ClawHub
Back to skill

Security audit

seedream 5.0 lite

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is mostly purpose-aligned, but it handles a RedFox API key in a way that can leak it to generated-image download hosts.

Review before installing. Use only non-sensitive prompts and images, prefer REDFOX_API_KEY from the environment rather than the plaintext config file, and rotate the key if you already used this version to download generated images. The main issue is a credential-handling bug, not evidence of intentional malware.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
assets/seedream.py:337
Finding

RedFox API Key Disclosed to Server-Supplied Image Download Hosts

Content
View full analysis
0: pct = int(dl * 100 / total_size) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}%", end="", flush=True) ``` ### Technical Analysis The script stores `X-API-KEY` in the default headers of a global `requests.Session`. This is appropriate for requests sent to the fixed RedFox API endpoints, but the same session is passed to `download_images()` and used to request URLs obtained from the API response's `imageUrls` field. Because default session headers are attached to outgoing requests, the RedFox API key can be transmitted to the host identified by each returned image URL. The download URL is not restricted to `redfox.hk` or an allowlisted storage domain. It may point to a third-party OSS/CDN host or, if the API service or response is compromised, an attacker-controlled host. TLS certificate verification only protects the connection against interception. It does not prevent the authenticated destination from reading the `X-API-KEY` header. Sending the key to R ...[truncated 1507 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents capabilities that require environment access, local file reads, and outbound network communication, but it does not declare any explicit tool scope or permissions. This weakens user and platform visibility into what the skill can access, increasing the chance of over-privileged execution and unintended exposure of API keys, local images, or downloaded content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description uses broad trigger phrases like 'AI 图片生成器', '文生图', and '图生图时调用此 Skill', which are common across many normal user requests. Overly generic invocation criteria can cause the skill to activate in situations where the user did not clearly intend to send prompts or reference images to this third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly states that prompts and reference images are sent to redfox.hk and that images may be uploaded to OSS, but it does not present this as a clear privacy/security warning to the user before use. Users may unknowingly transmit sensitive text, personal photos, or confidential business images to external infrastructure and long-lived storage.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill recommends persisting the API key in a plaintext file under ~/.qoder/apis/redfox.json for reuse across sessions. Storing long-lived credentials unencrypted on disk increases the risk of credential theft by other local processes, misconfigured backups, shared accounts, or accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
|----------|------|------|
| **环境变量**（推荐） | 设置一次，全局生效 | `export REDFOX_API_KEY=ak_你的密钥` |
| **命令行参数** | 临时使用，单次生效 | `python3 "$SKILL_PATH/assets/seedream.py" "prompt" --api-key ak_你的密钥` |
| **配置文件** | 持久化存储，跨会话保留 | `mkdir -p ~/.qoder/apis && echo '{"api_key":"ak_你的密钥"}' > ~/.qoder/apis/redfox.json` |

---

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code presents core user-facing descriptions, help text, prompts, and error messages primarily in Chinese while also including some English strings. Under the language/locale policy, forcing a specific language without explicit user opt-in can be a natural-language policy violation when no language selection or locale justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.