ClawHub
Back to skill

Security audit

使用Nano Banana Pro（Gemini 3 Pro Image）通过第三方中转API站清云EchoFlow API生成或编辑图像。支持图像生成、图像编辑和多图像合成（最多14张图像）。当用户请求生成图像、创建图像、编辑图像或组合图像时使用。关键词：图像生成、图片生成、生成图片、AI绘画、Nano Banana Pro、Gemini、Gemini 3 Pro Image。

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it includes risky setup and endpoint options that could expose a user’s EchoFlow API key if misused.

Install only if you are comfortable sending prompts and chosen input images to EchoFlow. Prefer installing uv through a trusted package manager instead of the curl|sh command, use ECHOFLOW_API_KEY rather than --api-key, and do not pass --api-base unless you fully trust that endpoint because it will receive your API key.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:47
Finding

Remote Installer Is Piped Directly into a Shell Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–48
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

bash
# Linux (curl | sh — Inspect script before running)
curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The installation instructions retrieve a mutable script from an external URL and immediately execute it with the invoking user's shell. No version pinning, cryptographic signature verification, checksum validation, or separate inspection step occurs before execution.

The accompanying comment recommends inspecting the script, but the command itself provides no opportunity to do so. The effective code executed can therefore change after this Skill has been reviewed. Compromise of the hosting service, its deployment process, or the network trust chain could turn the installation command into an arbitrary-code execution channel.

Installing uv is relevant to running the Skill, but immediate execution of unverified remote content exceeds the minimum privilege and trust necessary for that purpose. A package-manager installation or a separately downloaded and verified artifact would provide the required runtime with less risk.

Attack Path

  1. An attacker compromises the remote installer source or causes malicious content to be served from the referenced URL.
  2. A user follows the documented Linux setup instructions.
  3. curl downloads the attacker-controlled script.
  4. The pipe sends the response directly to sh, without local review or integrity verification.
  5. The malicious script executes with all privileges available to the user who ran the command.
  6. If the user invokes the command with elevated privileges, the payload may obtain correspondingly elevated system access.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. The payload could ac ...[truncated 362 chars]

Remediation
View remediation

Remediation Suggestions

Remove the pipe-to-shell installation command and use a trusted operating-system package manager with a pinned or reviewed release where possible.

If a standalone installer is necessary:

  1. Download a versioned installer to a local file instead of piping it to a shell.
  2. Publish and verify a cryptographic checksum or vendor signature before execution.
  3. Display or inspect the downloaded script separately.
  4. Execute it only after verification succeeds.
  5. Pin the installer URL to a specific reviewed release rather than a mutable latest-version endpoint.
  6. Explicitly advise users not to run the installer with elevated privileges unless the vendor documents a necessary reason.

For example, document separate download, verification, and execution commands rather than combining retrieval and execution into one operation.

T08 · Insecure Dependencies

Warning
Location
scripts/generate_image.py:2
Finding

Automatically Resolved Dependencies Are Not Pinned to Reviewed Versions

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_image.py, lines 2–7
Vulnerability Type: Insecure dependency resolution
Risk Level: Medium

Vulnerable code:

python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "httpx>=0.25.0",
#     "pillow>=10.0.0",
# ]
# ///

Technical Analysis

The inline dependency metadata specifies only minimum versions for httpx and pillow. When the documented uv run command is used, dependency resolution can select future compatible releases that were not present during the Skill audit.

This prevents reproducible dependency resolution and expands the supply-chain trust boundary to any later package release satisfying the constraints. Although the reviewed package names do not appear to be typosquatted and no malicious dependency is present in the audited files, a future compromised or unsafe release could be downloaded, installed, imported, and executed without a corresponding change to this repository.

Automatic dependency installation is useful for the Skill's functionality, but accepting unrestricted future versions is broader than necessary. Exact reviewed versions and integrity hashes can provide the same functionality with a smaller supply-chain attack surface.

Attack Path

  1. A future dependency release satisfying httpx>=0.25.0 or pillow>=10.0.0 is compromised, malicious, or otherwise unsafe.
  2. A user invokes the documented uv run command in an environment without a locked dependency resolution.
  3. The resolver selects and downloads the affected future version.
  4. Package installation or subsequent Python import executes code from that dependency.
  5. The dependency code runs with the privileges of the user executing the Skill.

