真人感照片生成专家

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches a photo-generation workflow, but it also includes broad public file upload, external skill installation guidance, environment-based credentialed network calls, and self-extension behavior that deserve user review before installation.

Install only if you trust LinkFox with uploaded product/reference images and generated outputs, understand that some files may become publicly accessible OSS URLs, and can control the LINKFOX_TOOL_GATEWAY and API-key environment. Disable or require explicit admin approval for external onboarding installation and skill creation/modification behavior, and avoid using the generic uploader for private local files.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

• Confidence: 83% confidence
• Finding: The code reads `LINKFOX_AGENT_API_KEY` from the environment and sends it in the `Authorization` header to a URL whose base is also environment-controlled via `LINKFOX_TOOL_GATEWAY`. If an attacker can influence that environment variable, the skill will exfiltrate the API token to an arbitrary endpoint, turning a normal backend call into credential leakage.

Tainted flow: 'req' from os.environ.get (line 51, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

"""尝试直接请求页面，从 HTML 中提取图片 URL"""
    try:
        req = Request(page_url, headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"})
        with urlopen(req, timeout=timeout) as response:
            html = response.read().decode("utf-8", errors="ignore")
            # 提取 i.pinimg.com 图片 URL
            pinimg_pattern = r'https://i\.pinimg\.com/[^\s"<>\'\\]+\.(?:jpg|jpeg|png|webp)'

• Confidence: 95% confidence
• Finding: The script fetches arbitrary URLs returned by the search backend without validating scheme, host, or destination. If the search service is compromised or manipulated, this becomes SSRF and can be used to probe internal services, access cloud metadata endpoints, or force outbound requests to attacker-chosen targets from the agent environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill orchestrates capabilities that imply network access, file handling, and likely environment-backed execution, yet it declares no permissions or user-visible capability boundaries. This creates a governance and security gap: operators and users cannot accurately assess what the skill can access, making unexpected data transfer or file exposure harder to detect and control.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented behavior and the repository's effective capabilities diverge significantly, including web search, file upload, text generation, and HTML/report-related functionality beyond the stated photo-generation purpose. Description-behavior mismatch is dangerous because reviewers and users may trust a narrower purpose while the skill can invoke broader actions and move data across services unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The workflow explicitly allows proceeding when Step 0 was not executed, even though earlier rules say the core chain cannot skip steps. Such internal contradictions weaken policy enforcement and can be exploited to bypass intended validation, provenance checks, or safety constraints tied to product-image analysis.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The skill first mandates GEM_3_1_PRO for inspiration-image analysis, then later permits GEM_3_FLASH for JSON prompt adjustment tied to the same analysis artifact. This inconsistency can undermine expected quality and control assumptions, and in security terms it signals that hard requirements are not reliably enforced.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Allowing the skill to create or modify other skills on the fly is unrelated to realistic photo generation and materially expands its authority. This is dangerous because a narrowly trusted media workflow can become a stepping stone to capability escalation, persistence, or introduction of new unsafe logic outside the user's original intent.

Description-Behavior Mismatch

High

• Confidence: 86% confidence
• Finding: `upload_file` can upload any local file path to Aliyun OSS once STS credentials are obtained, which materially exceeds a narrowly described image-generation helper and creates a generic exfiltration primitive. In an agent context, this is dangerous because other components could point it at sensitive local files, causing unauthorized transfer of workspace or host data to remote storage.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: `download_media` retrieves arbitrary remote HTTP(S) content and stores it locally, which is broader than a tightly scoped image-generation pipeline and can be abused as a network-fetch primitive. In agent environments this can enable SSRF-style access to internal services or untrusted large-file retrieval, especially because the function accepts arbitrary URLs and performs the request server-side.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill states that image/video generation is out of scope, yet earlier sections require automatic chaining into downstream image/video generation skills based on inferred intent. This inconsistency can cause agents or reviewers to underestimate the skill's actual authority and side effects, leading to unexpected invocation of more powerful downstream capabilities.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation presents generation workflows as 'not applicable' in one section while elsewhere mandating that the agent automatically use this skill as an upstream step for downstream generation. Such contradictory guidance weakens policy enforcement and can be used to disguise transitive behavior that expands the skill's effective scope beyond what users and maintainers expect.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file documents APIs for a different skill (`linkfox-aigc-textgen`) than the declared photo-generation skill, creating a capability/identity mismatch. In practice, this can cause an agent to invoke unintended external services, send the wrong user data to the wrong backend, or expose credentials and workflow assumptions across skill boundaries.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The header explicitly states the document is for `linkfox-aigc-textgen`, contradicting the surrounding skill identity. This kind of identity confusion increases the chance of misrouting requests, using the wrong prompts or data schema, and misleading downstream reviewers or agents about what external actions the skill performs.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The code implements asynchronous AI text generation and polling, while the manifest describes realistic product photo generation. This mismatch is dangerous because it can mislead users, reviewers, and policy controls about the skill’s actual capabilities and data flows, reducing the chance that text-generation behavior and its risks are properly reviewed.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script persists large generated responses to local files, but the manifest does not disclose local storage as part of the workflow. Undisclosed persistence increases data handling risk because generated content may contain sensitive prompts, outputs, or user data that remain on disk longer than expected and outside reviewed retention controls.

