shortart image generator 图片 生成

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:51 AM UTC
• Version: 1.0.9

Overview

The skill mostly matches its ShortArt image-generation purpose, but its download code can leak the ShortArt API key to untrusted image URLs.

Review before installing. Only use this skill with non-sensitive prompts and images you are willing to send to ShortArt, do not print or share your API key, and avoid the download workflow until the code stops sending the bearer token to unvalidated image URLs. Prefer a pinned, verified install source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/text-to-image/impl.py:179

Finding

Bearer API Key Disclosure Through Arbitrary Image URLs in Text-to-Image Downloads

Content

View full analysis

Vulnerability Details

File Location: scripts/text-to-image/impl.py, lines 179-204
Vulnerability Type: Credential disclosure through untrusted download URLs
Risk Level: High

Vulnerable Code

python

domain = result.get("domain", "https://file.shortart.ai/")
images = result["images"]
downloaded = []

download_dir = Path.home() / "Downloads"
download_dir.mkdir(exist_ok=True)

timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")

headers = {}
if api_key:
    headers["Authorization"] = f"Bearer {api_key}"

for idx, img in enumerate(images, 1):
    url = img.get("url") or f"{domain}{img['path']}"
    ext = Path(img["path"]).suffix or ".jpg"
    filename = f"shortart_{timestamp}_{idx}{ext}"
    filepath = download_dir / filename

    try:
        resp = requests.get(url, headers=headers, timeout=60)
        resp.raise_for_status()
        with open(filepath, "wb") as f:
            f.write(resp.content)

Technical Analysis

The --download mode parses caller-supplied JSON and trusts the domain and per-image url fields. The downloader then attaches SHORTART_API_KEY as a bearer token to every resulting URL without verifying the scheme, hostname, port, or redirect destination.

An attacker can provide a successful-looking result object containing a URL under their control. When the documented download workflow processes it, the HTTP request discloses the API key in its Authorization header. The requests library also follows redirects by default, so an initially trusted URL could redirect the credential-bearing request to another origin.

Authentication credentials should only be sent to the service for which they were issued. Downloading generated images does not justify forwarding the API credential to arbitrary destinations.

Attack Path

1. An attacker supplies or causes the Agent to process a JSON object with "status": "success" and a nonempty images array. ...[truncated 864 chars]

Remediation

View remediation

Remediation Suggestions

• Do not include the ShortArt bearer token when downloading public or presigned image URLs.
• If authenticated downloads are required, parse URLs with urllib.parse.urlparse and allowlist exact HTTPS origins controlled by ShortArt.
• Reject non-HTTPS schemes, embedded credentials, unexpected ports, malformed hosts, and all non-allowlisted hostnames.
• Disable redirects with allow_redirects=False, or validate every redirect destination and remove authorization headers before any cross-origin redirect.
• Prefer obtaining download URLs directly from a trusted API response rather than accepting complete download-result JSON from command-line input.
• Add tests proving that attacker-controlled URLs and redirects never receive the bearer token.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/template-image/impl.py:186

Finding

Bearer API Key Disclosure Through Arbitrary Image URLs in Template Downloads

Content

View full analysis

Vulnerability Details

File Location: scripts/template-image/impl.py, lines 186-211
Vulnerability Type: Credential disclosure through untrusted download URLs
Risk Level: High

Vulnerable Code

python

domain = result.get("domain", "https://file.shortart.ai/")
images = result["images"]
downloaded = []

download_dir = Path.home() / "Downloads"
download_dir.mkdir(exist_ok=True)

timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")

headers = {}
if api_key:
    headers["Authorization"] = f"Bearer {api_key}"

for idx, img in enumerate(images, 1):
    url = img.get("url") or f"{domain}{img['path']}"
    ext = Path(img["path"]).suffix or ".jpg"
    filename = f"shortart_template_{timestamp}_{idx}{ext}"
    filepath = download_dir / filename

    try:
        resp = requests.get(url, headers=headers, timeout=60)
        resp.raise_for_status()
        with open(filepath, "wb") as f:
            f.write(resp.content)

Technical Analysis

Template download mode accepts a JSON string and derives request destinations from its unvalidated domain and images[].url fields. The ShortArt API key is added to every request regardless of destination.

This creates a direct credential-exfiltration primitive. An attacker-controlled image URL receives the bearer token, while default redirect handling supplies an additional route for cross-origin disclosure. The behavior exceeds the minimum privileges needed to save generated images because credentials should not be sent unless the destination is a verified ShortArt authentication endpoint.

Attack Path

1. An attacker constructs a JSON object marked as successful with at least one image entry.
2. The entry specifies an attacker-controlled HTTPS URL, or a URL that redirects to one.
3. The crafted JSON reaches the documented --download workflow.
4. The script reads SHORTART_API_KEY and places it in the Authorization header.

