ClawHub
Back to skill

Security audit

apiyi-gpt-image-2-gen(基于API易代理站)-官转版

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its command templates and credential handling create review-worthy risks before installation.

Install only if you are comfortable sending prompts and uploaded images to api.apiyi.com and paying for those API calls. Prefer APIYI_API_KEY over --api-key, avoid prompts or filenames containing shell metacharacters, and use an agent/runtime that passes arguments as an array rather than rendering the documented shell templates directly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:17
Finding

Shell Command Injection Through Raw Prompt Interpolation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:85
Finding

API Credential Exposure Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/generate_image.py:49
Finding

Unpinned Third-Party Dependency Installation Guidance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)

Tainted flow: 'headers' from os.environ.get (line 185, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_image.py (reported line 240)May include surrounding context.

python
print('image generation in progress...')

        try:
            response = requests.post(url, headers=headers, files=files_list, timeout=DEFAULT_TIMEOUT)
            response.raise_for_status()
            data = response.json()
        except requests.exceptions.Timeout:

Tainted flow: 'headers' from os.environ.get (line 185, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_image.py (reported line 287)May include surrounding context.

python
print('image generation in progress...')

        try:
            response = requests.post(url, headers=headers, json=payload, timeout=DEFAULT_TIMEOUT)
            response.raise_for_status()
            data = response.json()
        except requests.exceptions.Timeout:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
- **优先尝试 Node.js 版本**：如果环境有 Node（`node` 命令可用），优先使用 `scripts/generate_image.js`（零依赖，参数与 Python 保持一致）。

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents capabilities that read environment variables, write files, and send data over the network, but it does not declare any tool scope or permission boundaries. That increases the risk of over-broad execution, accidental data access, and makes review/enforcement harder because consumers cannot tell up front what powers the skill requires.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: apiyi-gpt-image-2-gen
description: 图片生成技能，当用户需要生成图片、视觉信息图、创建图像、编辑/修改/调整已有图片时使用此技能。基于API易平台(https://api.apiyi.com/)的ChatGPT Image 2模型（gpt-image-2）的官方正式版图片生成服务。该模型支持精确的尺寸/画质控制（含4K），按token计费。与gpt-image-2-all（官逆版）不同的关键点：使用/v1/images/generations和/v1/images/edits端点；有显式size参数；有quality参数；按token计费；使用multipart/form-data上传参考图；b64_json为纯base64无前缀。
---

# 图片生成与编辑（GPT Image 2 官方正式版）

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is triggered by broad natural-language conditions such as requests to generate or edit images, which can overlap with ordinary conversation. In agent environments this can cause unintended invocation, leading to unexpected network calls, file writes, billing, or external transmission of user content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explains that prompts and reference images are sent to a remote API, but it does not clearly warn users about data egress or privacy implications. Because image-editing inputs may contain personal, confidential, or copyrighted material, silent transmission to a third party can create privacy and compliance risks.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to pass the user's full original input directly into command arguments and preserve all text verbatim. This increases the chance that sensitive personal data, secrets, or unrelated user content will be forwarded to external services and may also end up in local shell history, logs, or telemetry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation recommends passing the API key on the command line without warning that command-line arguments may be exposed through shell history, process listings, logs, or monitoring tools. This can leak long-lived credentials to other local users or operational systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This code transmits prompts and uploaded image content to an external domain, which is expected for an image-generation skill but still expands the trust boundary to a third-party proxy service. The risk is elevated by the nature of the data handled—free-form text and user-supplied images may contain personal, proprietary, or regulated information.

Content

Scanner excerpt · scripts/generate_image.js (reported line 535)May include surrounding context.

js
});
    }

    const url = 'https://api.apiyi.com/v1/images/edits';

    process.stdout.write('🎨 图片生成已启动！\n');
    process.stdout.write(`⏱️ 预计时间: 约120-150秒，请耐心等待\n`);

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends user prompts and, in edit mode, local image files to a third-party service at api.apiyi.com, but it does not provide an explicit privacy notice or consent step at the time of transmission. In a skill context, users may supply sensitive images or confidential prompt content, so silent external transfer creates a meaningful confidentiality and compliance risk even though the transmission is part of the core feature.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The generation path also sends user prompts to the third-party API endpoint, creating the same external transmission risk even when no input image is provided. While this is core functionality rather than overtly malicious behavior, lack of explicit disclosure and reliance on a proxy service can expose sensitive prompt content and create privacy/compliance issues.

Content

Scanner excerpt · scripts/generate_image.js (reported line 589)May include surrounding context.

js
if (args.outputFormat != null) payload.output_format = args.outputFormat;
    if (args.outputCompression != null) payload.output_compression = parseInt(args.outputCompression);

    const url = 'https://api.apiyi.com/v1/images/generations';

    process.stdout.write('🎨 图片生成已启动！\n');
    process.stdout.write(`⏱️ 预计时间: 约120-150秒，请耐心等待\n`);

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Natural-language policy issues apply to all file types, including code docstrings and help text. Here, the main documentation, examples, and argument descriptions are presented exclusively in Chinese, with no indication that the tool is region-specific or that other language options are available.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

In edit/multi-image mode, the script uploads local image files to a third-party endpoint. Because images may contain sensitive visual content or embedded metadata, this external transmission is more dangerous in skill context than ordinary API usage; it can leak private or proprietary data outside the host environment.

Content

Scanner excerpt · scripts/generate_image.py (reported line 204)May include surrounding context.

python
mode_str = '编辑图片' if len(args.input_image) == 1 else '多图融合'

        url = 'https://api.apiyi.com/v1/images/edits'

        files_list = [
            ('model', (None, 'gpt-image-2')),

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

The hardcoded third-party generation endpoint indicates dependence on an external service for prompt processing and image return. While not malicious, this creates a real outbound data-transfer surface that can expose user content and operational metadata to an external processor.

Content

Scanner excerpt · scripts/generate_image.py (reported line 258)May include surrounding context.

python
print(f'错误: 请求失败 - {e}', file=sys.stderr)
            sys.exit(1)
    else:
        url = 'https://api.apiyi.com/v1/images/generations'

        payload = {
            'model': 'gpt-image-2',

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The script transmits user prompts to an external third-party service over the network. In the context of an agent skill, users may unknowingly send sensitive business data or personal information off-platform, creating privacy, compliance, and data-governance risk even though the transmission is intentional.

Content

Scanner excerpt · scripts/generate_image.py (reported line 287)May include surrounding context.

python
print('image generation in progress...')

        try:
            response = requests.post(url, headers=headers, json=payload, timeout=DEFAULT_TIMEOUT)
            response.raise_for_status()
            data = response.json()
        except requests.exceptions.Timeout:

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The documentation says an API key can be supplied via a command-line flag, but the documented interface does not define that option consistently. This mismatch can cause users to fall back to unsafe trial-and-error handling of credentials or misunderstand how secrets are passed to the script.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Natural-language instructions, parameter descriptions, and usage examples are presented only in Chinese. Under the stated policy, forcing a specific language without opt-in or a documented region-specific justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.