ClawHub
Back to skill

Security audit

AI图像生成-免费版

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is not clearly malicious, but it asks users to run commands and use an API key with an opaque endpoint while its scope and implementation are under-specified.

Review this skill before installing. Use it only in an isolated environment with a narrowly scoped, revocable API key, verify the endpoint operator before sending credentials or prompts, and avoid relying on the documented command examples until the missing implementation is supplied and reviewed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:205
Finding

Unpinned Python Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 205-206
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

text
| requests | Python library | Required | pip install requests |
| Pillow | Image processing | Recommended | pip install Pillow |

Technical Analysis

The installation instructions request mutable versions of requests and Pillow without version constraints, package hashes, a lockfile, or an explicitly trusted package index. Consequently, the dependencies installed at deployment time may differ from those reviewed during the audit.

The named packages are legitimate, and the project contains no evidence that they are currently malicious. Nevertheless, the installation process lacks controls that would protect users if a dependency release or package distribution channel were compromised. Python packages may execute code during installation or when imported by a later implementation.

Attack Path

  1. An attacker compromises a dependency release, maintainer account, or package distribution path.
  2. A user follows the documented unpinned pip install instructions.
  3. Package resolution selects the compromised release because no reviewed version or hash is enforced.
  4. Malicious package logic executes during installation or when imported.
  5. The payload runs with the privileges of the user or automation account that installed or invoked the package.

Impact Assessment

A compromised dependency could execute arbitrary code with the privileges of the installing user. Potential consequences include theft of environment variables and API credentials, access to files available to the Agent, manipulation of generated outputs, and further network activity. The precise scope depends on the privileges and isolation of the installation environment.

Remediation
View remediation

Remediation Suggestions

  • Pin every required dependency to a reviewed version.
  • Provide a hash-locked requirements file, such as one generated with pip-compile.
  • Require hash verification during installation, for example with pip install --require-hashes.
  • Explicitly use a trusted package index and disable unneeded additional indexes.
  • Add automated dependency vulnerability and integrity scanning.
  • Run installation and image generation in a least-privileged, isolated environment.
  • Periodically review and deliberately update pinned versions rather than accepting automatic version drift.

other

Warning
Location
SKILL.md:117
Finding

Sensitive API Configuration Is Directed to an Unverified Third-Party Endpoint

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 117-118 and 139-140
Vulnerability Type: Untrusted external API configuration
Risk Level: Medium

Vulnerable Code

bash
export IMAGE_GEN_API_KEY="${API_KEY:?Please set environment variable}"
export IMAGE_GEN_BASE_URL="https://code.newcli.com/gemini"

The same default endpoint is repeated in the example configuration:

bash
IMAGE_GEN_API_KEY=your_key
IMAGE_GEN_BASE_URL=https://code.newcli.com/gemini

Technical Analysis

The Skill claims to provide Gemini-backed image generation but configures https://code.newcli.com/gemini as its default service URL. The documentation does not identify this host as an official Gemini endpoint and does not disclose its operator, credential-handling model, privacy policy, prompt retention policy, or trust relationship with the upstream provider.

The project does not include the referenced client implementation, so the audit cannot confirm whether the API key is transmitted as an authorization credential, transformed locally, or sent elsewhere. Therefore, actual credential exfiltration is not established. The confirmed weakness is that users are instructed to combine a sensitive API key with an opaque third-party endpoint without documented trust validation.

Attack Path

  1. A user follows the setup instructions and places an API credential in IMAGE_GEN_API_KEY.
  2. The user obtains or creates a client that honors IMAGE_GEN_BASE_URL.
  3. The client connects to https://code.newcli.com/gemini.
  4. If the client sends the configured key or sensitive prompts to that host, the endpoint operator receives those values.
  5. A malicious or compromised endpoint could retain prompts, collect credentials, return manipulated image data, or misuse a credential if it is accepted by another service.

