Ernie Image Art Name

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 0.1.1

Overview

The skill does what it claims, but it handles a long-lived Baidu access token in a way users should review carefully before installing.

Install only if you are comfortable giving it a Baidu AI Studio bearer token. Prefer using the AISTUDIO_ACCESS_TOKEN environment variable over --token or --set-token, avoid storing the token in the skill directory, keep generated outputs in a user-controlled folder, and rotate the token if it may have been saved in shell history, logs, or config.json.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_art_name.py:221

Finding

Access Token Exposure Through Command-Line Arguments and Plaintext Configuration Storage

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_art_name.py:93-99, scripts/generate_art_name.py:221-227, and scripts/generate_art_name.py:262-266
Vulnerability Type: Insecure credential handling
Risk Level: Medium

Vulnerable Code

python

def save_config(cfg: dict):
    """保存配置到文件"""
    CONFIG_FILE.parent.mkdir(parents=True, exist_ok=True)
    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
        json.dump(cfg, f, ensure_ascii=False, indent=2)
    print(f"✅ 配置已保存到 {CONFIG_FILE}")

python

parser.add_argument("--token", "-t", type=str, default="",
                    help="星河社区 Access Token（优先于配置文件）")
parser.add_argument("--model", "-m", type=str, default="",
                    choices=["ERNIE-Image", "ERNIE-Image-Turbo", "Stable-Diffusion-XL"],
                    help="使用的模型，默认：ERNIE-Image-Turbo")
parser.add_argument("--set-token", type=str, metavar="TOKEN",
                    help="将 Access Token 保存到配置文件")

python

if args.set_token:
    config["access_token"] = args.set_token
    save_config(config)
    print(f"✅ Access Token 已保存！前8位：{args.set_token[:8]}****")
    return

The insecure command-line usage is also explicitly recommended in SKILL.md:30-36, README.md:20, and references/api_docs.md:120-122:

bash

python3 scripts/generate_art_name.py --set-token YOUR_TOKEN

Technical Analysis

The Skill accepts access tokens through the --token and --set-token command-line arguments. Secrets supplied as command-line arguments can be exposed through shell history, process inspection utilities, terminal logs, automation logs, or monitoring systems that record executed commands.

The --set-token operation then stores the long-lived token as plaintext JSON in config.json. The file is created using the process's default umask, without explicitly enforcing owner-only permissions. Depending on the host configuration, othe ...[truncated 2255 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove token-bearing command-line options, especially --set-token, because command arguments are not an appropriate secret-entry channel.
2. Accept tokens through the AISTUDIO_ACCESS_TOKEN environment variable or prompt interactively with Python's getpass.getpass() so the token is not echoed or placed in shell history.
3. Prefer an operating-system credential store, such as Keychain, Secret Service, or Credential Manager, for persistent storage.
4. If file-based persistence must remain available:
   • Obtain explicit user consent before storing the token.
   • Create the file atomically with owner-only mode 0600.
   • Verify and correct permissions when reading an existing configuration.
   • Refuse to use a configuration file owned by another user or writable by untrusted users.
5. Add config.json to .gitignore and document that it must never be committed, shared, or included in support bundles.
6. Stop printing the token prefix after storage.
7. Update README.md, SKILL.md, and references/api_docs.md to recommend secure interactive or environment-based credential handling instead of command-line token arguments.
8. Advise users who previously used the documented command to remove affected shell-history entries, secure or delete plaintext configuration files, and rotate potentially exposed tokens.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

md

## 🚀 快速上手

### 1. 获取 Access Token

前往 [星河社区个人中心](https://aistudio.baidu.com/account/accessToken) 获取 Token，然后保存：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 83)May include surrounding context.

md

## 🚀 快速上手

### 1. 获取 Access Token

前往 [星河社区个人中心](https://aistudio.baidu.com/account/accessToken) 获取 Token，然后保存：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

## 🚀 快速上手

### 1. 获取 Access Token

前往 [星河社区个人中心](https://aistudio.baidu.com/account/accessToken) 获取 Token，然后保存：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

## 🚀 快速上手

### 1. 获取 Access Token

前往 [星河社区个人中心](https://aistudio.baidu.com/account/accessToken) 获取 Token，然后保存：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_art_name.py (reported line 103)May include surrounding context.

python

## 🚀 快速上手

### 1. 获取 Access Token

前往 [星河社区个人中心](https://aistudio.baidu.com/account/accessToken) 获取 Token，然后保存：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_art_name.py (reported line 222)May include surrounding context.

python

## 🚀 快速上手

### 1. 获取 Access Token

前往 [星河社区个人中心](https://aistudio.baidu.com/account/accessToken) 获取 Token，然后保存：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_art_name.py (reported line 276)May include surrounding context.