Description-Behavior Mismatch

Medium

• Confidence: 77% confidence
• Finding: This shared utility persistently stores session metadata, raw data, reports, and media under broadly reusable workspace/home/tmp paths, creating cross-skill data retention beyond the photo-generation skill's stated scope. In multi-skill or shared-host environments, unnecessary persistence increases exposure of user content and session linkage, especially when retention, isolation, and cleanup guarantees are not enforced.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The module can upload local files to Alibaba OSS using temporary credentials obtained from a backend, which is a data egress capability not reflected in the skill description. Because it accepts arbitrary local paths, misuse or insecure callers could exfiltrate sensitive local artifacts rather than only generated media.

Context-Inappropriate Capability

Medium

• Confidence: 74% confidence
• Finding: The code reads an API key from the environment and exchanges it with a backend to obtain OSS upload credentials, expanding trust and data movement beyond the stated photo-generation pipeline. While this may be operationally legitimate, it creates hidden privileged network behavior and potential abuse if the gateway endpoint or calling context is not tightly controlled.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: `download_media` can fetch arbitrary remote URLs and save them locally, which introduces an SSRF-style primitive and expands the skill's behavior beyond simple image generation. In agent environments, this can be abused to probe internal services, access cloud metadata endpoints, or pull attacker-controlled content into the workspace.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This skill introduces a generic public file-upload capability that is outside the stated scope of the parent agent skill, which is focused on realistic photo generation and prompt extraction. A mismatched, broadly capable uploader increases attack surface and can be abused to exfiltrate arbitrary local artifacts or publish internal outputs via public URLs, especially because the document explicitly encourages converting local files into externally accessible links.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill documents the ability to publish arbitrary local files to a publicly accessible OSS URL, which is dangerous because it can turn any readable local artifact into an external disclosure channel. In this context, the realistic-photo-generation agent does not inherently require arbitrary public file publishing, so the capability is overbroad and raises the risk of leaking sensitive images, reports, metadata, or other local files if invoked incorrectly or manipulated by downstream prompts.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script provides a generic capability to upload arbitrary local files to a remote public OSS location, which is materially broader than the declared skill purpose of realistic photo generation. In an agent setting, this kind of hidden or unjustified file-transfer primitive can be abused to exfiltrate sensitive local data from the runtime or user workspace under the guise of normal skill execution.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The main routine accepts arbitrary filesystem paths from command-line arguments, uploads them to OSS, and returns public URLs, effectively exposing a general-purpose file exfiltration mechanism. Because this is not tightly scoped to the skill's stated photo-generation workflow, the mismatch increases the likelihood that the capability could be misused by another component or prompt flow to leak unrelated local files.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill instructs the agent to download and install an additional skill package from an external URL when onboarding guidance is missing, which expands the trust boundary far beyond a simple web-search capability. This creates a supply-chain and unauthorized capability escalation risk: an agent following the instruction could fetch unreviewed code/content and change its behavior without explicit, scoped security review.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The skill declares a narrow scope for web search, but later instructs the agent to perform authentication, quota triage, onboarding, and installation-related workflows. That mismatch can cause the agent to take actions users did not request, increasing the chance of privilege misuse, confusing task routing, and unsafe operational behavior outside the skill's stated purpose.

Static analysis

No suspicious patterns detected.