ClawHub
Back to skill

Security audit

TencentCloud Image AIGC Detection

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it can automatically send local images to Tencent Cloud and recommends persistent plaintext cloud credentials, so users should review it before installing.

Install only if you are comfortable sending submitted image URLs or local image contents to Tencent Cloud for processing. Use a dedicated virtual environment, pin or review the Tencent SDK version, prefer short-lived and least-privilege Tencent credentials, and avoid storing SecretId or SecretKey in ~/.zshrc or other broadly loaded plaintext files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:239
Finding

Unpinned Third-Party SDK Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 239
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

bash
pip install tencentcloud-sdk-python

Technical Analysis

The Skill instructs the Agent to install tencentcloud-sdk-python without specifying an exact version or verifying package integrity. Consequently, the installed code can change after the Skill has been reviewed.

Python package installation may execute package-controlled build or installation logic. The package is subsequently imported by scripts/main.py and operates in the same process as Tencent Cloud credentials and submitted image data. There is no evidence that the current package is malicious; the risk arises from unconstrained future package resolution and supply-chain compromise.

Attack Path

  1. An attacker compromises the package distribution account, release pipeline, or another relevant dependency in the resolution chain.
  2. The attacker publishes a malicious version that still satisfies the unpinned installation command.
  3. A user invokes the Skill in an environment where the dependency is absent or being reinstalled.
  4. The Agent executes the documented pip install tencentcloud-sdk-python command.
  5. Package installation or import executes attacker-controlled code with the privileges of the Agent process.
  6. The malicious code may access environment variables, Tencent Cloud credentials, local files available to the process, or images submitted for analysis.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The accessible scope may include:

  • TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY, and an optional STS token.
  • Local image files supplied to the Skill.
  • Other files and environment variables readable by the Agent process.
  • Tencent Cloud operations permitted by the configured ...[truncated 101 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the SDK to an exact, reviewed version rather than resolving the latest available release.
  2. Maintain a lock file containing cryptographic hashes and install with hash verification, such as pip install --require-hashes.
  3. Install dependencies in a dedicated virtual environment with only the permissions required by the Skill.
  4. Use a trusted package index and explicitly configure the index URL to reduce dependency-confusion exposure.
  5. Periodically review and deliberately update the pinned SDK after security and compatibility testing.
  6. Prefer prebuilt, verified environments over performing package installation during normal Skill execution.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:62
Finding

Long-Lived Cloud Credentials Persisted in Shell Startup Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62-66
Vulnerability Type: Plaintext credential persistence and excessive credential exposure
Risk Level: Medium

Vulnerable Code:

bash
echo 'export TENCENTCLOUD_SECRET_ID="你的SecretId"' >> ~/.zshrc
echo 'export TENCENTCLOUD_SECRET_KEY="你的SecretKey"' >> ~/.zshrc
echo 'export TENCENTCLOUD_AIGC_RECOG_IMAGE_BIZ_TYPE="你的BizType"' >> ~/.zshrc
source ~/.zshrc

Technical Analysis

The optional persistence instructions direct users to place long-lived Tencent Cloud credentials in plaintext inside ~/.zshrc. Every future shell loading that file exports the credentials to its environment, broadening their lifetime and availability beyond the image-detection process.

Shell initialization files can be accessed by other processes running under the same user, collected by diagnostic or backup tooling, processed by shell plugins, or accidentally included in dotfile repositories. Exported credentials may also become available to unrelated child processes. The source ~/.zshrc command exposes the values immediately in the current shell.

This behavior is not a hidden backdoor and does not constitute covert system persistence. However, it exceeds the minimum credential exposure necessary for individual Skill invocations.

Attack Path

  1. A user follows the persistence instructions and substitutes valid Tencent Cloud credentials.
  2. The credentials remain as plaintext in ~/.zshrc and are exported whenever a shell loads the file.
  3. A malicious or compromised same-user process, shell plugin, backup, diagnostic collector, or accidentally published dotfile repository obtains the file contents or inherited environment.
  4. The attacker extracts the SecretId and SecretKey.
  5. The attacker authenticates to Tencent Cloud and performs operations allowed by the credentials until they expire, are disabled, or are rotated.

Impact Assessme

...[truncated 581 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer short-lived Tencent Cloud STS credentials with narrowly scoped IAM permissions.
  2. Do not recommend storing secrets directly in ~/.zshrc, shell history, source repositories, or other general-purpose plaintext files.
  3. Use a protected operating-system credential manager or a dedicated secrets-management service.
  4. If file-based configuration is unavoidable, use a dedicated file with restrictive permissions, exclude it from backups and version control, and load it only for the specific command.
  5. Apply least-privilege IAM policies that permit only the required Image Moderation operation and resources.
  6. Document credential rotation and immediate revocation procedures.
  7. Avoid globally exporting credentials to unrelated child processes; inject them only into the Skill process when it runs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill requires access to sensitive environment variables such as TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY, and optional TENCENTCLOUD_TOKEN, but it does not declare any explicit tool scope or permissions boundary. This creates a transparency and least-privilege problem: an agent may access secrets implicitly without the user being clearly informed that the skill needs credential-bearing environment access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to automatically execute remote image detection on user-provided URLs or local image files without first obtaining informed consent, while failing to clearly disclose that the image data will be sent to Tencent Cloud for third-party processing. This can cause unintended exfiltration of sensitive local files or private image contents, especially because local file paths are explicitly supported and the agent is told to proceed without confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file describes sending input images to a remote cloud moderation API for analysis, including full image content via URL or Base64, but it does not warn users that image data will be transmitted to an external service. Because image moderation may involve user-generated or sensitive images, the skill description should disclose privacy and data-handling implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code transmits either a user-supplied image URL or the full Base64-encoded image contents to Tencent Cloud's remote ImageModeration API, but it does not provide an explicit runtime warning, consent prompt, or clear disclosure that local files may leave the user's environment. In a security/privacy context, this can cause unintended exfiltration of sensitive images or internal-only URLs, especially when users assume a local analysis skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This instruction constrains how the agent communicates results without offering the user a choice of presentation style or language/locale accommodation. In a multilingual skill, hard-coded response behavior can violate organizational policies when it removes user preference or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file contains multiple user-visible error and guidance strings in Chinese only, such as the dependency error here and additional JSON messages elsewhere. This creates a language policy concern because the skill forces one language for user interaction without documenting a locale constraint or allowing user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.