python

## 🚀 快速上手

### 1. 获取 Access Token

前往 [星河社区个人中心](https://aistudio.baidu.com/account/accessToken) 获取 Token，然后保存：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Documenting a --token CLI flag encourages passing credentials on the command line, which can expose secrets through shell history, process listings, audit logs, and terminal recordings. In many environments, command-line arguments are less protected than environment variables or dedicated secret stores.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

| `--style` / `-s` | 风格：中国风/烫金/霓虹/卡通/石刻/玫瑰/极简/火焰/冰晶/单线卡通/彩铅卡通/自定义 |
| `--prompt` / `-p` | 自定义描述，配合 `--style 自定义` 使用 |
| `--output` / `-o` | 图片保存目录 |
| `--token` / `-t` | 临时指定 Access Token |
| `--model` / `-m` | 模型选择（默认 ERNIE-Image-Turbo） |
| `--set-token` | 将 Token 保存到配置文件（只需一次） |
| `--list-styles` | 查看所有可用风格 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The sample config includes an access_token field in plaintext, normalizing insecure credential-at-rest storage. Users may copy this template into a real project file and accidentally expose the secret through local compromise, backups, or repository publication.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

json

{
  "access_token": "在这里填写你的 Access Token",
  "model": "ERNIE-Image-Turbo",
  "output_dir": "./art_names"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_docs.md (reported line 20)May include surrounding context.

Authorization: Bearer YOUR_ACCESS_TOKEN

text

**获取 Access Token 地址：** https://aistudio.baidu.com/account/accessToken

## 请求参数

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_docs.md (reported line 143)May include surrounding context.

Authorization: Bearer YOUR_ACCESS_TOKEN

text

**获取 Access Token 地址：** https://aistudio.baidu.com/account/accessToken

## 请求参数

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_art_name.py (reported line 135)May include surrounding context.

python

f'将文字"{name}"设计成艺术字，{style_desc}，'
        f'文字清晰可辨，高分辨率，精细质感，专业设计感，正方形构图'
    )
    return prompt


def generate_image(prompt: str, access_token: str, model: str) -> bytes:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The script supports persisting the access token to a local config.json file in the skill directory, which stores a long-lived secret in plaintext. If the directory is readable by other local users, included in backups, committed accidentally, or exposed through packaging, the token can be stolen and used to access the API under the victim's account.

Content

Scanner excerpt · scripts/generate_art_name.py (reported line 227)May include surrounding context.

python

choices=["ERNIE-Image", "ERNIE-Image-Turbo", "Stable-Diffusion-XL"],
                        help="使用的模型，默认：ERNIE-Image-Turbo")
    parser.add_argument("--set-token", type=str, metavar="TOKEN",
                        help="将 Access Token 保存到配置文件")
    parser.add_argument("--list-styles", action="store_true",
                        help="列出所有可用风格")
    parser.add_argument("--show-config", action="store_true",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This code writes the provided access token into config.json and confirms storage, meaning the secret is intentionally persisted on disk in plaintext. In the context of a user-facing skill, this increases the chance of credential leakage through local file disclosure, workspace sharing, backups, or accidental repository inclusion.

Content

Scanner excerpt · scripts/generate_art_name.py (reported line 265)May include surrounding context.

python

if args.set_token:
        config["access_token"] = args.set_token
        save_config(config)
        print(f"✅ Access Token 已保存！前8位：{args.set_token[:8]}****")
        return

    # ── 参数校验 ──────────────────────────────────────────────

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly documents --set-token storing an API access token permanently in a local config.json, but it does not warn users about the security implications of storing bearer credentials on disk. This can lead to accidental exposure through weak file permissions, backups, screen sharing, repository commits, or multi-user systems, enabling unauthorized API use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents capabilities that access environment variables, read/write local files, and call an external network API, but it does not declare any explicit tool scope or permission boundaries. This increases the chance of over-broad execution in an agent framework and reduces visibility into what resources the skill is expected to touch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger description is broad enough to match general image-generation or text-to-image requests, which may cause this skill to activate when a more generic or safer skill should handle the task. Overbroad invocation can expose credentials, file writes, or network actions in situations where the user did not specifically intend to use this integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to persist an access token to a local config file without warning that this creates a credential at rest on disk. Storing tokens in plaintext can lead to accidental disclosure through backups, logs, shared directories, or source-control commits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring, usage instructions, argument descriptions, and runtime messages are all presented only in Chinese, with no option to select another language. This creates a locale/language policy issue because the skill imposes one language on all users rather than offering a choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill states that generated images are saved locally but does not clearly warn that files will be created on disk, potentially in a default relative directory. This can surprise users, create clutter, or place outputs in locations that are synchronized, shared, or privacy-sensitive.

Content

No source excerpt is available for this finding.