Jimeng Ai

• Outcome: Review
• Latest audit: Jul 4, 2026 · 10:44 PM UTC
• Version: 1.0.0

Overview

The skill’s image-generation purpose is plausible, but it handles Jimeng session cookies and account-related actions too broadly for a simple image tool.

Review before installing. Use only with a Jimeng account/session you control, replace or remove the bundled sessionid, protect config.json and logs, avoid shared machines, bind the service to localhost, restrict CORS, and update dependencies. Treat this as a sensitive account-automation wrapper rather than a simple image generator.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with open(PID_FILE, 'r') as f:
            pid = f.read().strip()
        try:
            subprocess.run(['kill', pid], check=False)
            PID_FILE.unlink()
            print(f"✅ 服务已停止 (PID: {pid})")
        except Exception as e:

• Confidence: 88% confidence
• Finding: The script reads a PID from a writable file and passes it to kill without validating that it is numeric, current, and belongs to the expected child process. An attacker who can modify .service.pid could cause termination of an unintended local process, creating a denial-of-service condition.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities requiring network access, local file reads/writes, environment access, and service control, yet no declared permissions are present. This creates a transparency and policy-enforcement gap: users and orchestrators cannot accurately assess or constrain what the skill can do before activation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is narrowly framed as image generation, but the analyzed behavior includes broader API exposure, token/account inspection, credit-claiming actions, and local service lifecycle management. This mismatch is dangerous because it can mislead users into granting trust to a skill that performs materially broader and more sensitive actions than advertised.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill includes a function to automatically claim daily account credits, which goes beyond the core user-requested image generation capability and performs account-side actions on behalf of the user. This can consume or alter the state of a shared official membership account without explicit authorization, creating abuse, policy, and account-management risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This file exposes standalone token-validation and credit-check endpoints that operate on account tokens directly, which goes beyond the stated image-generation functionality of the skill. These endpoints can be used to verify whether stolen tokens are live and to enumerate account balances, turning the service into a credential-testing and account-reconnaissance utility.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The server enables CORS globally with default permissive settings, allowing arbitrary web origins to issue browser-based requests to this service. For a skill that exposes image-generation functionality backed by an official member account and session automation, this broad cross-origin access can let untrusted websites drive the API from a victim's browser and increase abuse risk, especially if any credentials, tokens, or privileged actions are reachable through the service.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The utility exposes local IPv4 and MAC address enumeration, which collects host-identifying information unrelated to the advertised image-generation purpose. In an agent skill context, such functions can enable device fingerprinting, environment reconnaissance, or silent exfiltration if used elsewhere, increasing privacy and operational risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README explicitly instructs users to place a live `sessionid` in `start.sh` and export it as an authorization value, but provides no warning about credential sensitivity, storage risks, rotation, or leakage through shell history, logs, or source control. In a skill that wraps an unofficial API and uses an official member account, this increases the chance of account takeover or abuse if the token is exposed.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger description is broad enough to overlap with common conversation about images, drawing, or AI art, which raises the risk of unintended invocation. In a skill that can access credentials, start local services, use the network, and write files, accidental activation materially increases exposure and may cause unreviewed actions to occur.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill auto-saves generated images to a default local directory, but the documentation does not prominently warn users about persistent local writes. Silent or under-disclosed file creation can expose sensitive prompts, consume storage, and create privacy issues on shared systems or managed workspaces.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to extract a browser sessionid and store it in a local config file without clear warnings about the credential's sensitivity. A session cookie can function as an authentication bearer token; mishandling it can enable account takeover, unauthorized billing/credit use, and exposure of account data if the file or logs are accessed by other processes or users.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The session ID is persisted to config.json on disk and partially echoed to the console without any protection or warning. If the config file or logs are readable by other local users, the credential can be stolen and reused to access the linked account or service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The controller logs the full `messages` array, which can include sensitive user prompts, image descriptions, personal data, or secrets supplied by upstream workflows. Because this skill is explicitly designed for workflow integration and image generation requests, prompt content may be high-sensitivity and storing it in logs increases exposure to operators, log aggregation systems, and secondary breaches.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The streaming path repeats the same issue by logging the full `messages` payload before generation begins. This creates persistent disclosure risk across both normal and streaming code paths, making accidental collection of sensitive prompts systemic rather than isolated.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function forwards the user-supplied prompt and the refresh token to an external image-generation service. This is expected for the feature, but it still creates a real privacy and credential-exposure risk because sensitive user input and an account-authentication token leave the local trust boundary and could be mishandled, logged, or abused if the upstream service or request stack is compromised.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The /points route accepts tokens from the Authorization header, splits multiple tokens, queries each token's credit, and returns both the token value and associated points in the response. This handles highly sensitive credentials in a way that increases exposure through application responses, logs, intermediaries, and downstream consumers, and it facilitates bulk checking of possibly unauthorized tokens.

Known Vulnerable Dependency: axios==1.6.7 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The manifest explicitly permits axios 1.6.7, which is flagged with multiple advisories including SSRF-related and prototype-pollution-related issues. In a skill that appears to broker image-generation requests and likely performs outbound HTTP calls, a vulnerable HTTP client can materially increase risk of request smuggling, SSRF bypasses, credential leakage, or response tampering depending on how it is used.

Known Vulnerable Dependency: form-data==4.0.0 — 2 advisory(ies): CVE-2025-7783 (form-data uses unsafe random function in form-data for choosing boundary); CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: form-data 4.0.0 is flagged for unsafe randomness in multipart boundary generation and CRLF injection via unescaped multipart field names and filenames. For a skill that uploads images or forwards user-supplied prompts/files to an external AI service, malformed multipart construction could enable request manipulation, boundary prediction, header injection, or downstream parser confusion.

Known Vulnerable Dependency: koa==2.15.0 — 4 advisory(ies): CVE-2025-25200 (Inefficient Regular Expression Complexity in koa); CVE-2026-27959 (Koa has Host Header Injection via ctx.hostname); CVE-2025-8129 (Koa Open Redirect via Referrer Header (User-Controlled)) +1 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: koa 2.15.0 is reported with multiple server-side advisories including host header injection, open redirect, and regex complexity issues. This skill is described as an API/server component with workflow integration and automatic downloading, so a vulnerable web framework materially increases the attack surface for request routing abuse, header manipulation, denial of service, or redirect-based exploitation.

Known Vulnerable Dependency: lodash==4.17.21 — 3 advisory(ies): CVE-2026-2950 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2026-4800 (lodash vulnerable to Code Injection via `_.template` imports key names); CVE-2025-13465 (Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: lodash 4.17.21 is flagged for prototype pollution and template/code-injection style issues. Whether exploitable depends on actual usage, but this package is commonly used for deep object manipulation, and in an API that processes user-controlled workflow data, polluted objects can alter application logic, poison configuration, or create gadget chains that lead to more serious compromise.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 63% confidence
• Finding: uuid 9.0.1 is flagged for a missing buffer bounds check in certain version-generation functions when a caller supplies a buffer. This is likely only exploitable if the code uses the affected APIs with attacker-influenced buffer arguments, which is not evident from package.json alone, so the practical risk here appears limited.

Known Vulnerable Dependency: yaml==2.3.4 — 1 advisory(ies): CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections)

Low

• Category: Supply Chain
• Confidence: 62% confidence
• Finding: yaml 2.3.4 is flagged for stack overflow via deeply nested YAML collections. Exploitability depends on whether this skill parses untrusted YAML from users, workflow definitions, or remote sources; if it does, an attacker could trigger denial of service by supplying maliciously nested documents.

Static analysis

No suspicious patterns detected.