中文 EN
开始可信审查
安全决策报告

gpt-image-2

Skill sends user API keys and image prompts to an undisclosed hardcoded IP address via unencrypted HTTP without declaring network access in documentation.

安装决策优先 来源: ClawHub 扫描时间: 2026/6/22
文件 4
IOC 4
越权项 3
发现 4
最直接的威胁证据
01
User installs skill thinking it generates images locally 初始入口 · SKILL.md
02
User provides access key for verification trust_exploitation · SKILL.md
03
Access key and prompts transmitted to hardcoded IP via HTTP 权限提升 · scripts/generate_image.py

为什么得出这个结论

3/4 个维度触发
阻止
声明与实际能力

发现 3 项声明之外的能力或越权行为。

阻止
隐藏执行与外联

提取到 1 个高危 IOC 或外联信号。

阻止
攻击链与高危发现

报告包含 4 步攻击链，另有 3 项高危或严重发现。

复核
依赖与供应链卫生

发现 1 项需要关注的依赖或供应链线索。

攻击链

01
User installs skill thinking it generates images locally

初始入口 · SKILL.md:1

02
User provides access key for verification

trust_exploitation · SKILL.md:7

03
Access key and prompts transmitted to hardcoded IP via HTTP

权限提升 · scripts/generate_image.py:30

04
External server receives keys, prompts, and can track user quota/behavior

最终危害 · scripts/generate_image.py:21

风险分是怎么被拉高的

Hardcoded external IP address +25

Server IP 124.156.166.147 hardcoded in scripts/generate_image.py:21 with no DNS fallback

Undeclared network access +25

SKILL.md does not mention network communication; user keys and prompts are sent to external IP

Unencrypted HTTP transport +15

Uses http:// instead of https://, exposing credentials and prompts in plaintext

Shell execution via Bash +10

SKILL.md declares no allowed-tools but uses Bash to invoke scripts

最关键的证据

高危 数据外泄

Hardcoded external IP with no DNS resolution

The script connects to a hardcoded IP address (124.156.166.147:8765) over HTTP. No domain name is used, preventing any DNS-based trust verification. All user access keys and prompts are sent to this undisclosed endpoint.

scripts/generate_image.py:21
Replace with a properly documented HTTPS endpoint or use DNS-based service discovery with certificate validation.
高危 文档欺骗

Network communication not declared in SKILL.md

SKILL.md only describes image generation but fails to mention that user access keys, prompts, and quota information are transmitted to an external server. skill-card.md partially acknowledges this risk, but SKILL.md is silent.

SKILL.md:1
Add explicit declaration of network access and list the external endpoints in SKILL.md.
高危 凭证窃取

User access keys sent to external server

User-provided access keys (format: IMGKEY-HK-XXXXXX) are transmitted in the x-access-key header to an external IP. These keys could be harvested if the server is compromised or malicious.

scripts/generate_image.py:30
Avoid sending API keys to external servers when possible. If required, ensure the service uses proper OAuth or token exchange instead of raw key transmission.
中危 敏感访问

Undeclared shell execution via subprocess

SKILL.md invokes Python scripts through Bash commands but declares no allowed-tools. This shell:WRITE usage should be explicitly declared.

SKILL.md:14
Declare shell:WRITE in allowed-tools if subprocess execution is intentional.

声明能力 vs 实际能力

网络访问 阻止
声明 NONE
→
推断 WRITE
scripts/generate_image.py:21 - hardcoded SERVER IP
命令执行 阻止
声明 NONE
→
推断 WRITE
SKILL.md lines 14,25,39 - subprocess calls not declared
文件系统 阻止
声明 NONE
→
推断 WRITE
scripts/generate_image.py:67-68 - writes decoded images to disk

可疑产物与外联

高危 IP 地址
124.156.166.147

scripts/generate_image.py:21

中危 外部 URL
http://124.156.166.147:8765

scripts/generate_image.py:21

中危 外部 URL
https://clawhub.ai/user/kiribon43567

skill-card.md:7

中危 外部 URL
https://clawhub.ai/kiribon43567/gpt-image-2

skill-card.md:29

依赖与供应链

包名版本来源漏洞备注
requests * pip 否 Version not pinned - could receive malicious updates

文件构成

4 个文件 · 212 行
Markdown 2 个文件 · 108 行Python 1 个文件 · 99 行JSON 1 个文件 · 5 行
需关注文件 · 3
scripts/generate_image.py Python · 99 行
Hardcoded external IP with no DNS resolution · User access keys sent to external server · 124.156.166.147 · http://124.156.166.147:8765
SKILL.md Markdown · 66 行
Network communication not declared in SKILL.md · Undeclared shell execution via subprocess
skill-card.md Markdown · 42 行
https://clawhub.ai/user/kiribon43567 · https://clawhub.ai/kiribon43567/gpt-image-2
其他文件 · _meta.json

安全亮点

skill-card.md acknowledges the unencrypted HTTP risk to users
Script properly handles HTTP error codes (401, 403)
Images are saved to system temp directory only, not persistent storage