ClawHub
Back to skill

Security audit

seedream5

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Seedream image-generation skill that clearly sends prompts to a fixed external API and optionally stores its API key locally for reuse.

Install only if you trust the Seedream/API provider. Do not send confidential prompts or private reference-image URLs unless you are comfortable sharing them with the external service. Prefer a dedicated revocable API key, protect ~/.config/seedream5.0/.env if you use key persistence, and rotate the key if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill includes shell-capable instructions and scripts (for key storage and request execution) but does not declare corresponding permissions. That mismatch weakens review and consent boundaries because an agent may execute filesystem and shell actions the user did not clearly approve. In this context, the shell capability is especially relevant because it is used to persist API credentials locally.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The activation language is broad enough to match common phrases like 'generate an image' or 'cover image,' which can cause the skill to trigger in situations where the user did not intend external API use. Over-broad triggering increases the chance of accidental transmission of prompts, reference image URLs, or use of stored credentials without meaningful user awareness.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill description does not clearly warn users that their prompts, reference image URLs, and possibly sensitive creative inputs will be transmitted to an external API endpoint. This is a real privacy and data-handling issue because users may provide confidential or personal content under the assumption it stays local.

External Transmission

Medium
Category
Data Exfiltration
Content
详细接口说明见 references/api-guide.md。

```bash
curl --location 'https://agent.mathmind.cn/minimalist/api/volcengine/ai/fzGenerateImg5' \
--header 'Content-Type: application/json' \
--header 'x-api-key: <YOUR_X_API_KEY>' \
--data '{"prompt":"一只猫咪在玩耍","size":"2048x2048","watermark":true,"image":[]}'
Confidence
95% confidence
Finding
The skill is explicitly designed to send user-supplied prompts and image references to a remote endpoint, which constitutes external data transmission. While expected for this functionality, it is still security-relevant because creative prompts, internal URLs, or sensitive image references could be exposed to a third party if the user is not adequately informed.

Credential Access

High
Category
Privilege Escalation
Content
1. 本次对话显式输入的 x-api-key
2. 环境变量 X_API_KEY
3. 本地持久化文件 ~/.config/seedream5.0/.env

首次配置（只需一次）：
Confidence
96% confidence
Finding
The skill instructs the agent to read credentials from environment variables and a local .env file, which is credential access behavior. In an agent setting, allowing skill logic to retrieve secrets from local storage increases the blast radius: a mis-triggered or overly broad skill can use existing secrets without the user explicitly supplying them in the current conversation.

Credential Access

High
Category
Privilege Escalation
Content
## 快速执行脚本

- ./scripts/set_key.sh "你的x-api-key"：保存 key 到 ~/.config/seedream5.0/.env
- ./scripts/generate.sh --prompt "提示词" [--size "2048x2048"] [--watermark true] [--image "https://example.com/a.png"]

## 目录结构（标准）
Confidence
92% confidence
Finding
The quick-execution flow normalizes storing the API key in a local .env file and reusing it later, which encourages credential harvesting/access patterns within the skill workflow. Even if intended for convenience, this expands the persistence and exposure surface for the key and makes silent future use more likely.

Session Persistence

Medium
Category
Rogue Agent
Content
首次配置（只需一次）：

```bash
mkdir -p ~/.config/seedream5.0
cat > ~/.config/seedream5.0/.env << 'EOF'
X_API_KEY=你的x-api-key
EOF
Confidence
95% confidence
Finding
The skill provides instructions to create a persistent local configuration directory and store the API key in ~/.config/seedream5.0/.env for long-term reuse. Persistent local secret storage increases the risk of unauthorized reuse by future sessions, other skills, or local compromise, especially when combined with broad triggering and undeclared shell capability.

Static analysis

No suspicious patterns detected.