Security audit

zimage

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is not clearly malicious, but it should be reviewed because its helper scripts store an API key locally and later load that file as shell code.

Review before installing. Use an environment variable or a managed secret store instead of the provided set_key.sh flow where possible, do not put sensitive or confidential content in prompts sent to the external API, and avoid running generate.sh against any ~/.config/z-image/.env file you did not create and inspect yourself.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/set_key.sh:8
Finding: Arbitrary Shell Execution Through a Sourced Credential File
Content: View full analysis
Vulnerability Details

File Location: scripts/set_key.sh:8-15, scripts/generate.sh:91-94
Vulnerability Type: Executable credential configuration / command injection
Risk Level: High

Vulnerable Code

scripts/set_key.sh:8-15:

bash
KEY="$1" CONF_DIR="$HOME/.config/z-image" CONF_FILE="$CONF_DIR/.env" mkdir -p "$CONF_DIR" cat > "$CONF_FILE" <<EOF X_API_KEY=$KEY EOF chmod 600 "$CONF_FILE"

scripts/generate.sh:91-94:

bash
if [[ -z "${X_API_KEY:-}" && -f "$HOME/.config/z-image/.env" ]]; then set -a . "$HOME/.config/z-image/.env" set +a fi

Technical Analysis

set_key.sh accepts an arbitrary command-line string and writes it into a file formatted as shell source code. generate.sh subsequently loads that file using the shell . command.

The key value is not validated or encoded before storage. A value containing a newline followed by shell commands, or a shell expression such as command substitution, can therefore become executable shell syntax when the file is sourced. File mode 600 limits access by other local users but does not prevent execution of malicious content supplied by the current user, another invoking component, or a compromised configuration file.

Persisting a key is relevant to the declared functionality, but interpreting the credential file as executable code exceeds the minimum privilege and behavior necessary to read an API credential.

Attack Path

An attacker persuades a user or an automated caller to configure a crafted value as the API key.

The attacker-controlled value includes a newline or other content that forms a valid shell command in .env.

scripts/set_key.sh stores the content under ~/.config/z-image/.env.

The user later invokes scripts/generate.sh without an existing X_API_KEY environment variable.

generate.sh sources the credential file.

The injected shell statemen ...[truncated 481 chars]
Remediation: View remediation
Remediation Suggestions

Never source a file containing credential data.

Store only the raw key, without an assignment or other shell syntax, and read it as data:

bash
IFS= read -r X_API_KEY < "$HOME/.config/z-image/api-key" export X_API_KEY

Prefer an operating-system credential manager instead of a plaintext file.

If an environment-file format must be retained, parse exactly one expected assignment without evaluating it as shell code.

Validate the key against the provider's documented key syntax and reject newlines, carriage returns, null bytes, and unexpected characters.

Create the destination file with restrictive permissions from the outset rather than applying permissions only after writing.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/set_key.sh:4
Finding: API Key Exposure Through Command-Line Arguments and Plaintext Persistence
Content: View full analysis
Vulnerability Details

File Location: scripts/set_key.sh:4-15, SKILL.md:183
Vulnerability Type: Insecure secret input and storage
Risk Level: Medium

Vulnerable Code

scripts/set_key.sh:4-15:

bash
if [[ $# -lt 1 || -z "${1:-}" ]]; then echo "Usage: $0 <x-api-key>" exit 1 fi KEY="$1" CONF_DIR="$HOME/.config/z-image" CONF_FILE="$CONF_DIR/.env" mkdir -p "$CONF_DIR" cat > "$CONF_FILE" <<EOF X_API_KEY=$KEY EOF chmod 600 "$CONF_FILE"

SKILL.md:183:

bash
./scripts/set_key.sh "你的x-api-key"

Technical Analysis

The documented setup procedure requires users to provide the API key as a command-line argument. Secrets supplied this way can remain in shell history and may be visible temporarily through process-inspection facilities.

The key is also persisted as plaintext in ~/.config/z-image/.env. Applying mode 600 is a useful control, but the credential remains readable to the user account and to any process that compromises that account. Plaintext storage also increases exposure through backups, home-directory copies, and diagnostic collection.

Long-term key reuse is a legitimate convenience feature, but command-line secret entry is not necessary for that functionality and is avoidable.

Attack Path

A user follows the documented command and includes the API key directly in the command line.

The command and key are retained in shell history or observed through local process inspection while the script runs.

A local attacker or process with access to that information obtains the key.

