T08 · Insecure Dependencies
Warning
- Location
SKILL.md:15- Finding
Unpinned dependencies installed into the system Python environment
- Content
View full analysis
- Remediation
View remediation
Security audit
免费图片解决方案
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly an image workflow, but it makes misleading free-cost claims, encourages watermark removal, and can spend API quota without enforcing its stated zero-cost limit.
Install only if you are comfortable reviewing the scripts first, using an isolated virtual environment, setting hard provider-side spending limits, and limiting watermark removal to images you own or are explicitly allowed to modify.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/main.py:27- Finding
OpenAI API key prefix is exposed in console and retained logs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ai_generator.py:24- Finding
Configured zero-cost limit is not enforced before billable OpenAI requests
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ai_generator.py:47- Finding
Generated image URL is downloaded without network or size safety controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (50)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A skill presented as an image solution but apparently performing marketplace publication/verification, CLI installation, test execution, and temporary-directory filesystem operations is a severe description-behavior mismatch. When a skill induces users to install or run tooling unrelated to its stated purpose, it can conceal supply-chain, filesystem, or command-execution risks behind a harmless-looking description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill presented as an image solution but apparently performing marketplace publication/verification, CLI installation, test execution, and temporary-directory filesystem operations is a severe description-behavior mismatch. When a skill induces users to install or run tooling unrelated to its stated purpose, it can conceal supply-chain, filesystem, or command-execution risks behind a harmless-looking description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill presented as an image solution but apparently performing marketplace publication/verification, CLI installation, test execution, and temporary-directory filesystem operations is a severe description-behavior mismatch. When a skill induces users to install or run tooling unrelated to its stated purpose, it can conceal supply-chain, filesystem, or command-execution risks behind a harmless-looking description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A skill presented as an image solution but apparently performing marketplace publication/verification, CLI installation, test execution, and temporary-directory filesystem operations is a severe description-behavior mismatch. When a skill induces users to install or run tooling unrelated to its stated purpose, it can conceal supply-chain, filesystem, or command-execution risks behind a harmless-looking description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill presented as an image solution but apparently performing marketplace publication/verification, CLI installation, test execution, and temporary-directory filesystem operations is a severe description-behavior mismatch. When a skill induces users to install or run tooling unrelated to its stated purpose, it can conceal supply-chain, filesystem, or command-execution risks behind a harmless-looking description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill presented as an image solution but apparently performing marketplace publication/verification, CLI installation, test execution, and temporary-directory filesystem operations is a severe description-behavior mismatch. When a skill induces users to install or run tooling unrelated to its stated purpose, it can conceal supply-chain, filesystem, or command-execution risks behind a harmless-looking description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill presented as an image solution but apparently performing marketplace publication/verification, CLI installation, test execution, and temporary-directory filesystem operations is a severe description-behavior mismatch. When a skill induces users to install or run tooling unrelated to its stated purpose, it can conceal supply-chain, filesystem, or command-execution risks behind a harmless-looking description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill presented as an image solution but apparently performing marketplace publication/verification, CLI installation, test execution, and temporary-directory filesystem operations is a severe description-behavior mismatch. When a skill induces users to install or run tooling unrelated to its stated purpose, it can conceal supply-chain, filesystem, or command-execution risks behind a harmless-looking description.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The configuration explicitly enables automatic watermark removal, and the skill description reinforces that behavior as a built-in feature. This is dangerous because it facilitates removal of ownership or licensing markers from third-party images at scale, which can enable copyright infringement, terms-of-service violations, and misuse of protected content without user review or authorization checks.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest promises using OpenAI free credits for important images, free stock libraries for others, and automatic watermark removal. This file implements a standalone local batch processor for resizing, converting, and optimizing images, with no logic for image sourcing or watermark removal, so the implemented behavior materially diverges from the claimed scope.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares shell, network, filesystem, and environment-variable dependent behavior but provides no explicit tool scope or permission boundaries. In an agent ecosystem, this increases the chance of over-privileged execution, unintended command use, and unsafe access to secrets or local files.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description frames the skill as a 'free image solution' that uses OpenAI free quota for important images and free stock sources for others. However, the documentation clearly describes OpenAI image generation workflows with explicit dollar budgets and quota consumption, which is broader than a simple free-library solution and depends on an external paid-capable API rather than only free resources.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description mentions free-image sourcing and automatic watermark removal, but the file's declared capabilities extend further into full image-processing workflows such as bulk optimization, resizing, quality adjustment, and format conversion. Those processing features materially expand the skill from image acquisition into a general-purpose image manipulation pipeline.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s user-facing description, headings, instructions, and examples are presented exclusively in Chinese, including the manifest description and operational guidance. This can violate a language/locale policy when a skill forces a specific language without giving users an explicit choice or documenting a justified locale restriction.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation repeatedly claims zero-cost use while instructing users to configure an OpenAI API key and consume quota/budget. Misrepresenting cost and external service dependence can trick users into exposing credentials, incurring charges, or violating internal approval rules for paid APIs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The JSON descriptions for all listed sources are written exclusively in Chinese, which imposes a specific language/locale in user-facing metadata without any indication that the skill is region-specific or that users can choose another language. The policy explicitly flags language or locale constraints when they are forced without opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly instructs users to run a watermark removal tool on downloaded images without any warning about copyright, licensing, attribution, or authorization requirements. In the context of an image acquisition skill, this normalizes potentially unlawful removal of ownership or licensing markers and can facilitate misuse of third-party content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The complete workflow embeds watermark removal as a routine processing step, which makes the risky behavior appear endorsed and standard rather than exceptional. Because the skill is marketed as a low-cost/free image solution, this increases the chance that users will use it to strip attribution or ownership marks from third-party images at scale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow explicitly encourages downloading images that are watermarked or have removable watermarks and then removing those marks without any licensing or authorization checks. This facilitates copyright circumvention and misuse of protected media, increasing legal and policy risk for users and downstream systems.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example normalizes watermark removal as a routine post-processing step, which can enable unauthorized modification of copyrighted or restricted images. In a skill marketed as a 'free image solution,' this context makes the guidance more dangerous because it directly incentivizes bypassing payment, attribution, or licensing controls.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata advertises '自动去水印' (automatic watermark removal), but the project documentation only describes AI generation, stock image sourcing, and generic processing. This mismatch is risky because it suggests undisclosed or unsupported functionality tied to removing watermarks, which is commonly associated with bypassing licensing or copyright restrictions and may mislead users about the tool’s capabilities and legality.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation instructs users to source a local shell file containing the OpenAI API key but does not warn that this file contains sensitive credentials or advise on secure handling. This increases the chance of accidental exposure through unsafe file permissions, shell history, backups, screenshots, or repository inclusion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow tells users to generate images from supplied text via OpenAI but does not disclose that prompts and related content will be transmitted over the network to a third-party service. This is a privacy and data-governance issue because users may unknowingly submit sensitive, proprietary, or regulated text to an external provider.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says the skill uses OpenAI free credits for important images, uses free image libraries for others, and automatically removes watermarks. In this file, the implemented behavior is limited to calling OpenAI image generation, downloading the generated images, and writing them to disk; there is no stock-library selection logic or watermark-removal behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script performs billable API actions, fetches remote URLs, and writes files automatically without explicit user confirmation. In a skill context, this is risky because a caller may trigger unintended spending and side effects simply by invoking the tool, and the manifest context promising a broader automated image workflow makes such silent execution more concerning.
- Content
Static analysis
No suspicious patterns detected.