TencentCloud Aiart TextToImage

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:15 PM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it uses Tencent Cloud credentials to generate images from prompts, with some disclosed operational risks.

Install only if you are comfortable sending prompts and reference image URLs to Tencent Cloud and using your Tencent Cloud quota or billing. Use a least-privilege Tencent Cloud key, avoid submitting secrets or private internal URLs, and consider preinstalling a pinned Tencent Cloud SDK instead of relying on the automatic runtime install.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import tencentcloud  # noqa: F401
    except ImportError:
        print("[INFO] tencentcloud-sdk-python not found. Installing...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

• Confidence: 96% confidence
• Finding: subprocess.check_call( [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python", "-q"], stdout=sys.stderr, stderr=sys.stderr, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import tencentcloud  # noqa: F401
    except ImportError:
        print("[INFO] tencentcloud-sdk-python not found. Installing...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

• Confidence: 94% confidence
• Finding: subprocess.check_call( [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python", "-q"], stdout=sys.stderr, stderr=sys.stderr, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import tencentcloud  # noqa: F401
    except ImportError:
        print("[INFO] tencentcloud-sdk-python not found. Installing...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

• Confidence: 94% confidence
• Finding: subprocess.check_call( [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python", "-q"], stdout=sys.stderr, stderr=sys.stderr, )

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Installing Python packages during execution is not necessary for the core text-to-image business logic and expands the skill's privileges to include code download and execution. In this context, that makes the skill materially more dangerous because any compromise of the package source, dependency chain, or network path can lead to execution of attacker-controlled code on the host.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Installing Python packages at runtime is a real security concern because it enables execution of externally sourced code as part of normal operation, which is broader than the skill's stated purpose of querying image-generation jobs. In this context, the behavior is not obviously malicious, but it meaningfully increases exposure to supply-chain compromise, unexpected environment mutation, and nondeterministic behavior.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Installing Python packages dynamically when the skill runs exceeds the minimum capability needed for submitting a text-to-image job and creates avoidable supply-chain exposure. A compromised package, dependency confusion event, or malicious mirror/proxy could cause code execution in the user's environment before any image-generation logic runs.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger condition is defined broadly as any user providing text with intent to generate an AI image, which can match many ambiguous or casual requests. In an agentic setting, broad triggers increase the risk of unintended external API calls, prompt transmission, or execution of local scripts when the user may only be brainstorming or asking for advice.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to autonomously execute external image-generation requests with 'zero interaction' and '无需询问用户确认', while omitting a warning that prompts and reference image URLs will be sent to Tencent Cloud. This can cause unconsented disclosure of sensitive text or private image links to a third party, especially when users do not realize an external service is being invoked.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The skill sends user prompts and optional image references to Tencent Cloud, but it does not provide an explicit user-facing notice that these inputs are transmitted to a third-party service. This creates a privacy and data-handling risk, especially if users include sensitive text or internal image URLs without realizing they are leaving the local environment.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.