Guishu GPT Image 2

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 8:23 AM UTC
• Version: 1.1.0

Overview

This skill provides clearly disclosed image generation and editing through Guishu, with task-specific file access and controls against accidental repeat charges.

Install if you intend to use Guishu's third-party service and accept its charges and handling of uploaded prompts and images. Use a dedicated Guishu key through an environment variable, check batch counts before submission, and keep recovery files private. All bundled files were inspected and the scanner's missing-reference gaps were resolved; live service behavior, billing, and provider data-retention practices were not verified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tainted flow: 'request' from os.environ.get (line 230, credential/environment) → urllib.request.build_opener.open (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 235)May include surrounding context.

python

})
    request_id = None
    try:
        with urllib.request.build_opener(NoPostRedirect()).open(request, timeout=args.timeout) as response:
            request_id = safe_id(response.headers.get('x-request-id') or response.headers.get('request-id'), key)
            result = json.loads(bounded_read(response, MAX_RESPONSE_BYTES))
        if not isinstance(result, dict):

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate.py (reported line 138)May include surrounding context.

python

raise SkillError('必须提供非空 --prompt 或 --prompt-file；不会自动生成测试图片')
    if len(prompts) > 1000:
        raise SkillError('一次最多处理 1000 条提示词，请拆分批次')
    return prompts


def resolve_api_key(args):

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate.py (reported line 208)May include surrounding context.

python

value = getattr(args, field)
        if value is not None and value != '':
            body[field] = value
    return prompts, body, images, mask


def request_bytes(body, images, mask, image_field):

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/gpt-image-2-api.md (reported line 41)May include surrounding context.

请求协议

文生图：POST https://api.llm-token.cn/v1/images/generations，JSON。

json

{"model":"gpt-image-2","prompt":"蓝色音箱产品海报，干净背景","size":"1024x1024","n":1,"quality":"high","response_format":"b64_json"}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/gpt-image-2-api.md (reported line 47)May include surrounding context.

{"model":"gpt-image-2","prompt":"蓝色音箱产品海报，干净背景","size":"1024x1024","n":1,"quality":"high","response_format":"b64_json"}

text

参考图/编辑：`POST https://api.llm-token.cn/v1/images/edits`，`multipart/form-data`。文本字段与文生图相同，每张图一个 `image` 文件字段，可附一个 `mask` 字段。脚本负责 boundary，不能手填成普通 `application/json`。其他兼容服务明确要求 `image[]` 时使用 `--image-field 'image[]'`。

认证：`Authorization: Bearer <贵数Key>`。生成请求不跟随重定向；图片下载是无认证 GET，绝不携带生成 Key。下载仅允许 HTTPS 公网地址，重定向目标也会检查；签名 URL 过期可能无法恢复。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.py (reported line 26)May include surrounding context.

python

VERSION = '1.1.0'
DEFAULT_ENDPOINT = 'https://api.llm-token.cn/v1/images/generations'
DEFAULT_MODEL = 'gpt-image-2'
KEY_ENV_NAMES = ('LLM_TOKEN_API_KEY', 'GUI_SHU_TOKEN_KEY')
GUI_SHU_HOSTS = {'api.llm-token.cn', 'gpt-agent.cc', 'hk.gpt-agent.cc', 'eu.gpt-agent.cc', 'img.llm-token.cn'}

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/generate.py (reported line 205)May include surrounding context.

python

if not (args.model in EXTENDED_MODELS and args.quality == 'auto' and parsed.hostname in GUI_SHU_HOSTS):
        body['quality'] = args.quality
    for field in ('background', 'output_format', 'output_compression'):
        value = getattr(args, field)
        if value is not None and value != '':
            body[field] = value
    return prompts, body, images, mask