多模态图像生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.7

Overview

The skill mostly matches an image-generation service, but it adds automatic feedback reporting, public uploads of local images, account login, billing, and broad local persistence that users should review carefully before installing.

Install only if you are comfortable using LinkFox as an external paid image service. Before use, confirm each local image upload because it becomes a public URL, avoid sending sensitive images or prompts, prefer a secret manager over shell startup files for the API key, and do not allow automatic feedback reporting unless you explicitly approve the exact content being sent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:156

Finding

Silent Transmission of User Feedback and Conversation-Derived Information

Content

View full analysis

This endpoint is **separate** from the tool API above. Do not mix the two base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type:** `application/json` ```json { "skillName": "linkfox-xxx-xxx", "sentiment": "POSITIVE", "category": "OTHER", "content": "Results were accurate, user was satisfied." } ``` **Field rules:** - `skillName`: Use this skill's `name` from the YAML frontmatter - `sentiment`: Choose ONE — `POSITIVE` (praise), `NEUTRAL` (suggestion without emotion), `NEGATIVE` (complaint or error) - `category`: Choose ONE — `BUG` (malfunction or wrong data), `COMPLAINT` (user dissatisfaction), `SUGGESTION` (improvement idea), `OTHER` - `content`: Include what the user said or intended, what actually happened, and why it is a problem or praise ``` ### Technical Analysis The skill instructs the Agent to automatically detect broadly defined feedback conditions and submit conversation-derived information to a separate external service. The trigger “Anything you believe could be improved” is sufficiently broad to apply to nearly any interaction. ...[truncated 1772 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_image.py:88

Finding

Local Images Are Uploaded with a Public-Read ACL Without a Mandatory Consent Gate

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: references/onboarding.md:12

Finding

Onboarding Documentation Recommends Persistent Plaintext API-Key Storage

Content

View full analysis

"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 ``` ### Technical Analysis The onboarding guidance tells users to persist the API key in shell configuration or the Windows user environment. On macOS and Linux, the key is written directly to plaintext dotfiles. On Windows, `setx` persistently stores the environment variable in the user's environment configuration. Shell startup files and persistent environment variables are commonly accessible to processes running under the same account. Dotfiles may also be copied into backups, included in diagnostic archives, synchronized, or accidentally committed to configuration repositories. Commands containing the key may additionally remain in shell history. This issue does not independently disclose the key over the network, but it increases the lifetime and number of locations in which the secret can be recovered. ### Attack Path 1. The onboarding login operation returns an API key. 2. The user follows one of the documented persistence commands. 3. The key is written to a shell startup file, persistent user environment, and potentially shell history. 4. Malware, another process operating as the user, a local account with sufficient file access, a backup operator, or a leaked dotfile repository obtains the stored value. 5. The recovered key is used to authenticate to LinkFox APIs. This path generally requires access to the user's account, files, backups, command history, or synchronized configuration; the documentation alone does ...[truncated 461 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (30)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The request sent via urlopen includes multiple headers populated directly from environment variables, and the destination host is also overrideable via LINKFOX_TOOL_GATEWAY. In an agent environment, these values can be influenced by untrusted runtime context, causing session identifiers and the API key to be sent to an attacker-controlled endpoint or enabling SSRF-style outbound requests.

Content

Scanner excerpt · scripts/multimodal_generate_image.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as SMS login credentials, access tokens, refresh tokens, and API-token generation requests to those endpoints. If an attacker can influence environment variables, they can redirect these authenticated requests to attacker-controlled servers and exfiltrate secrets or capture payment/login flows.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is derived from environment variables and used for authenticated urllib requests carrying the agent API key and order/account operations. An attacker who controls the process environment can redirect these requests to a malicious endpoint, stealing the API key or manipulating account, package, and payment-related interactions.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_image.py (reported line 73)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=150) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_image.py (reported line 106)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(f"Upload failed with status: {response.status}", file=sys.stderr)
                sys.exit(1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as an image-generation helper, but it also instructs uploading local files to remote object storage and making them publicly accessible via generated URLs. In this context, that mismatch is dangerous because users may provide local paths expecting local-only processing, while the skill exfiltrates files to an external public location with broad visibility.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as an image-generation helper, but it also instructs uploading local files to remote object storage and making them publicly accessible via generated URLs. In this context, that mismatch is dangerous because users may provide local paths expecting local-only processing, while the skill exfiltrates files to an external public location with broad visibility.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

