横幅插画生成免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.3

Overview

The skill is not overtly malicious, but it mixes banner generation with broad command/API workflows and weak API-key handling that users should review carefully.

Review before installing. Prefer setting GEMINI_API_KEY through a protected environment or secret manager, do not paste API keys into chat, and treat the broad API/webhook/system-connection wording as out of scope for a free banner generator unless the publisher narrows it and supplies auditable implementation files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:139

Finding

API Key Exposure Through Conversation and Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 139, 169, and 198
Vulnerability Type: Insecure secret handling
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:139:

text

1. --api-key parameter (provided by the user in the conversation)

SKILL.md:169:

text

A: Pass it through the `--api-key` parameter, or set the `GEMINI_API_KEY` environment variable. The script reports an error if neither is available.

SKILL.md:198:

text

- It may also be passed through the `--api-key` parameter

The snippets above are English translations of the original Chinese instructions, preserving their security-relevant meaning.

Technical Analysis

The skill explicitly permits users to provide a Gemini API key in the conversation and allows the agent to pass that secret through the --api-key command-line argument.

Supplying an API key in a conversation can persist the credential in chat transcripts, telemetry, agent traces, or tool-call logs. Passing it as a command-line argument may additionally expose it through process listings, shell history, command auditing, diagnostic output, or execution logs.

This creates a credential-disclosure risk even though the document also recommends environment-variable storage. No executable implementation exists in the audited project, so actual redaction behavior or secure secret handling cannot be verified.

Attack Path

1. The skill asks or permits the user to provide a Gemini API key in the conversation.
2. The conversation platform, agent trace, or associated telemetry records the plaintext credential.
3. Alternatively, the agent inserts the key into a command using --api-key.
4. The command becomes visible in process metadata, shell history, audit records, or tool-execution logs.
5. A party with access to any exposed record obtains the credential.
6. The exposed key is reused to make unauthorized Gemini API requests ...[truncated 575 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions permitting users to submit API keys in conversations.
2. Remove support and documentation for the --api-key command-line option.
3. Require GEMINI_API_KEY to be supplied through a protected runtime environment or platform secret manager.
4. Ensure agent responses, tool calls, exception messages, and diagnostic logs redact credentials.
5. Avoid echoing environment variables or printing complete request headers and configuration objects.
6. Use a dedicated, least-privileged API key restricted to the required API, project, quota, and permitted origin where supported.
7. Add startup validation that reports only whether the secret is configured, never its value.
8. Document immediate key revocation and rotation procedures for suspected disclosure.
9. Once the referenced implementation is added, test it for secret leakage through process listings, shell history, logs, errors, and generated artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill uses overly broad invocation language unrelated to banner generation, including API integration and system-connection scenarios. In a skill with exec/write capability, broad trigger text is dangerous because it can cause the agent to select this skill for unrelated tasks and expose a larger attack surface for file modification, command execution, or unintended external calls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest frames the skill as a banner image generator, but the description also invites use for API integration, webhook configuration, and system connections. This scope expansion can cause the agent to invoke a write/exec-capable skill in contexts far beyond image generation, increasing the chance of unintended command execution or broader system interaction than the user expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description explicitly states '支持中文交互' and the document is written as if Chinese is the required interaction mode, but it does not offer users a language or locale choice. Per policy, forcing or implying a single language without opt-in is a natural-language policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document says the free version is limited to single-image generation/editing, yet later markets bulk processing and multi-interface aggregation efficiency. These contradictory claims can mislead users or orchestrators about what the skill may do, causing over-broad trust and potentially triggering automation patterns inconsistent with the intended safety model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation permits passing API keys via a command-line parameter but does not warn that CLI arguments may be exposed through shell history, process listings, logs, or telemetry. In a tool that encourages exec-based usage, this creates a realistic secret-leak risk if users follow the documented pattern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.