ClawHub
Back to skill

Security audit

Seedream 5.0 — AI Image Generation & Editing by ByteDance

Security checks for vulnerabilities and agentic risk

Overview

This image skill is purpose-adjacent but should go to Review because its broad activation, generic model control, paid external API use, and unrestricted local-file upload are not tightly scoped.

Install only if you intentionally want Atlas Cloud handling your image prompts and photos and understand API usage may bill your account. Avoid using it with confidential prompts, private images, or arbitrary local paths unless you have reviewed the exact file and destination; prefer sandboxed output directories and explicit user confirmation for uploads, batch edits, and non-Seedream model choices.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:184
Finding

Unrestricted Local File Upload to External Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:162
Finding

Unvalidated API-Controlled Output URL Download

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The documented behavior materially overstates and misstates what the skill actually does, including claimed Seedream-specific constraints while apparently permitting arbitrary model selection, uploads, and other undeclared behavior. Security-relevant mismatches like these are dangerous because operators and users may trust the skill with data under false assumptions about destination, scope, pricing, model restrictions, and processing behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is extremely broad and is designed to activate for a wide range of common creative or marketing requests, not just explicit Seedream use. In a skill that sends prompts and image URLs to an external paid API using a bearer key, overbroad invocation increases the risk of accidental activation, unnecessary disclosure of user content to a third party, and unintended billing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares access to an API key and documents network calls, but does not define an explicit tool scope such as permissions or allowed-tools. That creates an authorization/containment gap where a skill that can send prompts, image URLs, and bearer-authenticated requests externally is not constrained by least-privilege policy, increasing the chance of unintended data exfiltration or misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This skill explicitly transmits user prompts and authenticated requests to an external service, and the surrounding documentation states that image URLs may also be sent. External transmission is expected for this type of skill, but it is still security-relevant because sensitive prompts, private image references, and account-linked API usage leave the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This skill explicitly transmits user prompts and authenticated requests to an external service, and the surrounding documentation states that image URLs may also be sent. External transmission is expected for this type of skill, but it is still security-relevant because sensitive prompts, private image references, and account-linked API usage leave the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The image-editing example sends image references to a third-party API, which is more sensitive than text-only generation because source images may contain personal, proprietary, or confidential content. In this skill context, editing user-supplied photos materially increases privacy and data-governance risk, especially because uploads/local image handling are also described elsewhere.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

Image Editing Example (v5.0 Lite)

bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Batch sequential editing combines two risk amplifiers: transmission of user images to a third party and the ability to process multiple images in one request. That raises the potential volume of sensitive data exposed in a single action and can magnify both privacy impact and unintended paid usage if triggered incorrectly.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

Batch Sequential Editing Example

bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 41)May include surrounding context.

python
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():

Static analysis

No suspicious patterns detected.