Image Generate

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:45 PM UTC
• Version: 1.0.0

Overview

The skill is a straightforward image-generation helper that uses disclosed API credentials and saves generated images locally, with some implementation hygiene risks but no evidence of hidden or malicious behavior.

Install only if you are comfortable using Ark/VolcEngine image-generation credentials from your environment and sending prompts to that service. Prefer scoped API keys, set IMAGE_DOWNLOAD_DIR to a private directory, and avoid using a shared or attacker-writable download folder.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/image_generate.py:52

Finding

Unvalidated Remote Image Download and Predictable Output Path

Content

View full analysis

Vulnerability Details

File Location: scripts/image_generate.py, lines 52–61
Vulnerability Type: Unrestricted remote resource download and unsafe predictable file creation
Risk Level: Medium

python

for i, image in enumerate(response.data):
    #  print(f"Image URL: {image.url}")
    try:
        timestamp = int(time.time())
        filename = f"generated_image_{timestamp}_{i}.png"
        filepath = os.path.join(download_dir, filename)
        urllib.request.urlretrieve(image.url, filepath)
        print(f"Downloaded to: {filepath}")
    except Exception as e:
        print(f"Failed to download image from {image.url}: {e}")

Technical Analysis

The script treats each URL returned by the remote Ark API as trusted and passes it directly to urllib.request.urlretrieve. It does not validate the URL scheme, destination host, redirects, response content type, or response size. Consequently, a compromised or manipulated API response could make the process retrieve an unintended resource or download an excessively large response.

The destination filename is derived from the current timestamp in seconds and a sequential index. This makes the path predictable. The download operation does not create the output file atomically with exclusive semantics and does not check whether the destination is a symbolic link. If another local user or process can write to IMAGE_DOWNLOAD_DIR, it may pre-create a symbolic link at the predicted path and cause the script to overwrite another file writable by the script's operating-system account.

Error handling prints the complete response URL. If the URL contains temporary credentials, signatures, or other sensitive query parameters, those values may be exposed through terminal output or collected logs.

Attack Path

1. An attacker compromises or influences the remote image API response, or another failure in the trusted service causes an untrusted URL to appear ...[truncated 1559 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept only https URLs and enforce an explicit allowlist of expected image-service hostnames.
2. Validate every redirect and reject redirects to hosts outside the allowlist.
3. Stream downloads with strict connection, read, and total-operation timeouts rather than using urlretrieve.
4. Enforce a maximum response size before and during download.
5. Validate the response Content-Type and verify the downloaded data using an image decoder before treating it as an image.
6. Generate filenames with cryptographically random values rather than timestamps.
7. Create output files atomically with exclusive creation semantics and reject symbolic links. Ensure the download directory is private and not writable by untrusted users.
8. Download into a securely created temporary file, validate it, and then atomically move it to the final destination.
9. Redact URL query strings, fragments, credentials, and signatures from error messages and logs.
10. Apply storage quotas and remove incomplete files when a download fails.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes a local script that uses both environment variables and outbound network access, yet the manifest does not declare any tool scope or permissions boundaries. This makes the skill's capabilities opaque to users and reviewers, increasing the chance that it will access credentials or contact external services without informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states it will read API credentials from environment variables and may derive an Ark API key from cloud access keys, but it provides no warning or consent flow about credential usage. In an agent setting, this can lead to silent use of sensitive secrets and unintended transmission of authenticated requests to third-party services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.