GPT-image2

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 1.0.4

Overview

The skill does what it claims, but its credential handling can expose a RedFox API key more broadly than users would expect.

Review before installing if you use a paid or sensitive RedFox API key. Prefer an environment variable or a credential manager, avoid the plaintext config-file option, do not pass private images or confidential prompts unless you are comfortable sending them to RedFox, and rotate the key if you suspect generated-image downloads may have exposed it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/imagegen.py:192

Finding

API Key Disclosure Through Unvalidated Server-Supplied Download URLs

Content

View full analysis

1 else f"{prefix}{ext}" filepath = os.path.join(output_dir, filename) step(f"Downloading {i}/{total}: {filename}") try: resp = session.get(url, stream=True, timeout=120) ``` The same session has the API credential configured as a default header: ```python session = requests.Session() session.verify = True session.headers.update({ "Content-Type": "application/json", "X-API-KEY": api_key, }) ``` ### Technical Analysis The application places `X-API-KEY` in the default headers of a shared `requests.Session`. It then uses that session to fetch URLs returned in the remote API's `imagePaths` field. No validation restricts download URLs to HTTPS or to trusted RedFox-controlled hosts. As a result, the default `X-API-KEY` header can be transmitted to an arbitrary host selected through a malicious or compromised API response. Redirect behavior also requires explicit hardening because a trusted-looking URL may redirect to another origin. Uploading a selected image and submitting a prompt to RedFox are necessary for the declared image-generation functionality. Sending the API credential to arbitrary image-hosting origins is not necessary and exceeds minimum privilege. ### Attack Path 1. An atta ...[truncated 1266 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:126

Finding

API Key Persisted in a Plaintext Configuration File Without Enforced Permissions

Content

View full analysis

~/.qoder/apis/redfox.json` | ``` The application reads that plaintext credential without verifying ownership or permissions: ```python CONFIG_DIR = Path.home() / ".qoder" / "apis" CONFIG_FILE = CONFIG_DIR / "redfox.json" ``` ```python if CONFIG_FILE.exists(): try: data = json.loads(CONFIG_FILE.read_text()) key = data.get("api_key") if key: return key except (json.JSONDecodeError, OSError): pass ``` ### Technical Analysis The documented shell command stores the API key unencrypted in `~/.qoder/apis/redfox.json`. It does not explicitly create the directory with mode `0700` or the file with mode `0600`; resulting permissions depend on the user's existing umask and directory permissions. The script also reads the file without checking whether it is owned by the current user, whether it is a symbolic link, or whether group and other users have access. Plaintext file storage is especially concerning because the README separately advises users not to expose keys in plaintext, making the guidance internally inconsistent. The Skill only needs temporary access to the API credential while issuing authenticated requests. Persisting it in an unprotected ...[truncated 1254 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README says users can '直接用自然语言描述你想要的图片即可', which defines activation in very broad terms without constraining when this skill should be invoked instead of general conversation. The examples that follow are common everyday requests, and the document does not provide negative examples or scope limits to reduce accidental triggering.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises execution that uses environment variables, local file inputs, and outbound network access, but it does not declare any tool scope or permissions metadata. This weakens user consent and platform enforcement because consumers cannot easily understand that prompts, images, and credentials may be accessed and transmitted off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation describes image editing via local file upload and remote generation, but it does not clearly warn users that prompts and reference images are sent to a third-party service for processing. This creates a privacy and data-handling risk because users may unknowingly upload sensitive images, metadata, or confidential prompts to an external provider.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill recommends persisting an API key in a plaintext file under the user's home directory for reuse across sessions. Storing long-lived secrets unencrypted increases exposure to local compromise, accidental inclusion in backups or dotfile sync, and unintended access by other tools or users on the system.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

|----------|------|------|
| **环境变量**（推荐） | 设置一次，全局生效 | `export REDFOX_API_KEY=ak_你的密钥` |
| **命令行参数** | 临时使用，单次生效 | `python3 "$SKILL_PATH/assets/imagegen.py" "prompt" --api-key ak_你的密钥` |
| **配置文件** | 持久化存储，跨会话保留 | `mkdir -p ~/.qoder/apis && echo '{"api_key":"ak_你的密钥"}' > ~/.qoder/apis/redfox.json` |

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

When --image is used, the script uploads the contents of a local file to a third-party remote service, but it does not clearly warn the user at the point of use that local image data will leave the device. In a tool that accepts arbitrary local file paths, this can lead to unintended disclosure of sensitive images or embedded metadata, especially because the skill is designed for convenience and the upload is automatic once the option is supplied.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing instructions and examples in the README are presented only in Chinese, with no indication that other languages are supported or that the language is optional. This can be a language/locale policy issue when the skill effectively assumes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module description and user-facing interface are written in Chinese, and later prompts/help text continue this language assumption. The file does not offer any user opt-in or alternative locale, which can violate a language/locale policy when a skill is expected to be language-neutral unless explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.