ClawHub
Back to skill

Security audit

Kling Image Generate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Kling AI image-generation integration that sends user-selected prompts and images to Kling's API using locally supplied API keys.

Install only if you intend to use Kling's cloud API. Keep the Kling access and secret keys out of shared shells, logs, and source control, and avoid sending sensitive prompts, private images, internal callback URLs, or regulated data unless Kling is approved for that use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (37)

Tainted flow: 'url' from os.environ.get (line 151, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/expand_image.py (reported line 126)May include surrounding context.

python
url = f"{API_BASE}/v1/images/editing/expand"
    
    try:
        response = requests.post(url, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'url' from os.environ.get (line 151, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/expand_image.py (reported line 156)May include surrounding context.

python
url = f"{API_BASE}/v1/images/editing/expand/{external_task_id}?external_task_id=true"
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'url' from os.environ.get (line 131, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_image.py (reported line 106)May include surrounding context.

python
url = f"{API_BASE}/v1/images/generations"
    
    try:
        response = requests.post(url, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'url' from os.environ.get (line 131, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_image.py (reported line 136)May include surrounding context.

python
url = f"{API_BASE}/v1/images/generations/{external_task_id}?external_task_id=true"
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'url' from os.environ.get (line 137, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_image_with_progress.py (reported line 117)May include surrounding context.

python
url = f"{API_BASE}/v1/images/generations"
    
    try:
        response = requests.post(url, headers=headers, json=data, timeout=60)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'url' from os.environ.get (line 137, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_image_with_progress.py (reported line 142)May include surrounding context.

python
url = f"{API_BASE}/v1/images/generations/{external_task_id}?external_task_id=true"
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'url' from os.environ.get (line 127, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_omni_image.py (reported line 102)May include surrounding context.

python
url = f"{API_BASE}/v1/images/omni-image"
    
    try:
        response = requests.post(url, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'url' from os.environ.get (line 127, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_omni_image.py (reported line 132)May include surrounding context.

python
url = f"{API_BASE}/v1/images/omni-image/{external_task_id}?external_task_id=true"
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

整体上，这段代码确实是可灵图像生成工具，并且鉴权方式与环境变量声明一致，主用途与“AI图像生成”大体匹配。但声明列出的功能范围明显大于代码实际实现：代码仅调用单一的 images/generations 接口，未看到多图参考、Omni、扩图等专门能力的实现痕迹，也没有对应参数结构。相反，代码提供了任务查询与轮询完成这样的附加能力。由于声明中的若干核心功能并未在代码中得到体现，描述不能算准确对应实际行为，因此应判定为存在不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明描述强调该技能可用于生成AI图像、图片编辑和图像扩展等创作类任务；但提供的代码片段没有提交任何生成请求、上传图片、编辑图片或扩图参数处理逻辑。它的核心行为是根据 api_type 映射到不同的任务查询端点，发送 GET 请求获取任务列表。因此，代码的实际主要用途是“列出/查询已有任务”，而不是声明中的“生成/编辑图像”。鉴权方式与服务对象（可灵API、环境变量密钥）是一致的，但主能力存在明显不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares use of environment variables and outbound network access to an external API, but does not specify any explicit tool scope or permission boundaries. In an agent setting, this can cause overbroad execution authority, making it easier for the skill to access secrets and perform remote requests without clear operator review or runtime restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file documents callback_url as a feature and elsewhere accepts images via URL or Base64, but it does not include any warning that using these fields may send user images or task metadata to external endpoints. For markdown files, omissions around privacy- or system-affecting behavior should be flagged when the skill description lacks user warnings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Natural-language descriptions and user-facing help in this file are presented in Chinese, with no indication that the language is optional or region-specific. Under the stated policy, forcing a specific language without opt-in is a locale-policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends the user-provided image, prompt, and optional callback metadata to a third-party remote API, but it does not clearly warn the operator at runtime that local or sensitive content will leave the system. In a skill context, users may assume a local image-processing utility, so this can cause unintended disclosure of proprietary, personal, or regulated data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The code intentionally performs external transmission of user-supplied image content and prompts to a remote API endpoint. While this is core functionality rather than malicious behavior, it is security-relevant because it can expose sensitive data outside the local environment if users are not fully aware of the network transfer.

Content

Scanner excerpt · scripts/expand_image.py (reported line 126)May include surrounding context.

python
url = f"{API_BASE}/v1/images/editing/expand"
    
    try:
        response = requests.post(url, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script sends user prompts and optional image content to a third-party API, but the CLI interface does not prominently warn users that their inputs may leave the local environment. In an agent-skill context, this matters because prompts, reference images, and callback metadata may contain sensitive or proprietary information that users do not realize is being transmitted off-platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This code intentionally performs external transmission of user-supplied prompts and optional image data to a remote AI provider. In the context of an agent skill, that can expose sensitive text, images, or identifiers to a third party, especially if the caller assumes processing is local or does not understand the privacy implications.

Content

Scanner excerpt · scripts/generate_image.py (reported line 106)May include surrounding context.

python
url = f"{API_BASE}/v1/images/generations"
    
    try:
        response = requests.post(url, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Help text, status messages, and docstrings are written entirely in Chinese, which constitutes a language/locale constraint in natural-language behavior. There is no opt-in, fallback, or explanation that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The script transmits user-supplied content to an external service, including prompts, optional images, and possibly callback metadata. In this skill's context, such transmission is expected, but it still carries privacy and data-governance risk if users are unaware that sensitive material leaves the local environment.

Content

Scanner excerpt · scripts/generate_image_with_progress.py (reported line 117)May include surrounding context.

python
url = f"{API_BASE}/v1/images/generations"
    
    try:
        response = requests.post(url, headers=headers, json=data, timeout=60)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends prompts, optional source images, and user-supplied callback URLs to a third-party cloud API without an explicit disclosure at runtime about off-box data transmission. In a skill context, users may provide sensitive images or confidential prompts, so lack of notice can cause unintentional data exposure to the external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_omni_image.py (reported line 102)May include surrounding context.

python
url = f"{API_BASE}/v1/images/omni-image"
    
    try:
        response = requests.post(url, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends prompts, image URLs, optional callback_url, and external_task_id to a third-party service, which can disclose potentially sensitive user content or internal metadata. In a skill context, users may not realize their text and referenced images are leaving the local environment, especially when callback URLs can also expose internal endpoints or workflow identifiers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring presents the skill description exclusively in Chinese. The policy requires avoiding forced language/locale constraints unless the skill offers user choice or clearly documents that it is region- or locale-specific, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The argparse description, help strings, and error message are all user-facing text in Chinese only. There is no indication that the skill is intentionally limited to a Chinese locale or that users can choose another language, which violates the language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code includes all user-facing natural-language strings in Chinese, including the module description, CLI description, help text, and error messages. The file does not offer an opt-in language choice or indicate that the skill is intentionally limited to Chinese-speaking users, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.