outputs, phone-number onboarding, and possible payment flows. Avoid feeding private, regulated, or proprietary images unless public upload and remote processing are acceptable, and prefer self-service credential setup over having an agent handle phone numbers or API-token generation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (32)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
93% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
91% confidence
Finding
with urlopen(req, timeout=30) as resp:

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The template explicitly broadens processing beyond a mannequin garment transfer task by instructing the model to replicate a reference person’s identity attributes and a reference scene’s composition. This creates unnecessary identity and environment cloning capability, which can be misused for impersonation, privacy violations, or generating deceptive commercial imagery beyond the skill’s stated purpose.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The instruction to replicate a reference person's face, hair, skin tone, and body proportions exactly is a direct identity-copying directive. In an image generation pipeline, this materially increases the risk of non-consensual likeness reproduction, impersonation, and misuse of a real person’s biometric appearance without being necessary for mannequin-to-model conversion.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The published skill metadata describes a generic image-generation capability, while the declared skill purpose is a narrowly scoped mannequin-to-model transformation tool. This scope mismatch can cause the agent to invoke a broader-capability backend than users or orchestrators expect, enabling policy bypass and unintended content generation outside the approved use case.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The examples and guidance advertise broad product and creative image-generation scenarios unrelated to mannequin-to-model conversion. In practice, this teaches the agent and users to treat the skill as a general image generator, increasing the chance of unauthorized or unsafe task routing and bypassing specialization-based controls.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The instruction to immediately execute a generic script on receipt of arguments contradicts the claimed specialized identity and reduces contextual safeguards. This can cause the agent to bypass intent verification and invoke a broader image-generation pipeline automatically, which is especially risky because the document itself contains imperative execution text that should not be blindly trusted.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The script performs SMS login, API-key acquisition, plan discovery, ordering, and payment-state querying, which are materially broader than a mannequin-to-model image generation skill. In a skill ecosystem, this scope expansion is dangerous because it collects sensitive user identifiers and credentials and initiates account/billing actions unrelated to the declared transformation function.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Billing and order-creation logic lets the skill enumerate purchasable plans, create payment orders, and render QR codes for payment. Those capabilities can trigger financial transactions and expose purchase metadata, which is a significant trust and abuse concern for a skill whose stated purpose is image generation rather than commerce.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code retrieves or generates API tokens for the user's group and returns them to the caller. Credential provisioning inside an image-processing skill is risky because it expands the blast radius from one task to broader API access, and the returned token could be reused outside the intended workflow.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill documentation turns a text-generation skill into an automatic orchestrator that can invoke downstream image/video generation skills without explicit per-step user confirmation. This increases the skill’s effective privilege and data-flow scope: user prompts and model outputs may be forwarded into other remote services or tools, creating unintended actions, surprise capability escalation, and a larger prompt/data exfiltration surface.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The documentation is internally contradictory: it declares image/video generation 'not applicable' for this skill, while earlier sections instruct the agent to automatically chain into image/video generation workflows. Conflicting capability boundaries are dangerous because agents and integrators may rely on the wrong section, leading to accidental tool use, policy bypass, or unexpected remote processing of user data.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file documents the API for a different skill (`linkfox-aigc-textgen`) while the declared skill is mannequin-to-model image generation. This can cause the agent to invoke the wrong external capability, send user data to an unintended endpoint, or expose unrelated functionality, which is a serious integrity and data-handling issue in a security-sensitive skill system.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The documentation introduces a feedback submission endpoint unrelated to the stated image-generation purpose, expanding the skill's effective capabilities beyond user expectations. Unrelated outbound actions increase the risk of unintended data disclosure and can be abused to transmit user content to a separate service.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file is an asynchronous text-generation client that polls `aigc/textGenAsync`, emits text content, and archives responses locally, which does not match the declared mannequin-to-model image-generation skill. This mismatch is dangerous because it can cause operators or downstream agents to invoke a capability they did not intend, bypass review expectations, and silently expand data-handling and network behaviors under a misleading manifest.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file implements account onboarding, login, plan listing, ordering, and payment QR generation, which is unrelated to the declared mannequin-to-model image-generation purpose. Such capability drift is dangerous because it expands the skill's authority surface to user accounts and billing without clear necessity or user expectation.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The code creates and queries orders and renders payment QR codes, introducing billing operations unrelated to the stated image-generation task. In the current skill context, this makes the behavior more dangerous because users invoking an image tool would not reasonably expect payment initiation or account charges.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script performs SMS verification, login, token exchange, team discovery, and API-key generation, all of which are outside the declared image-generation scope. In this context, collecting phone numbers and provisioning keys materially increases the risk of credential abuse, surprise authentication flows, and unauthorized expansion of access.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs agents to upload any non-HTTP/HTTPS local file path to a public URL so downstream tools can access it, but it does not require explicit user confirmation or warn that this changes the file's exposure from local/private to publicly reachable. In a skill that processes user-supplied images, this can unintentionally disclose sensitive or proprietary images if the operator assumes local files remain private.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes very broad phrases such as generic requests to generate or draw an image, which can cause the wrong skill to activate for unrelated user intents. Over-broad activation is dangerous here because the skill appears to expose a powerful backend and automatic execution flow, increasing the chance of unintended tool use and policy-incorrect routing.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill states that generated images and raw API responses containing task metadata and temporary URLs are automatically written to local storage, but it does not clearly present this as a privacy and retention risk. Users and downstream systems may unknowingly persist sensitive images, prompts, identifiers, or signed URLs longer than necessary, expanding the exposure surface.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The API documentation instructs the skill to send user-provided image URLs and prompts to an external image-generation service, but it does not disclose this data flow or require any privacy notice, consent, or handling constraints. Because the inputs may contain sensitive product assets, personally identifying imagery, or private business content, this omission can lead to unintended third-party data disclosure and compliance/privacy issues.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The instructions explicitly tell the operator to collect a user's phone number and use it with a local script to register or log in, but they do not warn that this is personal data, explain where it will be transmitted, or require consent and secure handling. In a support/onboarding workflow, this omission can lead to unnecessary collection and transmission of sensitive personal information and privacy noncompliance.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script persistently stores full API responses and downloaded generated images under a session directory without any minimization, retention control, or user-visible disclosure in code. Those files may contain sensitive prompts, member identifiers, task metadata, or proprietary/generated media, increasing the impact of local compromise, cross-session data exposure, or accidental retention.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list contains broad everyday phrases such as '帮我写一段' and generic analysis terms that can match many unrelated user requests. Overbroad activation can cause unintended invocation of this skill, sending prompts or media to external model services when the user did not intend to use this specific tool.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.