The attacker submits requests to the image-generation service using the stolen credential.

Alternatively, malware running as the same user can directly read the persisted plaintext credential file.

Impact Assessment

Exposure permits unauthorized use of the victim's API account, potentially causing billing charges, quota exhaustion, ser ...[truncated 149 chars]
Remediation: View remediation
Remediation Suggestions

Prompt for the key without terminal echo instead of accepting it as a positional argument:

bash
IFS= read -rs -p "x-api-key: " KEY printf '\n'

Support standard input for automation so callers can use a secure secret provider without exposing the key in process arguments.

Recommend removing any previously entered key from shell history.

Store the credential in an operating-system keychain or secret manager where available.

If file storage is required, create the file atomically with mode 600, restrict the parent directory, and clearly document the residual plaintext-storage risk.

Avoid displaying any part of the full key in logs, errors, or success messages.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate.sh:148
Finding: API Credential May Be Forwarded to a Redirected Host
Content: View full analysis
Vulnerability Details

File Location: scripts/generate.sh:148-152
Vulnerability Type: Sensitive header forwarding across HTTP redirects
Risk Level: Medium

Vulnerable Code

bash
curl --location "$API_URL" \ --header "x-api-key: $X_API_KEY" \ --header 'Content-Type: application/json' \ --data "$payload"

Technical Analysis

The request includes the API key in a custom HTTP header while enabling automatic redirect handling through curl --location. Custom headers supplied explicitly to curl can be reused on redirected requests. If the configured endpoint returns a redirect to another origin, the credential may consequently be disclosed to that redirect destination.

The API URL is statically configured, but the response and redirect target are controlled by the remote service or by any party that compromises it. Image generation only requires a request to the designated endpoint; unrestricted redirect following is not necessary for the declared functionality.

Attack Path

The legitimate API endpoint is compromised, misconfigured, or changed to issue an HTTP redirect.

The redirect points to an attacker-controlled origin.

curl --location follows the redirect.

The explicitly configured x-api-key header is sent with the redirected request.

The attacker-controlled server records and reuses the credential.

Impact Assessment

The exposed key could be used for unauthorized image-generation requests, account abuse, quota exhaustion, and billing fraud. The scope is limited to permissions granted to the API key; this issue does not directly grant local system access.
Remediation: View remediation
Remediation Suggestions

Remove --location if redirects are not required by the documented API.

Treat any 3xx response as an error and report it without making another authenticated request.

If redirect support is operationally required, validate each destination against a strict allowlist of HTTPS scheme, hostname, and port.

Strip the x-api-key header before any cross-origin request.

Do not weaken TLS verification or permit HTTPS-to-HTTP redirects.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate.sh:139
Finding: Prompt Is Embedded Into JSON Without Correct Serialization
Content: View full analysis
Vulnerability Details

File Location: scripts/generate.sh:139-145
Vulnerability Type: Improper JSON encoding / request injection
Risk Level: Medium

Vulnerable Code

bash
payload=$(cat <<EOF { "prompt": "${prompt//"/\\\"}", "size": "$size" } EOF )

Technical Analysis

The request body is constructed through string interpolation and attempts to escape only quotation marks. Correct JSON string serialization must also handle backslashes, control characters, tabs, carriage returns, newlines, and other special characters.

A crafted prompt containing backslashes and quotation marks can interfere with the manual escaping. Other control characters can produce invalid JSON. Depending on the exact input, this may cause request rejection or change how the receiving JSON parser interprets the request body.

Shell quoting prevents this value from being directly executed as a local shell command in this segment, but it does not make the generated content valid or structurally safe JSON.

Attack Path

An attacker supplies a prompt containing a crafted combination of backslashes, quotes, newlines, or control characters.

The script performs incomplete quote-only escaping.

The resulting request body is malformed or interpreted differently than intended by the remote JSON parser.

The script sends the manipulated body as an authenticated, potentially billable API request.

Impact Assessment

Exploitation can cause request corruption, unexpected API behavior, failed or unintended billable operations, and loss of request integrity. The issue does not directly provide local code execution because the prompt is not evaluated as shell code in this payload-building operation.
Remediation: View remediation
Remediation Suggestions

Use a proper JSON serializer instead of manual string substitution. For example:

bash
payload="$( jq -n \ --arg prompt "$prompt" \ --arg size "$size" \ '{prompt: $prompt, size: $size}' )"

If adding jq is undesirable, use another available language or library with a standards-compliant JSON encoder.

