Back to skill

Security audit

AIGC商品电商图生成专家

Security checks across malware telemetry and agentic risk

Overview

This product image skill is mostly coherent, but it needs Review because it can upload images, persist session data, handle credentials/payment onboarding, run broad local scripts, and contains biased human-depiction prompt rules.

Before installing, review whether you are comfortable with product images and prompts being sent to LinkFox services, local files being uploaded to public URLs, account/billing helpers being present in the package, and generated assets plus raw responses being stored locally. The biased human-depiction rules and dynamic script-path behavior should be fixed or disabled before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (80)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
91% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
89% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
94% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
90% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
90% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs use of shell execution, file reads/writes, network access, environment-dependent behavior, and cross-skill invocation, yet no explicit permissions are declared. This weakens sandboxing and review because the runtime capabilities are broader than what a caller or platform policy can easily verify, increasing the chance of unintended file access, data exfiltration, or command misuse.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The document says the skill does not involve local file upload, but Step 1 explicitly says non-HTTP paths must be uploaded via linkfox-file-upload to obtain a public URL. This contradiction can mislead operators and users about where local data goes, causing accidental transmission of sensitive local files under a false assumption that no upload occurs.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
This section expands an S1 content-reasoning step into persistent cross-skill state handling, including saving brand-gene output to disk and passing absolute file paths through later stages. That creates unnecessary data retention and trust-boundary coupling between skills, which can expose sensitive session artifacts, enable path misuse, and make downstream behavior depend on file references rather than validated structured data.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The document says S1 is internal reasoning only, yet mandates writing the full image plan to disk after confirmation. This broadens data exposure and retention beyond what is needed for immediate reasoning, increasing the chance of sensitive business content, prompts, or user-provided product details being persisted and later reused incorrectly or accessed by other components.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The documentation directs the skill to persist the full confirmed image plan to local disk and to create multiple intermediate task files. This expands the skill from conversational planning into filesystem state management, which increases data retention and creates opportunities for unintended disclosure, tampering, or reuse of user-provided content beyond the immediate interaction.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill instructions require shell and Python orchestration to initialize files and append user-influenced JSON fragments, even though the user-facing purpose is image-plan confirmation. Granting or normalizing command execution and file orchestration in this stage broadens the attack surface: path misuse, unsafe argument handling, and unintended execution behaviors become possible if surrounding controls are weak or if later edits reuse these patterns unsafely.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The embedded runtime prompt contains a direct contradiction: it says to 'Remove the main part of the product' while the surrounding specification repeatedly requires preserving the product’s shape, angle, and constituent parts. Because this markdown block is explicitly treated as a runtime data source and dynamically extracted into the final prompt, the contradictory instruction can cause destructive or incorrect image edits, violating product fidelity and potentially producing non-compliant marketplace images.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The code serializes the extracted brand-gene payload and sends it to a separate save script, then returns a filesystem path to the saved result. This creates persistent storage of derived data that is not apparent from the skill description, increasing privacy, transparency, and data-handling risk if users or platform operators expect image generation only.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The function sends image URLs to a text-generation process to infer a structured brand profile ('brand gene') from the images, which is broader than straightforward image editing or generation. That mismatch matters because it expands the skill's effective capability into profiling/analysis of user-supplied content without clear justification or disclosure in the stated product purpose.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The function accepts a user-controlled or job-controlled `textgen_script` path and only checks that it exists as a file before using it in downstream execution. This creates a path for arbitrary script substitution, allowing an attacker who can influence job input to redirect execution to an unintended local script, which is especially dangerous because this skill later orchestrates external components.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code dynamically prepends a skill-controlled scripts directory to sys.path and imports module_name at runtime, then later executes functions from those imported modules. In this pipeline, skill_root comes from state or caller-controlled configuration, so a crafted state can cause arbitrary Python code execution during import, which exceeds the declared image-generation purpose and breaks trust boundaries.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The subprocess target textgen_script is taken from state-derived spec data and only checked for file existence before execution, allowing the workflow to launch arbitrary Python files under the current interpreter. In an agent skill, this is especially dangerous because a task meant to generate product images gains general program-execution capability if an attacker can influence collection-state.json or upstream plan/state generation.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This template is explicitly for clothing image planning ('服饰套图内容规划师') while the skill metadata states the skill is for non-clothing product images. That scope mismatch can cause the agent to generate incorrect prompts, model/person styling instructions, and unsuitable content plans, leading to policy violations, broken business logic, or unintended handling of unsupported categories.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The utility resolves and prepares execution paths for sibling skills outside the declared image-generation scope, including text generation and brand-gene extraction. This expands the trust boundary and creates a cross-skill execution surface where a compromised or unexpected sibling repository/script could be invoked by this skill.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The module can fetch arbitrary HTTP/HTTPS URLs and persist the response locally, which broadens the skill from image planning into a general network retrieval primitive. In an agent environment, this can be abused for SSRF-like access to internal endpoints, downloading unexpected content, or storing attacker-controlled files for later processing.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The template explicitly restricts depiction of Black people when the inferred model ethnicity is Caucasian, which is an unjustified race-based exclusion unrelated to legitimate product-image generation. This creates discriminatory output behavior, can systematically exclude protected groups, and may expose the product or operator to policy, legal, and reputational harm.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The workflow mandates creating 'non-Asian' ethnicity descriptions for any concept containing people, which injects protected-attribute steering unrelated to the stated task of generating compliant product-scene prompts. This can cause systematic bias, exclusion, and fabricated identity traits in generated content.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The template is explicitly tailored to clothing and apparel-specific A+ imagery while the skill metadata says the skill is for non-apparel product image generation. This mismatch can cause the agent to generate irrelevant or inappropriate outputs, mis-handle user inputs, and introduce unsafe or biased behavior when product categories do not fit the embedded assumptions.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
Requiring a gendered/apparel framing in output formatting is inconsistent with a non-apparel product generation skill and can force irrelevant or misleading content into outputs. That increases the chance of harmful stereotypes, broken workflows, and incorrect image plans for products that do not involve people or clothing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.