...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the authorization header from ordinary image-download requests.
• If file downloads genuinely require authentication, restrict credentials to a documented allowlist of exact ShortArt HTTPS origins.
• Validate both direct destinations and redirect targets.
• Set allow_redirects=False unless redirects are explicitly and safely processed.
• Refuse URLs with unexpected schemes, hosts, ports, user information, or ambiguous hostname encodings.
• Avoid trusting caller-provided result JSON as an authority for authenticated network destinations.
• Centralize secure downloading in ShortArtClient so every mode uses one validated implementation.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/suit-image/impl.py:112

Finding

Bearer API Key Disclosure Through Arbitrary Image URLs in Suit-Image Downloads

Content

View full analysis

Vulnerability Details

File Location: scripts/suit-image/impl.py, lines 112-130
Vulnerability Type: Credential disclosure through untrusted download URLs
Risk Level: High

Vulnerable Code

python

timestamp = time.strftime("%Y%m%d_%H%M%S")
downloaded = []

headers = {}
if api_key:
    headers["Authorization"] = f"Bearer {api_key}"

for idx, img in enumerate(result.get("images", []), 1):
    url = img["url"]
    ext = Path(img["path"]).suffix or ".jpg"
    filename = f"shortart_suit_{timestamp}_{idx}{ext}"
    filepath = download_dir / filename

    resp = requests.get(url, headers=headers, timeout=60)
    resp.raise_for_status()

    with open(filepath, "wb") as f:
        f.write(resp.content)

Technical Analysis

Suit-image download mode takes each images[].url directly from supplied result JSON and sends the ShortArt API key to that URL. No origin validation is performed, and redirects are followed by default.

Because the destination is attacker-controllable while the authorization value comes from a sensitive environment variable, this is a direct sensitive-data flow from a trusted source to an untrusted network sink. The API key is unnecessary for arbitrary external downloads and therefore violates least-privilege principles.

Attack Path

1. An attacker prepares JSON whose top-level status is "completed".
2. The JSON includes an image with an attacker-operated URL.
3. The crafted result is supplied to scripts/suit-image/impl.py --download.
4. The script adds the ShortArt API key to the request headers.
5. The request reaches the attacker’s server, which captures the token.
6. The attacker attempts to use the key against ShortArt APIs.

Impact Assessment

The vulnerability can expose the complete ShortArt bearer token. Resulting privileges are limited to those assigned to that token but may include spending generation credits, submitting jobs, queryi ...[truncated 129 chars]

Remediation

View remediation

Remediation Suggestions

• Never send SHORTART_API_KEY to a URL taken from input JSON.
• Download public or presigned output URLs without authorization headers.
• If authentication is mandatory, enforce an exact HTTPS hostname allowlist before attaching the token.
• Disable automatic redirects or strip authorization before redirects and validate each target.
• Replace the three duplicated download implementations with a single hardened helper.
• Add regression tests using attacker-controlled URLs and redirects to verify that credentials are not forwarded.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Skill Instructions Expose the API Key in Terminal and Agent Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 59
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

Vulnerable Code

markdown

1. Verify API key: `echo $SHORTART_API_KEY`
2. Identify user intent from triggers above
3. Read the corresponding reference file for detailed workflow
4. Execute using scripts in the appropriate subdirectory

Technical Analysis

The quick-start instructions tell the Agent or user to print the complete secret environment variable. Terminal output can be retained in shell transcripts, Agent tool logs, session recordings, continuous-integration output, or shared support material.

Presence validation does not require disclosure of the value. Printing the entire secret unnecessarily broadens the number of components and people that may observe it.

Attack Path

1. A user or Agent follows the Skill’s quick-start instructions.
2. echo $SHORTART_API_KEY prints the complete secret.
3. The output is retained by terminal logging, Agent traces, screen sharing, recordings, or copied diagnostics.
4. Another party obtains the recorded value and attempts to use it against ShortArt.

Impact Assessment

Exposure compromises the confidentiality of the ShortArt API key. A party obtaining the output may acquire all API capabilities associated with that key, including possible access to projects or consumption of generation credits. This issue does not independently provide local-system privileges.

Remediation

View remediation

Remediation Suggestions

Replace the value-printing command with a presence-only check:

bash

if [ -n "${SHORTART_API_KEY:-}" ]; then
  echo "SHORTART_API_KEY is set"
else
  echo "SHORTART_API_KEY is not set"
fi

Additionally:

• Explicitly instruct users not to paste API keys into chat messages or logs.
• Redact secrets from diagnostic output and error reports.
• Recommend revoking and rotating any key that has already been printed in a recorded or shared session.