This path is conditional on compromise or unsafe behavior in an allowed dependency release; the audit found no evidence that the currently named packages are themselves malicious.

...[truncated 417 chars]

Remediation
View remediation

Remediation Suggestions

Adopt reproducible, integrity-checked dependency management:

  1. Pin each dependency to an exact version that has been reviewed and tested.
  2. Generate and commit a lockfile containing the full transitive dependency graph.
  3. Require cryptographic hashes for downloaded distributions where supported.
  4. Use a trusted package index explicitly and disable unexpected additional indexes.
  5. Update dependencies through a controlled review process with vulnerability scanning and regression testing.
  6. Avoid silently resolving unrestricted future versions during ordinary Skill execution.
  7. Periodically refresh pinned versions to obtain security fixes rather than leaving them indefinitely outdated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (20)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The documentation recommends installing uv via a curl-piped shell command, which executes remote script content directly with minimal inspection safeguards. If users follow this pattern and the remote host, DNS, TLS chain, or distribution channel is compromised, it can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

macOS (Homebrew)

brew install uv

Linux (curl | sh — 检查脚本后再运行 / Inspect script before running)

curl -LsSf https://astral.sh/uv/install.sh | sh

text

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The pipe into sh is the dangerous element that turns a network fetch into immediate command execution. In a skill installation document, this chaining pattern reduces the chance of review and makes exploitation straightforward if the fetched content is malicious or tampered with.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

brew install uv

Linux (curl | sh — 检查脚本后再运行 / Inspect script before running)

curl -LsSf https://astral.sh/uv/install.sh | sh

text

**第二步 — 设置 API 密钥** / Set your API key:

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

uv run {baseDir}/scripts/generate_image.py -p "create a collage" -f "collage.png" -i a.png -i b.png -i c.png

使用 Pro 模型

uv run {baseDir}/scripts/generate_image.py -p "abstract art" -f "art.png" -m "gemini-3-pro-image-preview"

text

## API 参考 / API Reference

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_image.py (reported line 46)May include surrounding context.

python
def get_api_key(provided_key: str | None) -> str | None:
    """
    Get API key from --api-key argument first, then ECHOFLOW_API_KEY env var only.
    No fallback to OPENAI_API_KEY or GEMINI_API_KEY to avoid unintended credential use.
    """
    if provided_key:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares use of environment variables and network access but does not explicitly scope or declare those capabilities via permissions/allowed-tools. This weakens platform-level containment and user awareness, especially because the skill sends prompts, images, and an API key to an external service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger phrases are broad and include generic terms like image generation requests that may overlap with ordinary user conversations. Over-broad activation can cause unintentional invocation of a networked skill, sending user prompts or images to a third-party provider without sufficiently clear intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill supports a user-controlled --api-base endpoint while also sending an Authorization header containing the API key. This creates an SSRF-like secret exfiltration path where a user or downstream caller can redirect requests and leak the credential to an arbitrary host.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
| `--resolution`, `-r` | 输出分辨率: `1K`, `2K`, `4K` | `1K` |
| `--model`, `-m` | 模型名称 | `gemini-3.1-flash-image-preview` |
| `--api-key`, `-k` | API 密钥（优先使用环境变量）| — |
| `--api-base` | API 地址（见安全警告）| `https://api.echoflow.cn/v1` |

## 可用模型 / Available Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The security notes explicitly confirm that the API key is sent in the Authorization header to whatever host is specified by --api-base. In the context of a skill that may be invoked automatically, this materially increases the risk of credential exfiltration if endpoint selection is exposed to user input or prompt influence.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
> **API 密钥范围**: 脚本仅从 `ECHOFLOW_API_KEY` 环境变量或 `--api-key` 参数读取密钥，**不会**回退到 `OPENAI_API_KEY` 或 `GEMINI_API_KEY`。

> **`--api-base` 风险**: API 密钥会以 Authorization 头发送到指定的主机。**不要**将其指向不信任的端点，始终使用默认地址 `https://api.echoflow.cn/v1` 或你完全信任的主机。

> **CLI 密钥暴露**: 通过 `--api-key` 传入密钥会暴露在进程列表和 shell 历史中。请使用 `ECHOFLOW_API_KEY` 环境变量。

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly describes sending user-supplied images and text prompts to a third-party service but does not include any warning that uploaded content leaves the local environment and is transmitted to EchoFlow. This can lead users to unknowingly send sensitive images, personal data, or confidential prompts to an external processor, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
"""
Generate or edit images using EchoFlow API with Nano Banana Pro (Gemini 3 Pro Image).