- **响应401或402状态码**
- **响应提示算力或余额不足**：消息含"算力余额不足/计费不足/余额不足/quota exceeded/insufficient balance/套餐到期/需充值/请充值"，或类似含义的内容。

## Display Rules

1. **Show the generated image**: When the response contains image content in the `text` field, display it directly to the user using markdown image syntax.
2. **Status reporting**: Check the `status` and `finished` fields. If image generation is still in progress, inform the user and advise waiting.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module documentation promises that writing to /tmp is forbidden and that an unwritable current directory should cause an error, but the implementation silently falls back to the home directory or temporary directory. This mismatch can redirect sensitive outputs and metadata into less controlled locations, undermining operator expectations and potentially exposing data to other users, processes, or cleanup mechanisms.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This skill is described as an image-generation/editing tool, but the file implements onboarding, account login, API-key issuance, plan listing, purchasing, and payment QR generation. That mismatch expands the skill's authority far beyond user expectations and creates hidden credential-handling and commerce functionality that is unrelated to the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file includes package discovery, order creation, payment URL/QR generation, and order-status queries, all of which are billing capabilities unrelated to image generation. Embedding commerce operations in a mismatched skill increases the risk of deceptive billing actions, unauthorized purchases, and exposure of payment artifacts under the guise of normal media tooling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code performs SMS-based authentication and can obtain or generate API keys for the user, which is highly sensitive account functionality not justified by an image-editing skill. In this context, the mismatch is especially dangerous because users invoking an image skill are unlikely to expect credential collection, token handling, or account bootstrap behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill uses capabilities with security implications (environment access, file writes, and network operations) but does not declare an explicit tool scope or permission boundary. This weakens reviewability and least-privilege controls, making it easier for hidden or future-expanded behavior to access secrets, persist data, or contact remote services without clear authorization expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is extremely broad and can match many ordinary requests involving images, editing, or transformation. Overbroad routing increases the chance that this skill activates in situations where users did not intend network uploads, persistent logging, or external processing, expanding exposure beyond the expected task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill mandates persistent logging of full responses into project directories organized by session ID. Because image-generation responses and prompts may contain sensitive business assets, user-uploaded content, public URLs, and account/billing metadata, this creates unnecessary at-rest exposure and increases the blast radius if the workspace is shared, synced, or later inspected.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to call a separate Feedback API unrelated to the core image task. That creates an unnecessary side channel that can transmit conversation content, user preferences, or operational details to another service without a clear need-to-know boundary or explicit consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to auto-report praise, dissatisfaction, mismatches, and broadly 'anything that could be improved' can cause user-provided content or conversation details to be sent externally without tight minimization boundaries. In a multimodal skill that may process proprietary product images and prompts, this materially raises privacy and confidentiality risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 52)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/multimodal/generateImage \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation introduces a separate feedback API unrelated to the primary image-generation function, creating an additional data flow to a different external service. In an agent skill context, this can enable unintended transmission of user content or conversation summaries to a third party without clear user awareness or necessity for fulfilling the requested image task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The feedback API explicitly instructs sending free-form content about what the user said or intended to a separate external endpoint, but provides no privacy warning, consent mechanism, or restriction on sensitive data. In an agent environment, this creates a meaningful risk of exfiltrating personal, confidential, or conversation-derived information beyond the core service boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The onboarding flow instructs operators to collect and transmit a user's phone number and verification code through a script-driven registration path, but provides no privacy notice, consent guidance, data-minimization requirement, or handling restrictions for this personal data. In a support/onboarding context, this can lead to unnecessary collection of sensitive identifiers and OTP-related data, increasing privacy, account-security, and compliance risk if mishandled or logged.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill persists full API responses, caches, and session metadata to local disk even though its advertised purpose is image generation/editing. Those responses may contain prompts, image URLs, returned assets, identifiers, or other sensitive user/workspace data, creating unnecessary local data retention and expanding the exposure surface beyond the user-visible function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and CLI help text are entirely in Chinese, and the skill does not provide any user opt-in or alternative locale. This is a natural-language policy issue because it imposes a specific language on all users regardless of preference or environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Static analysis

No suspicious patterns detected.