安全决策报告
grok-image-tool-pro
Pure documentation skill providing Grok batch image-generation guidance; all tool usage (read/exec/write) is declared and matches documented behavior, with no hidden implementation or malicious code.
为什么得出这个结论
0/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
复核
隐藏执行与外联
提取到 3 个一般风险产物，需要结合上下文判断。
通过
攻击链与高危发现
没有形成明确的恶意路径。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Broad 'exec' tool declaration +15
SKILL.md declares 'exec' tool for shell-based workflow automation; while declared, it enables arbitrary command execution with wide blast radius
Filesystem write to arbitrary paths +10
Skill creates directories and moves/renames files across arbitrary paths including $HOME/Downloads
Documentation completeness mitigates risk +-5
All tool usage, workflow steps, and security caveats are documented; no hidden functionality detected
最关键的证据
中危 权限提升
Broad shell execution tool declared
The 'exec' tool is declared for workflow automation, enabling arbitrary shell commands (mkdir, mv, convert, sleep, etc.). While declared, it provides wide blast radius for file and system operations.
SKILL.md:6 Consider restricting exec to a whitelist of safe commands (mkdir, mv, python3) or use a sandboxed execution environment for batch workflows.
低危 敏感访问
Access to user Downloads directory
Batch workflow examples reference $HOME/Downloads for saving generated images before renaming and moving to output directories, which touches user home directory.
SKILL.md:150 Use a dedicated workflow output directory and avoid touching the user's default Downloads folder to prevent file collision or data leakage.
低危 文档欺骗
Duplicate '核心功能' section
SKILL.md contains a duplicated '核心功能' (Core Functions) section near the end, which appears to be a documentation artifact rather than a security issue.
SKILL.md:492 Remove duplicate documentation section to avoid confusion.
声明能力 vs 实际能力
文件系统 通过
声明 READ
→ 推断 READ
SKILL.md declares 'read' tool; file operations limited to image workflow paths 文件系统 通过
声明 WRITE
→ 推断 WRITE
SKILL.md declares 'write' tool; creates output dirs, renames/moves image files 命令执行 通过
声明 WRITE
→ 推断 WRITE
SKILL.md declares 'exec' tool; bash scripts create dirs, mv files, sleep intervals, ImageMagick convert commands 网络访问 通过
声明 NONE
→ 推断 NONE
No direct network requests in skill code; browser automation via external tools handles grok.com; Feishu via 'message tool' 浏览器 通过
声明 READ
→ 推断 READ
Browser automation declared via 'playwright' and 'desktop-agent' in SKILL.md examples 环境变量 通过
声明 NONE
→ 推断 NONE
No environment variable access in skill; security note explicitly advises against hardcoding keys 可疑产物与外联
中危 外部 URL
https://grok.com/imagine SKILL.md:140
中危 外部 URL
https://clawhub.ai/user/thcjp skill-card.md:9
中危 外部 URL
https://clawhub.ai/thcjp/skills/grok-image-tool-pro skill-card.md:39
依赖与供应链
没有结构化依赖告警。
文件构成
3 个文件 · 565 行
Markdown 2 个文件 · 560 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Broad shell execution tool declared · Access to user Downloads directory · Duplicate '核心功能' section · https://grok.com/imagine
skill-card.md https://clawhub.ai/user/thcjp · https://clawhub.ai/thcjp/skills/grok-image-tool-pro
其他文件 · _meta.json
安全亮点
All tool usage (read/exec/write) is explicitly declared in SKILL.md frontmatter
No scripts or implementation files present — pure documentation; no hidden code
No credential harvesting or environment variable access observed
No data exfiltration or C2 communication detected
No base64, eval, obfuscation, or anti-analysis patterns found
Security notes explicitly advise against hardcoding API keys
skill-card.md accurately summarizes known risks with mitigations
MIT-0 license permits broad use with minimal restrictions
Callback/Feishu delivery risks are called out in skill-card.md