T09 · Insecure Skill Coding Practices
Error
- Location
scripts/image_generator.py:171- Finding
Unrestricted Server-Supplied Image URL Enables SSRF
- Content
View full analysis
- Remediation
View remediation
Security audit
image-generator-custom
Security checks for vulnerabilities and agentic risk
Overview
This custom image generator is mostly transparent, but needs review because it can fetch arbitrary image URLs returned by a provider, including unintended internal addresses.
Install only if you trust the configured image API provider and are comfortable sending prompts and request metadata to it. Avoid sensitive prompts, review where images are saved, and prefer providers that return base64 image data or otherwise ensure returned image URLs cannot point to internal or untrusted destinations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents use of environment variables and outbound network access to a third-party API, but it does not declare any explicit tool scope or permissions. This creates a transparency and governance gap: an agent may invoke capabilities beyond what users or platform policy reviewers can easily assess, increasing the risk of unintended secret use and external data transmission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s goal/ability description explains that it calls a third-party image API, but it does not clearly warn users that their prompts and related request data will be transmitted to an external provider. This can lead to inadvertent disclosure of sensitive prompts, proprietary data, or personal information to a non-local service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text ### 支持的服务商示例 - OpenAI DALL-E: `https://api.openai.com/v1/images/generations` - Azure OpenAI: `https://your-resource.openai.azure.com/openai/deployments/your-deployment/images/generations?api-version=2023-06-01-preview` - 其他兼容 OpenAI 格式的 API 服务商
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text ### 支持的服务商示例 - OpenAI DALL-E: `https://api.openai.com/v1/images/generations` - Azure OpenAI: `https://your-resource.openai.azure.com/openai/deployments/your-deployment/images/generations?api-version=2023-06-01-preview` - 其他兼容 OpenAI 格式的 API 服务商
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language documentation entirely in Chinese, including the module docstring and usage examples, with no indication that the skill is region-specific or that users can opt into another language. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill sends user-supplied prompts and an API bearer token to a configurable third-party endpoint from environment variables, and it also follows provider-returned image URLs with a second outbound request. In this skill context, external transmission is expected, but the lack of allowlisting or validation of the destination makes secret exposure and SSRF-style access to unintended hosts more dangerous if the API URL or returned image URL is malicious or misconfigured.
- Content
python print(f"模型: {model}") print(f"尺寸: {size}, 数量: {n}, 质量: {quality}") response = requests.post( api_url, headers=headers, json=data,
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill notes elsewhere that images are saved in the current directory, but it lacks an explicit warning emphasizing local filesystem persistence and the resulting data-handling implications. Users may assume outputs are transient when they are actually written to disk, which can expose sensitive or regulated generated content to other local processes or users.
- Content