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Unpinned Third-Party Installation Creates a Mutable Supply-Chain Trust Boundary

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 20-26
Vulnerability Type: Unpinned third-party installer and mutable Skill source
Risk Level: Medium

Vulnerable Code

markdown

### Step 1: Install the skill

```bash
npx skills add yige666s/shortart-image-generator

This will install the skill to ~/.agents/skills/shortart-image-generator.

text

### Technical Analysis

The installation procedure invokes an `npx`-resolved tool and installs a mutable repository reference without specifying a package version, release tag, commit hash, checksum, or signature. Consequently, the content installed in the future may differ from the content covered by this audit.

If either the installer package or referenced upstream source is compromised or changed, users following the documented command can receive unreviewed scripts and instructions. This is especially relevant because the installed Skill is granted `Bash(python3 *)`, allowing its Python entry points to run in the Agent environment.

This finding identifies an insecure supply-chain practice; the audited repository itself did not contain evidence that the current installer or upstream account is malicious.

### Attack Path

1. The package resolved by `npx`, the publisher account, or the referenced Skill repository is compromised or modified.
2. An attacker publishes altered content under the same unpinned identifier.
3. A user runs the documented installation command.
4. The command retrieves the altered package or Skill revision rather than the audited revision.
5. The Agent loads the new instructions and may execute modified Python scripts under the Skill’s allowed Bash capability.

### Impact Assessment

The ultimate impact depends on the content introduced through the compromised dependency or source. Because installed Skill code can execute Python, malicious replacement content could potentially read data available to the Agent process,
...[truncated 159 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npx installer to a reviewed version rather than relying on mutable resolution.
• Pin the Skill to a specific signed release or immutable commit hash.
• Publish and verify cryptographic checksums or signatures for release artifacts.
• Document the authoritative source repository and verification procedure.
• Re-audit changed Skill revisions before granting execution permissions.
• Use lockfiles or equivalent integrity metadata where supported.
• Minimize the Skill’s allowed execution capability to only the specific reviewed entry points.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a multi-mode image generation skill with broad capabilities, including general text-to-image, image-to-image, e-commerce suit images, and template-driven generation. This code chunk only covers the suit-image path: it optionally uploads a local image, requires an image reference, calls create_suit_image, polls status, and can download resulting images to the user's Downloads folder. There is no implementation here for generic text-to-image generation or template-based generation. Additionally, the code writes files locally when downloading results, which is a resource access/capability not declared in the description. Polling and upload are supporting details for the suit-image workflow, but the overall declared scope materially overstates what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code is narrowly focused on template-based image generation via ShortArt. It can enumerate templates, retrieve a template, upload images, create a project from a template, poll for completion, and download results locally. It does not implement general text-to-image or standalone image-to-image generation, nor any explicit e-commerce suit/product-photo mode described in the declaration. Additionally, it has a concrete local file-writing/download behavior that is not mentioned in the declared purpose. Therefore the description overstates and partially misrepresents the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The core declared purpose of generating images via ShortArt is broadly accurate: the code creates generation projects, can upload an input image, polls for completion, and returns/downloads results. However, the description claims three specific modes, including e-commerce suit images and template-based generation with customizable parameters. This code chunk only exposes generic generation, image upload, polling, and download behavior; it contains no dedicated template APIs, template selection/recommendation logic, or product/suit-image-specific handling. Additionally, it has an undeclared capability to download files from URLs and save them to the user's Downloads directory. That filesystem-writing behavior is materially beyond the stated description.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

This client performs outbound HTTP requests to the ShortArt API and uploads user-supplied images, but the static finding indicates that network capability is not declared in the skill permissions. Undeclared network access is dangerous because it can exfiltrate prompts, images, and API-derived data to external services outside the user's expected permission model, and the skill context makes this especially relevant since remote image generation is core behavior.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

md

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![Python 3.7+](https://img.shields.io/badge/python-3.7+-blue.svg)](https://www.python.org/downloads/)

> 🎉 **Generate images from text, create e-commerce product photos, or use professional templates - all in one skill!**

[Get Started](#-installation) • [Features](#-features) • [Quick Start](#-quick-start)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx skills add yige666s/shortart-image-generator without pinning a specific version of the tooling or package reference. This creates a supply-chain risk where future changes to the installer or referenced package could alter what gets executed on the user's machine at install time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README encourages users to submit prompts and upload images to ShortArt, but it does not clearly warn that this content is transmitted to a third-party external service. Users may unknowingly send sensitive personal, business, or copyrighted material off-device, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: shortart-image-generator
