ClawHub
Back to skill

Security audit

Qwen Image

Security checks for vulnerabilities and agentic risk

Overview

The skill does perform its stated Qwen image-generation job, but it handles paid API credentials in ways that can expose them.

Install only if you intend to use Alibaba Cloud DashScope/Qwen Image and are comfortable sending prompts to that service. Prefer DASHSCOPE_API_KEY or a protected secret store over --api-key, avoid exposing keys in logs or command history, and avoid --no-verify-ssl unless you understand the download-integrity risk.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:70
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/generate_image.py:2
Finding

Unpinned Runtime Dependency Resolution

Content
View full analysis
=3.10" # dependencies = [ # "requests>=2.31.0", # ] # /// ``` The documented execution method invokes dependency resolution through `uv`: ```bash uv run {baseDir}/scripts/generate_image.py --prompt "一副典雅庄重的对联悬挂于厅堂之中" --size "1664*928" --api-key sk-xxx ``` ### Technical Analysis The dependency constraint `requests>=2.31.0` is open-ended. Consequently, the exact third-party code executed by `uv run` can change after the Skill has been audited. There is no lock file or hash constraint in the reviewed project. The dependency name refers to the established `requests` package; there is no evidence of typosquatting, dependency confusion, or a currently malicious release. The risk is that future resolution may select a compromised, incompatible, or behaviorally changed package version without a corresponding change to the Skill source. ### Attack Path 1. The Skill is invoked with `uv run` in an environment where the dependency is not already fixed in a controlled environment. 2. `uv` resolves a version of `requests` satisfying `>=2.31.0`. 3. A future compromised or otherwise unsafe release is selected. 4. The selected package is installed or loaded in the user's execution context. 5. Malicious dependency code can act with the same operating-system permissions and environment access as the Skill process, including potential access to `DASHSCOPE_API_KEY`. This path depends on upstream or package-distribution compromise; no such compromise was observed in the audited files. ### Impact Assessment A malicious dependency could read process-accessible credentials and files, alter API traffic, make additional network requests, or execute code with the invoking user's privileges. ...[truncated 253 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate_image.py:74
Finding

Optional TLS Certificate Verification Bypass for Image Downloads

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 24)May include surrounding context.

python
def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("DASHSCOPE_API_KEY")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises and instructs use of capabilities that access environment variables, local configuration files, and the network, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations can cause the skill to run with broader-than-expected access, reducing reviewability and increasing the chance of unintended credential access or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text is broad enough that the skill may be selected for generic image requests rather than only when this specific provider is appropriate. Over-broad triggering is not direct code execution risk, but it can route user requests into a skill that performs network calls and credential-backed API usage unnecessarily, increasing exposure of secrets and external data sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation explicitly instructs the agent to retrieve API keys from local config files and environment variables without any warning, consent step, or limitation on exposing those values. In an agent setting, this creates a real secret-handling risk because the model may read sensitive credentials from the host and pass them into commands, logs, or responses, especially since examples also show the API key on the command line.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script hard-codes a Chinese negative prompt as the default input sent to the image-generation service. This imposes a specific language/locale choice on every run unless the user explicitly overrides it, which is a natural-language policy violation under the language/locale rule.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI help at L075-L077 says --no-verify-ssl disables SSL certificate verification, but the main DashScope API call at L125-L133 hardcodes verify=True. The option only affects the later image डाउनलोड at L172, so the documented behavior contradicts what the code actually does for the primary request.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 125)May include surrounding context.

python
try:
        # Make API request
        response = requests.post(
            "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation",
            headers={
                "Content-Type": "application/json",

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 125)May include surrounding context.

python
try:
        # Make API request
        response = requests.post(
            "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation",
            headers={
                "Content-Type": "application/json",

Tainted flow: 'image_url' from requests.post (line 163, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
94% confidence
Finding

The script takes an image URL returned by the external API and immediately fetches it with requests.get without validating the hostname or scheme. If the upstream service is compromised, misconfigured, or manipulated, this creates an SSRF-style sink that can trigger unintended outbound requests to attacker-controlled or internal endpoints from the environment running the skill.

Content

Scanner excerpt · scripts/generate_image.py (reported line 172)May include surrounding context.

python
output_path.parent.mkdir(parents=True, exist_ok=True)
            
            print("Downloading image...")
            img_response = requests.get(image_url, timeout=30, verify=not args.no_verify_ssl)
            img_response.raise_for_status()

            # Save the image

Static analysis

No suspicious patterns detected.