T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wan-image-gen.js:581- Finding
API Credential Disclosure Through an Unrestricted Endpoint Override
- Content
View full analysis
- Remediation
View remediation
Security audit
wan-image-gen
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent image-generation tool, but it can send the user's DashScope API key to an unrestricted configured endpoint and downloads unvalidated remote files.
Install only if you trust the skill source and will keep baseUrl pointed at the legitimate DashScope endpoint. Prefer DASHSCOPE_API_KEY from the environment instead of config.json, do not let untrusted projects set DASHSCOPE_BASE_URL or config.json, and run it in a network- and disk-limited workspace if possible.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wan-image-gen.js:501- Finding
Unvalidated Service-Provided Image URL Fetching
- Content
View full analysis
{ if (item && item.url) { urls.push(item.url); } }); } if (Array.isArray(output.choices)) { output.choices.forEach((choice) => { const content = choice && choice.message && Array.isArray(choice.message.content) ? choice.message.content : []; content.forEach((item) => { if (item && item.image) { urls.push(item.image); } }); }); } ``` ```js async function downloadFile(url, filePath) { const response = await fetch(url); if (!response.ok) { throw new Error(`Download failed: ${response.status} ${response.statusText}`); } const arrayBuffer = await response.arrayBuffer(); fs.writeFileSync(filePath, Buffer.from(arrayBuffer)); } ``` ```js for (let i = 0; i < urls.length; i += 1) { const url = urls[i]; const filename = `${prefix}-${String(i + 1).padStart(2, '0')}.png`; const filePath = path.join(outputDir, filename); await downloadFile(url, filePath); saved.push(filePath); } ``` ### Technical Analysis Image URLs extracted from task responses are passed directly to `fetch`. The code does not validate the URL scheme, hostname, port, resolved IP address, or redirect destination. It therefore trusts the remote API response to select arbitrary resources accessible from the machine running the Skill. If the configured API endpoint is compromised, malicious, or redirected, it can return URLs targeting loopback services, private network hosts, or cloud metadata endpoints. Redirects can also move an initially acceptable URL to a prohibited destination unless every redirect is validated. The response is consumed through `arrayBuffer()`, causing the entire body to be buffered in memory before it i ...[truncated 1761 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/wan-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/wan-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/wan-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/wan-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/wan-image-gen.js`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 主要脚本：`node scripts/wan-image-gen.js`
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires environment access to read an API key and performs outbound network calls, but the manifest does not explicitly declare tool scope such as permissions or allowed-tools. This weakens least-privilege enforcement and makes it harder for a host agent or reviewer to understand and constrain what the skill is allowed to access.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language instructions and usage guidance are entirely presented in Chinese, and the skill does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill automatically downloads generated images to a local directory, but the top-level description does not clearly warn that execution writes files to disk. This can surprise users or calling agents, especially in environments where local writes are sensitive, audited, or space-limited.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
L080 声称“默认档位为 final”，而前面的 config 示例在 L039 与 L053 明确给出 defaultGoal=balanced、defaultTier=standard，对应默认模型并非 final。这个问题属于文档内部对实际默认行为的主动矛盾描述，会误导调用方对脚本默认行为的理解。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The file content is entirely Chinese and does not indicate user opt-in, multilingual support, or a justified region-specific language constraint, which may conflict with organizational language-choice expectations.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This is a markdown file, so SQP-2 applies to user-affecting behaviors described in the documentation. Line L20 states that images are automatically downloaded locally, but the notes do not present this as a warning or caution even though it affects user data/storage and creates local files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The usage examples and many user-facing messages in the script are written only in Chinese, which effectively steers use toward a specific language/locale. The file does not indicate that Chinese is optional or that users may supply prompts and interact in another language.
- Content