ClawHub
Back to skill

Security audit

多模态图像生成

Security checks across malware telemetry and agentic risk

Overview

The skill can perform the advertised image generation, but it also includes sensitive account, payment, public upload, local caching, and automatic feedback-reporting behavior that needs review.

Review before installing. Use it only if you trust LinkFox with prompts, reference images, local images you choose to upload, phone/SMS authentication data, API keys, and billing actions. Require explicit confirmation before uploading local files publicly, creating payment orders, displaying or storing API keys, or sending feedback content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
96% confidence
Finding
The request sent via urlopen includes attacker-influenced environment-derived values in headers, most importantly the API gateway base URL from LINKFOX_TOOL_GATEWAY and metadata headers such as SESSION_ID, MODE_ID, and APP_NAME. If an attacker can influence the environment, they can redirect authenticated traffic to an arbitrary host and exfiltrate the API key and request contents, making this a real SSRF/credential-leak class issue.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
94% confidence
Finding
The POST target is ultimately derived from environment-controlled base URLs, and this helper transmits sensitive login material such as phone numbers, SMS codes, access tokens, and refresh tokens. If an attacker can influence environment variables, the skill can be redirected to an attacker-controlled endpoint, causing credential exfiltration and unauthorized account/API-key issuance.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
91% confidence
Finding
The gateway request URL is built from environment-controlled base URLs and is then used for authenticated API calls with the LinkFox API key in the Authorization header. An attacker who can alter the environment can redirect these requests and harvest the API key or manipulate billing and account operations.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documents capabilities to access environment variables, write files, and use the network, but does not declare permissions or narrowly constrain those actions. In an agent setting, undeclared capabilities reduce transparency and can enable unintended data exposure, filesystem writes in the user workspace, and outbound transmission of user data or local file contents.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The stated purpose is image generation/editing, but the skill also includes account login, SMS verification, subscription lookup, recharge/order creation, payment QR generation, payment-status polling, and local-image upload to public storage. This is a major scope expansion that can collect sensitive identifiers, trigger financial operations, and exfiltrate local content under the cover of a benign image tool.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill instructs the agent to automatically send feedback to an external Feedback API whenever various conditions apply, including subjective cases like praise, dissatisfaction, or anything improvable. Automatic external reporting outside the core task can leak user prompts, outputs, and behavioral metadata without informed consent.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The documentation introduces a separate feedback-submission endpoint that is unrelated to the core image-generation capability, creating an unexpected data flow to a different external service. In an agent context, this can enable silent exfiltration of user content, outputs, or interaction summaries if an implementation follows the docs without explicit user consent and clear separation of purposes.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This onboarding document introduces authentication recovery, account registration, and billing workflows inside a skill whose stated purpose is image generation/editing. That scope expansion is dangerous because it normalizes collecting credentials/contact data and initiating account/payment actions through an unrelated skill, increasing the chance of abuse, phishing-like behavior, or accidental execution of sensitive flows by operators.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The document authorizes operators to register accounts, log users in via SMS code, and purchase plans, none of which are justified by the image-editing skill's purpose. Embedding these capabilities in an unrelated skill creates a confused-deputy risk where a benign media tool can be used to trigger sensitive identity and financial operations.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The docstring explicitly promises writes only under the current working directory and forbids /tmp, but the actual implementation falls back to the user's home directory and then the system temp directory. This mismatch can cause sensitive API responses, including generated image metadata or returned URLs, to be persisted in less controlled locations than operators expect.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This skill is presented as an image-generation/editing tool, but the file implements account onboarding, SMS login, API-key retrieval, and purchasing flows instead. That mismatch is dangerous because it enables collection of user credentials and monetization actions under a misleading capability description, increasing the likelihood of deceptive data capture.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The billing features let the skill enumerate purchasable plans, create orders, and render payment QR codes despite the skill being described as an image tool. In this context, hidden payment functionality is especially risky because it can steer users into financial transactions unrelated to the advertised behavior.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The file performs SMS login, token handling, team discovery, and API-key generation, none of which are justified by the stated image-generation/editing purpose. In a mismatched skill, such credential-handling behavior strongly suggests covert account linking or secret acquisition beyond what the user would reasonably expect.

Vague Triggers

High
Confidence
84% confidence
Finding
The trigger conditions are extremely broad and designed to activate on nearly any request involving images, including vague editing or transformation requests. Overbroad triggering increases the chance that the skill runs in contexts the user did not intend, causing unnecessary data handling, uploads, API charges, or disclosure to external services.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The API description states that prompts and reference image URLs are sent to a remote endpoint but provides no privacy notice, sensitivity guidance, or handling constraints. Because prompts and image URLs may contain personal, confidential, or proprietary data, this omission can cause agents to transmit sensitive user material externally without informed consent or sanitization.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The feedback API encourages sending free-form content that may include user statements, intents, and outcome details to a separate external service, but it does not warn about the privacy implications. This is dangerous because implementers may forward conversation content or summaries containing personal or sensitive information without transparency, consent, or minimization.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The instructions tell operators to collect a user's phone number and pass it to a script for registration/login, but provide no privacy notice, retention policy, consent language, or handling constraints. This creates avoidable exposure of personal data and raises the risk of unauthorized collection, logging, or downstream misuse of phone numbers and verification flows.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The skill caches and persists full remote API responses to local disk, and those responses may contain sensitive prompts, generated asset URLs, usage data, or other user content. In an agent/workspace context, silent persistence increases the chance of unintended data exposure to other tools, users on the same system, backups, or later tasks.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The login command emits the newly obtained API key directly to stdout JSON, which can be captured by calling agents, logs, shell history tooling, or other orchestration layers. Exposing a reusable API credential this way materially increases the chance of secret leakage and downstream account abuse.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script uploads a local file and explicitly sets the uploaded object ACL to public-read, then returns a public URL, but it does not provide an explicit user-facing warning at execution time that the image will become publicly accessible. In an agent/skill context, this can cause unintended disclosure of sensitive local images because the consequence is easy to miss.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.