ClawHub
Back to skill

Security audit

Xiaohongshu Image Gen

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill mostly does what it says, but it includes unrelated financial API code and an unsafe dependency file, so it should be reviewed before installation.

Review before installing. Use a virtual environment, avoid pip installing the supplied requirements.txt unless the external package provenance is verified, do not run artifact/scripts/api_client.py unless you intentionally want Tushare financial API access, and do not print API keys while troubleshooting. Treat prompts sent through OpenAI or Stability AI modes as data shared with those providers; use --use-local for local fallback when sensitive prompt content is involved.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/api_client.py:30
Finding

Undisclosed Financial API Client Accesses an Unrelated Credential and External Service

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
requirements.txt:1
Finding

Self-Referential External Package Creates an Unsafe Supply-Chain Installation Path

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:197
Finding

Troubleshooting Documentation Instructs Users to Print the Full OpenAI API Key

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (18)

Tainted flow: 'image_url' from os.getenv (line 119, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · source/xiaohongshu_image_gen.py (reported line 123)May include surrounding context.

python
# 下载图片
    import requests
    img_response = requests.get(image_url)
    with open(output_path, "wb") as f:
        f.write(img_response.content)

Tainted flow: 'headers' from os.getenv (line 144, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · source/xiaohongshu_image_gen.py (reported line 158)May include surrounding context.

python
"samples": 1
    }

    response = requests.post(url, headers=headers, json=body)

    if response.status_code != 200:
        raise Exception(f"Stability AI 错误: {response.text}")

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · source/xiaohongshu_image_gen.py (reported line 94)May include surrounding context.

python
prompt = f"{prefix}，{style_name}风格，{user_prompt}，{suffix}"

    return prompt


def generate_with_openai(prompt, output_path, aspect_ratio):

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file presents all user-facing instructions and examples exclusively in Chinese. That can violate a language/locale policy when the skill forces a specific language experience without offering the user an explicit language choice or documenting the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The entire README is written in Chinese and the skill is tailored to '小红书' content generation, but it does not explicitly state that the skill is region/language-specific or offer users a language option. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language instructions and usage guidance are entirely in Chinese, and the file does not indicate that this language restriction is optional or tied to a justified region-specific requirement. Under the stated policy, forcing a specific language without user opt-in is a locale-policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The usage and feature description promotes third-party image generation services but does not clearly warn users that their prompts may be sent to external providers. Users may unknowingly include confidential business, personal, or proprietary content in prompts, leading to unintended disclosure to cloud vendors.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The security section claims that all generation happens locally and that user images are not uploaded, but earlier sections explicitly state the skill can send prompts to OpenAI and Stability AI cloud APIs. This creates a misleading privacy and data-flow representation that may cause users to submit sensitive prompts under false assumptions about local-only processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's user-facing comments and output strings are exclusively in Chinese, including errors and usage guidance. This can violate a language/locale policy when the skill forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file's natural-language documentation and operational messages are exclusively in Chinese, including the module docstring and later user-facing error/log text. Under the policy for natural-language violations, forcing a specific language without opt-in is reportable when no alternative language choice or locale justification is provided.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest description uses broad promotional phrasing such as 'AI一键生成' and '立即体验' but does not define any specific activation phrases, scope limits, or exclusion conditions. In a manifest file, this kind of generic capability description can make it unclear when the skill should be invoked versus other general image-generation tools.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · source/xiaohongshu_image_gen.py (reported line 142)May include surrounding context.

python
else:  # 9:16
        width, height = 720, 1280

    url = "https://api.stability.ai/v1/generation/stable-diffusion-xl-1024-v1-0/text-to-image"

    headers = {
        "Authorization": f"Bearer {os.getenv('STABILITY_API_KEY')}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · source/xiaohongshu_image_gen.py (reported line 158)May include surrounding context.

python
"samples": 1
    }

    response = requests.post(url, headers=headers, json=body)

    if response.status_code != 200:
        raise Exception(f"Stability AI 错误: {response.text}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · source/xiaohongshu_image_gen.py (reported line 191)May include surrounding context.

python
# 调用脚本
    try:
        result = subprocess.run(
            [sys.executable, str(script_path), prompt, "-o", output_path],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI help explicitly requires the prompt to be in Chinese via the string '图片描述（中文）', and the surrounding descriptions/comments indicate the skill is designed around Chinese-only usage. This is a natural-language locale constraint presented without offering the user a language choice or documenting a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file documents OpenAI DALL-E 3 and Stability AI as primary generation methods, which implies sending user prompts to third-party services. The README provides setup details and recommendations but does not warn users that their prompt content may be transmitted off-device to external providers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says the tool is focused on '家装/美食/穿搭 3 大热门赛道' and '3个赛道任选', but elsewhere on the same line it advertises '家装、美食、穿搭、旅行 4大热门赛道'. This is a direct contradiction in the skill's own documentation about the scope of supported categories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language description is entirely Chinese and tightly framed around Xiaohongshu-specific usage, but it does not state whether this locale/language targeting is intentional or whether users can opt into another language. This may violate language/locale policy expectations when a skill is exposed in broader multilingual environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.