安全决策报告
agnes-image-gen
SKILL.md embeds a real Agnes AI API key and declares shell/filesystem/network capabilities without any executable implementation present, creating credential exposure risk and a significant doc-to-code mismatch.
最直接的威胁证据
01
Skill published on ClawHub with hardcoded API key in SKILL.md 初始入口 · SKILL.md
02
Attacker extracts the embedded API key from the skill file reconnaissance · SKILL.md
03
Attacker uses the stolen key to generate images at the victim's expense via Agnes AI API 最终危害 · SKILL.md
为什么得出这个结论
3/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 3 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 3 步攻击链，另有 1 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
攻击链
01
Skill published on ClawHub with hardcoded API key in SKILL.md
初始入口 · SKILL.md:47
02
Attacker extracts the embedded API key from the skill file
reconnaissance · SKILL.md:47
03
Attacker uses the stolen key to generate images at the victim's expense via Agnes AI API
最终危害 · SKILL.md:47
风险分是怎么被拉高的
Hardcoded real API key in documentation +25
sk-8Rzd2yCbFzOi1vxojseH8C5D8w3u4aMdNWsPNzxk0G7339Cz at SKILL.md:47 is a plausible real Agnes AI key, not a placeholder. Exposed in a published skill file.
Undeclared resource capabilities +15
SKILL.md does not declare any allowed-tools (shell:WRITE, filesystem:WRITE, network:READ) despite calling curl, writing files, and making HTTP requests
Doc-to-code mismatch on implementation +10
SKILL.md references scripts/agnes_gen.py but no scripts/ directory or code files exist. The skill is documentation-only with no executable.
Network requests to external API not declared +5
Calls to apihub.agnes-ai.com are documented but not declared as a resource capability
最关键的证据
高危 凭证窃取
Hardcoded real API key in SKILL.md
A plausible real Agnes AI API key (sk-8Rzd2yCbFzOi1vxojseH8C5D8w3u4aMdNWsPNzxk0G7339Cz) is embedded at line 47 of SKILL.md. Unlike the 'your-api-key-here' placeholders, this follows a valid key format and may be a genuine credential. If this is a real key, anyone who accesses the skill can use it at the owner's expense.
SKILL.md:47 Remove the hardcoded key from SKILL.md. Only document the key format (sk-*) and sourcing instructions without embedding a real credential. Users should set AGNES_API_KEY via environment variables.
中危 文档欺骗
Referenced implementation script does not exist
SKILL.md extensively references scripts/agnes_gen.py as the recommended way to use the skill, but no scripts/ directory or code files exist in the package. The skill is entirely documentation.
SKILL.md:60 Either provide the actual scripts/agnes_gen.py implementation, or remove references to it from documentation. A skill that cannot execute its primary documented workflow is deceptive.
中危 权限提升
No allowed-tools declarations for required capabilities
The skill uses curl/bash for HTTP requests, writes files to save images, and calls PowerShell/Python — all of which require declared allowed-tools. SKILL.md declares NONE for all resources despite the implied capabilities. The allowed-tools mapping shows Bash→shell:WRITE, Write→filesystem:WRITE, WebFetch→network:READ, but these are never explicitly declared.
SKILL.md:1 Add an allowed-tools declaration in SKILL.md frontmatter: shell (for curl/PowerShell execution), filesystem (for image saving), network (for API calls).
低危 凭证窃取
Placeholder credentials in documentation examples
Lines 29 and 32 show 'your-api-key-here' placeholder text in environment variable examples. While these are clearly placeholders, they appear in close proximity to the real API key and could confuse users about which key to use.
SKILL.md:29 Use a clearly distinguished placeholder like '<YOUR_API_KEY>' to avoid confusion with the real embedded key.
声明能力 vs 实际能力
网络访问 阻止
声明 NONE
→ 推断 READ
SKILL.md makes POST requests to https://apihub.agnes-ai.com but never declares network:READ capability 文件系统 阻止
声明 NONE
→ 推断 WRITE
SKILL.md documents saving images to local paths via PowerShell/Python but never declares filesystem:WRITE capability 命令执行 阻止
声明 NONE
→ 推断 WRITE
SKILL.md documents curl/bash commands throughout but never declares shell:WRITE capability 可疑产物与外联
严重 API 密钥
sk-8Rzd2yCbFzOi1vxojseH8C5D8w3u4aMdNWsPNzxk0G7339Cz SKILL.md:47
高危 API 密钥
API_KEY = "your-api-key-here" SKILL.md:29
高危 API 密钥
API_KEY="your-api-key-here" SKILL.md:32
中危 外部 URL
https://agnes-ai.com SKILL.md:50
中危 外部 URL
https://apihub.agnes-ai.com/v1/images/generations SKILL.md:98
中危 外部 URL
https://apihub.agnes-ai.com/v1/images/edits SKILL.md:119
中危 外部 URL
https://clawhub.ai/user/jiuwu2495 skill-card.md:7
中危 外部 URL
https://clawhub.ai/jiuwu2495/agnes-image-gen skill-card.md:29
依赖与供应链
没有结构化依赖告警。
文件构成
3 个文件 · 540 行
Markdown 2 个文件 · 535 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Hardcoded real API key in SKILL.md · Referenced implementation script does not exist · No allowed-tools declarations for required capabilities · Placeholder credentials in documentation examples · sk-8Rzd2yCbFzOi1vxojseH8C5D8w3u4aMdNWsPNzxk0G7339Cz · API_KEY = "your-api-key-here" · API_KEY="your-api-key-here" · https://agnes-ai.com · https://apihub.agnes-ai.com/v1/images/generations · https://apihub.agnes-ai.com/v1/images/edits
skill-card.md https://clawhub.ai/user/jiuwu2495 · https://clawhub.ai/jiuwu2495/agnes-image-gen
其他文件 · _meta.json
安全亮点
No malicious code execution, reverse shell, or C2 communication found
No obfuscated code, base64 payloads, or anti-analysis techniques
No sensitive path access (no ~/.ssh, ~/.aws, .env reads)
No supply chain risks (no package dependencies, no dependency files)
No persistence mechanisms or backdoor installation
No prompt injection or jailbreak instructions