ClawHub
Back to skill

Security audit

Qwen Image

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Qwen/DashScope image-generation skill with disclosed API-key and network use, but users should avoid its optional TLS-bypass flag.

Install only if you are comfortable sending prompts and generation settings to Alibaba Cloud DashScope. Use a dedicated DashScope API key, prefer environment variables or a secret store over command-line keys, avoid sensitive prompts, do not use --no-verify-ssl except in a controlled proxy setup, and save files only to paths you choose intentionally.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'image_url' from requests.post (line 163, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
output_path.parent.mkdir(parents=True, exist_ok=True)
            
            print("Downloading image...")
            img_response = requests.get(image_url, timeout=30, verify=not args.no_verify_ssl)
            img_response.raise_for_status()

            # Save the image
Confidence
93% confidence
Finding
The script trusts an image URL returned by the remote API and immediately fetches it with requests.get, creating a server-side request forgery style sink if the upstream service is compromised or returns attacker-controlled URLs. In an agent context, this can be abused to make outbound requests to arbitrary hosts, including internal metadata or intranet endpoints, and then save the response locally as if it were an image.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill clearly requires access to environment variables and network resources to obtain API keys and call the remote image-generation API, yet it declares no corresponding permissions. That mismatch weakens transparency and policy enforcement, making it easier for a user or platform to underestimate what the skill can access and exfiltrate.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation instructs the agent to retrieve API keys from local configuration files and environment variables without any warning about sensitive-data handling, minimization, or redaction. In an agent setting, this encourages automatic secret access and creates a path for accidental disclosure in logs, command lines, error messages, or downstream tool output.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `--negative-prompt "unwanted elements"` - Specify what to avoid
- `--no-prompt-extend` - Disable automatic prompt enhancement
- `--watermark` - Add watermark to generated image
- `--no-verify-ssl` - Disable SSL certificate verification (use when behind corporate proxy)

## Workflow
Confidence
97% confidence
Finding
Documenting and normalizing a `--no-verify-ssl` option encourages disabling TLS certificate verification for a networked API call. If used, an attacker on the network path or a malicious proxy could intercept traffic, manipulate responses, or capture API credentials, which is especially dangerous because the same workflow also handles sensitive API keys.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
help="DashScope API key (overrides DASHSCOPE_API_KEY env var)"
    )
    parser.add_argument(
        "--no-verify-ssl",
        action="store_true",
        help="Disable SSL certificate verification (use with caution)"
    )
Confidence
96% confidence
Finding
The tool exposes a flag to disable SSL certificate verification for the image download request, enabling man-in-the-middle interception and tampering of downloaded content. In an agent environment this weakens a core transport security control and, combined with the untrusted image_url flow, makes malicious redirection or response substitution much easier.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.