Skill Trust Decision
gpt-image-2
Skill sends user API keys and image prompts to an undisclosed hardcoded IP address via unencrypted HTTP without declaring network access in documentation.
Most direct threat evidence
01
User installs skill thinking it generates images locally Entry · SKILL.md
02
User provides access key for verification trust_exploitation · SKILL.md
03
Access key and prompts transmitted to hardcoded IP via HTTP Escalation · scripts/generate_image.py
Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
3 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 3 severe findings.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
Attack Chain
01
User installs skill thinking it generates images locally
Entry · SKILL.md:1
02
User provides access key for verification
trust_exploitation · SKILL.md:7
03
Access key and prompts transmitted to hardcoded IP via HTTP
Escalation · scripts/generate_image.py:30
04
External server receives keys, prompts, and can track user quota/behavior
Impact · scripts/generate_image.py:21
What drove the risk score up
Hardcoded external IP address +25
Server IP 124.156.166.147 hardcoded in scripts/generate_image.py:21 with no DNS fallback
Undeclared network access +25
SKILL.md does not mention network communication; user keys and prompts are sent to external IP
Unencrypted HTTP transport +15
Uses http:// instead of https://, exposing credentials and prompts in plaintext
Shell execution via Bash +10
SKILL.md declares no allowed-tools but uses Bash to invoke scripts
Most important evidence
High Data Exfil
Hardcoded external IP with no DNS resolution
The script connects to a hardcoded IP address (124.156.166.147:8765) over HTTP. No domain name is used, preventing any DNS-based trust verification. All user access keys and prompts are sent to this undisclosed endpoint.
scripts/generate_image.py:21 Replace with a properly documented HTTPS endpoint or use DNS-based service discovery with certificate validation.
High Doc Mismatch
Network communication not declared in SKILL.md
SKILL.md only describes image generation but fails to mention that user access keys, prompts, and quota information are transmitted to an external server. skill-card.md partially acknowledges this risk, but SKILL.md is silent.
SKILL.md:1 Add explicit declaration of network access and list the external endpoints in SKILL.md.
High Credential Theft
User access keys sent to external server
User-provided access keys (format: IMGKEY-HK-XXXXXX) are transmitted in the x-access-key header to an external IP. These keys could be harvested if the server is compromised or malicious.
scripts/generate_image.py:30 Avoid sending API keys to external servers when possible. If required, ensure the service uses proper OAuth or token exchange instead of raw key transmission.
Medium Sensitive Access
Undeclared shell execution via subprocess
SKILL.md invokes Python scripts through Bash commands but declares no allowed-tools. This shell:WRITE usage should be explicitly declared.
SKILL.md:14 Declare shell:WRITE in allowed-tools if subprocess execution is intentional.
Declared capability vs actual capability
Network Block
Declared NONE
→ Inferred WRITE
scripts/generate_image.py:21 - hardcoded SERVER IP Shell Block
Declared NONE
→ Inferred WRITE
SKILL.md lines 14,25,39 - subprocess calls not declared Filesystem Block
Declared NONE
→ Inferred WRITE
scripts/generate_image.py:67-68 - writes decoded images to disk Suspicious artifacts and egress
High IP Address
124.156.166.147 scripts/generate_image.py:21
Medium External URL
http://124.156.166.147:8765 scripts/generate_image.py:21
Medium External URL
https://clawhub.ai/user/kiribon43567 skill-card.md:7
Medium External URL
https://clawhub.ai/kiribon43567/gpt-image-2 skill-card.md:29
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| requests | * | pip | No | Version not pinned - could receive malicious updates |
File composition
4 files · 212 lines
Markdown 2 files · 108 linesPython 1 files · 99 linesJSON 1 files · 5 lines
Files of concern · 3
scripts/generate_image.py Hardcoded external IP with no DNS resolution · User access keys sent to external server · 124.156.166.147 · http://124.156.166.147:8765
SKILL.md Network communication not declared in SKILL.md · Undeclared shell execution via subprocess
skill-card.md https://clawhub.ai/user/kiribon43567 · https://clawhub.ai/kiribon43567/gpt-image-2
Other files · _meta.json
Security positives
skill-card.md acknowledges the unencrypted HTTP risk to users
Script properly handles HTTP error codes (401, 403)
Images are saved to system temp directory only, not persistent storage