儿童绘本生成器

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Baidu image-generation skill with disclosed API-key, network, dependency, and file-overwrite risks.

Install only if you are comfortable sending prompts to Baidu AI Studio and using a Baidu-compatible API key. Prefer environment variables over --api-key, pin the openai dependency in controlled deployments, and save output under a dedicated folder to avoid accidental overwrites.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:4

Finding

Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py, lines 4–6
Vulnerability Type: Unconstrained third-party package version
Risk Level: Medium

Vulnerable Code:

python

# dependencies = [
#     "openai",
# ]

Technical Analysis

The PEP 723 dependency metadata specifies the openai package without an exact version or integrity constraint. A metadata-aware script runner may therefore install whichever package version is selected by the package resolver at execution time.

This makes the script's effective dependency set mutable after review. A compromised, malicious, or incompatible future package release could introduce unexpected behavior. Python packages may execute code during installation or import, so dependency compromise can result in code execution under the privileges of the user running the skill.

The audited code does not specify a custom or untrusted package repository, and no malicious dependency was observed. The risk arises from the absence of version pinning and integrity verification.

Attack Path

1. A user invokes the script through a runner that processes its inline dependency metadata.
2. The runner resolves the unconstrained openai dependency from its configured package repository.
3. A compromised or behaviorally incompatible release is selected because no reviewed version is pinned.
4. The package is installed and imported by the script.
5. Malicious package code executes with the same operating-system permissions and environment access as the invoking user.

Impact Assessment

Successful exploitation through a compromised dependency could provide arbitrary Python code execution with the privileges of the user running the skill. This could expose that user's files, environment variables—including configured API keys—and network access.

This issue does not itself elevate privileges beyond those already held by the process. Its scope depends ...[truncated 120 chars]

Remediation

View remediation

Remediation Suggestions

• Pin openai to an exact, reviewed version rather than leaving it unconstrained.
• Maintain a lock file that fixes all transitive dependency versions.
• Use package hashes where supported to verify dependency integrity.
• Install packages only from a trusted, explicitly configured package index.
• Run dependency vulnerability and provenance checks as part of release review.
• Test and deliberately approve dependency upgrades before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:72

Finding

Caller-Controlled Output Path Allows Arbitrary File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_image.py, lines 72–73 and 92–93
Vulnerability Type: Unrestricted file write and overwrite
Risk Level: Medium

Vulnerable Code:

python

# Set up output path
output_path = Path(args.filename)
output_path.parent.mkdir(parents=True, exist_ok=True)

python

with open(output_path, "wb") as f:
    f.write(image_bytes)

Technical Analysis

The --filename argument is converted directly into a filesystem path. The implementation accepts absolute paths and paths containing parent-directory traversal components. It then creates missing parent directories and opens the destination in wb mode.

Opening an existing file in wb mode truncates and replaces its contents without confirmation. The implementation also does not confine output to a designated directory, reject symbolic links, verify the resolved destination, or use exclusive file creation.

As a result, a caller who can control --filename can overwrite any file writable by the executing process. A symbolic link at the selected destination may also redirect the write to another writable file. Exploitation requires control over the script arguments or over a component that constructs those arguments.

Attack Path

1. An attacker obtains influence over the --filename argument passed to the script.
2. The attacker supplies an absolute path, a traversal path such as ../../target, or a path referring to a symbolic link.
3. The script resolves the supplied value without applying an output-directory boundary.
4. Parent directories are created when permitted.
5. After a successful image-generation response, the script opens the destination in wb mode.
6. The targeted writable file is truncated and replaced with decoded image bytes.

Impact Assessment

Exploitation can destroy or corrupt any file writable by the account running the skill. Depending on that account's ...[truncated 458 chars]

Remediation

View remediation

Remediation Suggestions

• Store generated files beneath a dedicated, trusted output directory.
• Resolve both the output root and requested destination with Path.resolve(), then verify that the destination remains inside the approved root.
• Reject absolute paths, .. traversal components, and invalid filename forms.
• Reject symbolic-link destinations and inspect existing path components for symlinks where appropriate.
• Use exclusive creation mode, such as open(path, "xb"), by default to prevent silent replacement.
• Require an explicit, separately authorized overwrite option when replacement is intended.
• Run the skill as a minimally privileged user with write access limited to its output directory.
• Consider writing to a securely created temporary file inside the output directory and atomically renaming it after successful decoding and validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The skill explicitly supports passing secrets via a command-line argument and reading them from environment variables. While common, this creates real credential-exposure risk because CLI arguments may be visible to other local users via process listings, shell history, logs, or orchestration metadata; the risk is somewhat reduced because the doc also warns against CLI use, but the insecure path still exists.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

python

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    for key in ["ERNIE-Image_API_KEY", "ERNIE_Image_API_KEY", "BAIDU_API_KEY"]:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 22)May include surrounding context.

python

from openai import OpenAI

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    # Try multiple env var names for compatibility

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file presents all user-facing instructions in Chinese from the title onward, and nowhere indicates that the skill is intentionally region-specific or that another language option is available. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file consistently describes and exemplifies a text-to-image workflow: it accepts a text prompt, calls /images/generations, and saves the returned image data. The version history entry at L328 states the initial version supports both "文生图" and "图生图", which contradicts the rest of the documented code path and capability matrix that marks only text-to-image as supported.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script's module docstring and runtime behavior indicate it generates images through Baidu's ERNIE-Image API, and the client is initialized against Baidu's base URL. However, the --api-key help text says 'Gemini API key', which actively contradicts the implemented service and could mislead users about what credential is being supplied.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs a network call to Baidu's ERNIE-Image service using the user-supplied prompt, which may transmit user content off-system. While the script prints progress and its purpose implies image generation, there is no explicit disclosure in the code comments or usage text that prompt data is sent to a third-party remote service.

Content

No source excerpt is available for this finding.