description: "Generate images using ShortArt AI platform with three modes: (1) Text-to-image and image-to-image generation for general artwork creation, (2) E-commerce suit images for product photography and Amazon listings, (3) Template-based image generation with customizable parameters. REQUIRES: SHORTART_API_KEY environment variable (get from https://shortart.ai/home). Use when users explicitly request: creating images, drawing, generating pictures, making artwork, product images, suit images, template images, or visual content creation using ShortArt. Triggers on: 生成图片, 画一张, 帮我画, 制作图片, 套图, 生成套图, 主图, 商品主图, 模版生图, 用模版生成图片, 推荐模版, generate image, create image, draw, visualize, suit image, product main image, template image generation, image-to-image, 以图生图."
homepage: https://shortart.ai
allowed-tools: Bash(python3 *)
metadata: {"openclaw": {"emoji": "🎨", "requires": {"env": ["SHORTART_API_KEY"]}, "primaryEnv": "SHORTART_API_KEY"}, "dependencies": {"python": ">=3.7", "pip": ["requests"]}}

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list is very broad, including common phrases like 'create image', 'draw', and 'visualize', which can cause the skill to activate on many ordinary requests not specifically intended for ShortArt. That increases the chance of unintended external API use, unnecessary credential exposure to a third-party service context, and unexpected file/output side effects from downstream scripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill tells users to place SHORTART_API_KEY in ~/.zshrc but does not warn that shell profiles are long-lived plaintext storage locations that may be exposed via backups, shared accounts, screenshots, or accidental disclosure. This is not necessarily malicious, but it normalizes insecure secret-handling guidance and can lead to credential compromise for the ShortArt account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to upload local images to an external service and later download generated files to the local machine without disclosing the data-transfer, retention, or overwrite/privacy implications. In an image-generation workflow, this can expose proprietary product images or personal data and can cause users to accept local file writes without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to upload user-provided local images to the ShortArt service but does not require any disclosure, confirmation, or data-sensitivity check before transmission. This creates a real privacy and data-handling risk because users may provide personal, confidential, or proprietary images without realizing they are being sent to a third-party external platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

When --upload is used, a local user-provided file is sent to a remote API, but the code provides no inline disclosure or consent guard around that network transmission. In a skill environment, uploading local files can expose sensitive images or metadata if the user does not understand that the file leaves the machine.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest claims support for three modes including general text-to-image/image-to-image generation and template-based generation, but this file only invokes create_suit_image and requires an input image path. That is a narrower behavior than the manifest's advertised scope, creating a description-behavior mismatch for this skill component.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The download path writes remote content directly into the user's Downloads directory without an explicit confirmation step. Even though saving generated images is related to the skill's purpose, implicit local file writes can surprise users and may clutter or overwrite expected workflows if invoked unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill downloads images from URLs in result JSON and writes them to the local Downloads folder without a clear warning or approval prompt. In an agent context, silent filesystem writes are security-relevant because they create side effects on the host machine beyond merely returning generated content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When uploads are provided, the skill sends local user files to the ShortArt remote service via upload_image(). That is expected for image-to-image workflows, but without explicit disclosure or confirmation in this execution path, users may unintentionally transmit sensitive local files off-device.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill downloads remote image content and writes it directly into the user's local Downloads directory as a side effect. Even if this supports the feature, local filesystem writes are more sensitive than pure image generation and are not clearly constrained or confirmed here, which can surprise users and expand the skill's effective privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code automatically saves downloaded images to ~/Downloads without any interactive warning, confirmation, or caller-controlled destination. Silent local writes can create privacy, safety, and trust issues, especially in an agent context where users may not expect filesystem modification from a content-generation request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill exposes a download mode that fetches remote image URLs and writes files to the local filesystem, but this behavior is not disclosed in the manifest/description. Hidden filesystem-modifying behavior is dangerous because users or higher-level agents may invoke an image-generation skill expecting API-only behavior, while it silently persists attacker-controlled content to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README describes automatic or assistant-mediated downloading of generated images to local paths, but it does not explicitly warn users that files will be written to disk. This can create privacy and operational issues on shared systems or managed environments where local file writes are sensitive or unexpected.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The routing guidance tells the agent to identify intent from broad trigger phrases, but it does not define boundaries for when not to use this skill. In an agent ecosystem, weak scoping can lead to over-invocation of a third-party integration for requests that only loosely resemble image generation tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON file includes a large block of Chinese-language keywords alongside English keywords, which can implicitly steer the skill toward a specific language or locale. Under the policy, language or locale constraints should either be optional for the user or clearly documented and justified; this file contains no such indication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The workflow provides a Chinese-language example prompt as the optimization example, but does not state that language choice is optional or user-selected. This can be read as steering the skill toward a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.