The last stages depend on behavior in the absent client implementation and are therefore a potential exploitation path rather than confirmed exfiltra ...[truncated 414 chars]

Remediation
View remediation

Remediation Suggestions

  • Default to the official, documented provider endpoint.
  • Clearly identify any intermediary service, its operator, and why it must receive requests.
  • Document whether the intermediary receives or stores credentials, prompts, images, and request metadata.
  • Use a host allowlist and reject unexpected or user-injected endpoint values by default.
  • Require TLS certificate validation and prohibit insecure fallback protocols.
  • Use narrowly scoped, revocable credentials intended specifically for the selected endpoint.
  • Never forward credentials issued for one provider to an unrelated intermediary.
  • Add explicit user confirmation before transmitting sensitive prompts or credentials to a third party.
  • Provide a privacy policy, retention policy, and credential-rotation procedure.

other

Note
Location
SKILL.md:74
Finding

Referenced Image-Generation Implementation Is Missing from the Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 74
Vulnerability Type: Missing implementation and unverifiable execution behavior
Risk Level: Low

Vulnerable Code

bash
python3 scripts/generate_image.py \
  "image generation prompt" \
  --model gemini-3.1-flash-image \
  --output avatar.png

Technical Analysis

The package contains only SKILL.md; the referenced scripts/generate_image.py file and scripts/ directory are absent. As a result, the declared image-generation workflow cannot execute as packaged.

The missing implementation prevents verification of critical behavior, including command-line input handling, output-path validation, TLS certificate verification, API credential transmission, response parsing, file permissions, and error handling. The documentation warns against command injection and credential leakage, but there is no code demonstrating that these controls are implemented.

This is principally a package integrity and auditability issue rather than evidence of embedded malicious behavior. No remote script download is explicitly instructed, and no malicious replacement script was found.

Attack Path

  1. A user attempts to follow the documented command.
  2. Execution fails because scripts/generate_image.py is absent.
  3. To make the Skill operational, the user may search for or obtain a similarly named script from an external, unaudited source.
  4. If that replacement is malicious, it could read the configured API key, access local files, or execute arbitrary commands with the user's privileges.

Steps three and four represent a foreseeable risk caused by the incomplete package, not behavior explicitly implemented by the audited project.

Impact Assessment

The immediate impact is loss of availability and inability to verify the Skill's security claims. If a user introduces an unaudited replacement implementation, the resulting impact could include arbitrary code execution and credential disclo ...[truncated 105 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the complete scripts/generate_image.py implementation in the package.
  • Ensure the implementation is covered by the same security review as SKILL.md.
  • Validate model identifiers, prompt length, and output paths without invoking a shell.
  • Prevent directory traversal and unintended file overwrites.
  • Use a fixed allowlist for supported API hosts and models.
  • Verify TLS certificates and apply network timeouts.
  • Prevent API keys from appearing in command output, logs, exceptions, or generated files.
  • Add tests for hostile prompts, malformed responses, unsafe output paths, network failures, and credential redaction.
  • If no implementation will be distributed, remove the unavailable command and clearly identify the document as non-executable guidance.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

High
Category
Not specified by scanner
Confidence
92% confidence
Finding

The top-level description includes vague activation language covering general AI model use, conversation, agent orchestration, and LLM applications. Because skill selection often relies on description text, this broad wording can misroute unrelated requests into a skill that exposes exec/read/write and external API behavior, creating unnecessary privilege exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition says to use this skill for broad categories such as AI model calling, intelligent dialogue, agent orchestration, and LLM applications, which far exceeds image generation. In an agent environment, this can cause the skill to activate for unrelated tasks and gain access to exec/read/write capabilities in contexts where it is unnecessary, expanding the attack surface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is presented as a narrow image-generation tool, but its documented interface expands into generic create/query/modify/delete, import/export, and runtime configuration behaviors unrelated to text-to-image generation. This kind of scope inflation increases the chance an agent will invoke the skill for broader file or workflow operations than users expect, weakening least-privilege assumptions and making unsafe tool use harder to reason about.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples show free-form prompt text embedded directly into shell command invocations while the skill also permits exec. If an agent constructs these commands by string interpolation, attacker-controlled prompt text can break quoting or inject additional shell syntax, leading to arbitrary command execution or unintended file/network actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.