EchoFlow API: https://api.echoflow.cn/
Model: gemini-3.1-flash-image-preview (default), gemini-3-pro-image-preview

Usage:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
"""
Generate or edit images using EchoFlow API with Nano Banana Pro (Gemini 3 Pro Image).

EchoFlow API: https://api.echoflow.cn/
Model: gemini-3.1-flash-image-preview (default), gemini-3-pro-image-preview

Usage:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/echoflow_api.md (reported line 3)May include surrounding context.

md
"""
Generate or edit images using EchoFlow API with Nano Banana Pro (Gemini 3 Pro Image).

EchoFlow API: https://api.echoflow.cn/
Model: gemini-3.1-flash-image-preview (default), gemini-3-pro-image-preview

Usage:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/echoflow_api.md (reported line 13)May include surrounding context.

md
"""
Generate or edit images using EchoFlow API with Nano Banana Pro (Gemini 3 Pro Image).

EchoFlow API: https://api.echoflow.cn/
Model: gemini-3.1-flash-image-preview (default), gemini-3-pro-image-preview

Usage:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/echoflow_api.md (reported line 18)May include surrounding context.

md
"""
Generate or edit images using EchoFlow API with Nano Banana Pro (Gemini 3 Pro Image).

EchoFlow API: https://api.echoflow.cn/
Model: gemini-3.1-flash-image-preview (default), gemini-3-pro-image-preview

Usage:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/echoflow_api.md (reported line 129)May include surrounding context.

md
"""
Generate or edit images using EchoFlow API with Nano Banana Pro (Gemini 3 Pro Image).

EchoFlow API: https://api.echoflow.cn/
Model: gemini-3.1-flash-image-preview (default), gemini-3-pro-image-preview

Usage:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 12)May include surrounding context.

python
"""
Generate or edit images using EchoFlow API with Nano Banana Pro (Gemini 3 Pro Image).

EchoFlow API: https://api.echoflow.cn/
Model: gemini-3.1-flash-image-preview (default), gemini-3-pro-image-preview

Usage:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 133)May include surrounding context.

python
"""
Generate or edit images using EchoFlow API with Nano Banana Pro (Gemini 3 Pro Image).

EchoFlow API: https://api.echoflow.cn/
Model: gemini-3.1-flash-image-preview (default), gemini-3-pro-image-preview

Usage:

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The script allows the API base URL to be overridden via --api-base, and later sends the Bearer API key to whatever host is supplied. In an agent or automation context, an untrusted caller could redirect requests to an attacker-controlled endpoint and exfiltrate the credential as well as user prompts/images.

Content

Scanner excerpt · scripts/generate_image.py (reported line 131)May include surrounding context.

python
)
    parser.add_argument(
        "--api-base",
        default="https://api.echoflow.cn/v1",
        help=(
            "API base URL (default: https://api.echoflow.cn/v1). "
            "WARNING: your API key is sent to this host. Do NOT use untrusted endpoints."

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The file hardcodes bilingual Chinese/English descriptions and trigger wording, but does not state that language is selected based on user preference or that other languages are supported. This can be a locale-policy issue when a skill implicitly imposes language behavior without user opt-in.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The explicit command curl -LsSf https://astral.sh/uv/install.sh | sh is a concrete remote-code-execution pattern. Even with a note to inspect first, the published one-liner normalizes direct execution of fetched script content and increases supply-chain compromise risk.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

brew install uv

Linux (curl | sh — 检查脚本后再运行 / Inspect script before running)

curl -LsSf https://astral.sh/uv/install.sh | sh

text

**第二步 — 设置 API 密钥** / Set your API key:

Static analysis

No suspicious patterns detected.