T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:42- Finding
API Credential Exposure Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
the ai painting interface of suichuang api
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent image-generation connector, but it instructs users to expose an API key in URL query parameters during polling.
Review before installing. Use only a limited, revocable API key, avoid sensitive prompts, and prefer a version that authenticates polling with headers rather than putting the key in the URL. Rotate any key that has already been used in query strings.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This skill instructs the agent to send user-supplied prompts and credentials to an external domain, which is a data exfiltration surface by design. In context, an image-generation skill legitimately needs a remote API, but the danger remains because user content is transmitted off-platform and the skill includes secret-handling guidance.
- Content
md ### 第一步：提交任务 - 方式：POST - 地址：`https://api.wuyinkeji.com/api/async/image_nanoBanana2` - Headers： - Authorization: `【你的密钥】` - Content-Type: application/json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
The polling URL places the API key in the query string, which is especially dangerous because query parameters are commonly logged by proxies, servers, analytics tools, browser histories, and monitoring systems. This increases the chance of credential leakage beyond the intended recipient.
- Content
md ### 第二步：查询结果 - 方式：GET - 地址：`https://api.wuyinkeji.com/api/async/detail?key=【你的密钥】&id={task_id}` - Headers： - Authorization: `【你的密钥】`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This endpoint again sends user prompts to an external image-generation service, creating a third-party data disclosure path. While expected for the feature, the skill normalizes sending potentially sensitive user content and repeats secret material in both headers and body, increasing exposure.
- Content
md ### 第一步：提交任务 - 方式：POST - 地址：`https://api.wuyinkeji.com/api/async/image_nanoBanana_pro` - Headers： - Authorization: `【你的密钥】` - Content-Type: application/json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
As with the other result-query endpoint, the skill requires the API key in the URL query string during polling. Repeated polling amplifies the exposure because the secret may be written to logs many times across multiple layers of infrastructure.
- Content
md ### 第二步：查询结果 - 方式：GET - 地址：`https://api.wuyinkeji.com/api/async/detail?key=【你的密钥】&id={task_id}` - Headers： - Authorization: `【你的密钥】`
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill requires that all user prompts be translated into English before submission to a third-party image API, without user consent or disclosure. This can alter user meaning, cause unintended sharing/transformation of user content, and creates a privacy/compliance risk because the transformed prompt is externally transmitted.
- Content