Do not attempt to maintain a custom list of escaped characters.

Add tests for quotes, backslashes, Unicode, tabs, carriage returns, and multiline prompts.

Validate the final payload as JSON before making an authenticated request.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/generate.sh:132
Finding: Unbounded Request Count Permits Cost and Resource Amplification
Content: View full analysis
Vulnerability Details

File Location: scripts/generate.sh:132-138
Vulnerability Type: Missing upper bound on billable operations
Risk Level: Low

Vulnerable Code

bash
if ! [[ "$count" =~ ^[1-9][0-9]*$ ]]; then echo "Error: invalid --count '$count'. Expected positive integer" exit 1 fi for ((i = 1; i <= count; i++)); do

Technical Analysis

The script verifies that --count is a positive integer but does not enforce a maximum. Consequently, a caller can provide an extremely large value and cause the script to perform a correspondingly large number of authenticated API requests.

The loop is sequential, but it can still consume network and process resources, exhaust account quotas, and create substantial API charges. Strictly matching a user-requested count does not require accepting arbitrary unbounded values.

Attack Path

An attacker controls or influences the value passed to --count.

The attacker supplies a very large positive integer.

The value passes the current regular-expression validation.

The loop repeatedly invokes the authenticated image-generation endpoint.

Requests continue until the loop finishes, the process is terminated, or the service rejects further requests.

Impact Assessment

Exploitation can cause API quota exhaustion, unexpected billing charges, prolonged process execution, network consumption, and temporary denial of service for legitimate users. It does not grant additional local privileges.
Remediation: View remediation
Remediation Suggestions

Enforce a conservative hard maximum appropriate for normal Skill usage, such as:

bash
MAX_COUNT=10 if ! [[ "$count" =~ ^[1-9][0-9]*$ ]] || (( count > MAX_COUNT )); then echo "Error: --count must be between 1 and $MAX_COUNT" exit 1 fi

Require explicit confirmation for unusually expensive operations.

Consider enforcing account-side quotas and spending limits.

Add request timeouts and a mechanism to stop remaining calls after authentication, quota, or billing-related errors.

Log only the planned and completed request counts without recording credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest presents the skill as a simple text-to-image generator, but the content also instructs persistent credential storage and local shell-based configuration. This mismatch undermines user and platform trust boundaries because operators may approve the skill for image generation while it also influences local filesystem and secret-handling behavior.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The skill instructs storing an API key in a plaintext .env file under the user's home directory. Plaintext credential persistence materially increases the chance of secret leakage through backups, shell history, other local processes, or accidental disclosure by agents with filesystem access.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
bash
mkdir -p ~/.config/z-image cat > ~/.config/z-image/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/z-image/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The instructions continue to normalize long-term credential storage in a local .env file, which creates standing secret exposure beyond the immediate task. Even with restrictive file permissions, any component or future workflow with access to the home directory may retrieve and misuse the key.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
cat > ~/.config/z-image/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/z-image/.env

text
## 核心接口

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.
md
- `SKILL.md`

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The script sources $HOME/.config/z-image/.env directly into the shell with '.', which executes arbitrary shell code from that file rather than merely parsing a key-value secret. If an attacker can modify that file, running the script leads to arbitrary code execution in the user's context, making this more dangerous than ordinary credential loading.
Content: Scanner excerpt · scripts/generate.sh (reported line 91)May include surrounding context.
sh
exit 1 fi if [[ -z "${X_API_KEY:-}" && -f "$HOME/.config/z-image/.env" ]]; then set -a . "$HOME/.config/z-image/.env" set +a

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The combination of set -a and sourcing the .env file exports all variables defined during execution of that file, magnifying the risk of arbitrary code execution and environment manipulation. A malicious .env could run commands, alter PATH or shell behavior, and influence subsequent curl execution or other subprocesses.
Content: Scanner excerpt · scripts/generate.sh (reported line 93)May include surrounding context.
sh
if [[ -z "${X_API_KEY:-}" && -f "$HOME/.config/z-image/.env" ]]; then set -a . "$HOME/.config/z-image/.env" set +a fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/set_key.sh (reported line 11)May include surrounding context.
sh
KEY="$1" CONF_DIR="$HOME/.config/z-image" CONF_FILE="$CONF_DIR/.env" mkdir -p "$CONF_DIR" cat > "$CONF_FILE" <<EOF

