T09 · Insecure Skill Coding Practices
Error
- Location
scripts/qwen-image-gen.js:691- Finding
DashScope API credentials can be forwarded to an arbitrary configured endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Qwen Image Gen
Security checks for vulnerabilities and agentic risk
Overview
This image-generation skill is mostly purpose-aligned, but it handles API credentials and downloads in ways that are too broadly scoped for automatic trust.
Install only if you trust the publisher and will keep the base URL pointed at the official DashScope endpoint you intend to use. Prefer DASHSCOPE_API_KEY from the environment instead of config.json, do not allow untrusted projects or agents to edit config.json or DASHSCOPE_BASE_URL, and review generated output files before reusing them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/qwen-image-gen.js:545- Finding
Untrusted API response URLs are fetched without destination or response validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/qwen-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/qwen-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/qwen-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/qwen-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/qwen-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/qwen-image-gen.js`
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill requires access to an API key and makes outbound network requests, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This creates an overbroad trust boundary: a host agent may invoke the skill without clear policy gating on secret access and networking, increasing the chance of unintended credential exposure or unreviewed external communication.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file presents all substantive guidance in Chinese, including headings, usage notes, and pricing, with no indication that the language choice is optional or that the document is intended only for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script emits user-facing messages in Chinese, for example the error text at L192, and this pattern continues throughout usage, validation, and status output. Because there is no opt-in, locale switch, or documented region-specific justification in the file, this is a natural-language locale policy concern.
- Content