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill documentation includes shell-based setup and execution steps but does not declare any tool scope or allowed-tools constraints. In an agent environment, this broadens the effective capability surface and can let the skill invoke local shell actions without explicit sandboxing expectations, increasing the chance of unintended file or system access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description explicitly targets requests for images with Chinese text ("带中文文字的图片") and is itself written as the operative instruction set in Chinese, without stating that other languages are equally supported or user-selectable. This creates a locale/language bias in activation behavior that is not presented as optional or region-specific.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs the agent to read API keys from environment variables and a local config file and to reuse them across sessions. That introduces secret discovery and persistence behavior beyond basic image generation, creating risk of credential exposure, over-collection, and use of secrets the user did not intend this skill to access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The shell-script-based local configuration steps expand the skill from image generation into local system modification by creating directories and writing files under the user's home directory. Even if intended for convenience, this increases the blast radius of the skill and creates opportunities for misuse or accidental persistence on hosts where such changes are unexpected.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The skill explicitly instructs creating persistent state in the user's home directory for future key reuse. Session persistence increases risk because compromise of the agent, host, or unrelated workflows can expose the stored credential long after the original image-generation request has ended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
首次配置（只需一次）

bash
mkdir -p ~/.config/z-image cat > ~/.config/z-image/.env << 'EOF' X_API_KEY=你的x-api-key EOF

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
cat > ~/.config/z-image/.env << 'EOF' X_API_KEY=你的x-api-key EOF chmod 600 ~/.config/z-image/.env

text
## 核心接口

External Transmission

Medium

Category: Data Exfiltration
Confidence: 78% confidence
Finding: The skill sends user prompts and an API key to an external service endpoint. External transmission is expected for an API-backed image tool, but it remains security-relevant because sensitive prompts or credentials could be disclosed to a third party if the endpoint, logging, or transport handling is not properly controlled.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
详细接口说明见 references/api-guide.md。

bash
curl --location 'https://agent.mathmind.cn/minimalist/api/tywx/zImage' \ --header 'x-api-key: <YOUR_X_API_KEY>' \ --header 'Content-Type: application/json' \ --data '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide instructs use of a third-party HTTPS endpoint and requires sending both the user's prompt and an x-api-key, but it does not disclose that user data and credentials leave the local system and are transmitted to an external service. In an agent skill context, this omission can cause operators or users to unknowingly send sensitive prompts or secrets to an external provider, creating privacy, compliance, and credential-handling risks.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 85% confidence
Finding: The cURL example demonstrates direct transmission of user-supplied prompt data and an authentication secret to an external network endpoint. While this is expected for the feature, in a skill package it is security-relevant because it operationalizes outbound data flow without any contextual warning, consent, or minimization guidance, increasing the chance of accidental disclosure of sensitive content or misuse of the API key.
Content: Scanner excerpt · references/api-guide.md (reported line 71)May include surrounding context.

16:9 -> 2048*1152

21:9 -> 2016*864

cURL Example

bash
curl --location 'https://agent.mathmind.cn/minimalist/api/tywx/zImage' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/generate.sh (reported line 152)May include surrounding context.
sh
EOF ) curl --location "$API_URL" \ --header "x-api-key: $X_API_KEY" \ --header 'Content-Type: application/json' \ --data "$payload"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code sends the user-provided prompt to a remote API and includes an API key in the request headers, but there is no confirmation prompt, visible disclosure message, or explanatory comment warning the user that their input will be transmitted off-machine. For a code file, remote transmission of user data and credentials should have some form of user-facing disclosure unless clearly warned elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes the provided API key in plaintext to $HOME/.config/z-image/.env without warning the operator that a sensitive credential will be persisted on disk. Although the file is later restricted with chmod 600, plaintext local storage still increases exposure through backups, endpoint compromise, shell history habits around passing secrets as arguments, and accidental disclosure during troubleshooting.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/set_key.sh (reported line 17)May include surrounding context.
sh
cat > "$CONF_FILE" <<EOF X_API_KEY=$KEY EOF chmod 600 "$CONF_FILE" echo "x-api-key saved to $CONF_FILE"

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tp4

Credential Access

Credential Access

Ae1

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Natural-Language Policy Violations

Context-Inappropriate Capability

Context-Inappropriate Capability

Session Persistence

首次配置（只需一次）

Sudo/Root Execution

External Transmission

Missing User Warnings

External Transmission

cURL Example

External Transmission

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Static analysis