The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/providers/google.ts file executes shell commands using child_process.execSync to perform image generation requests via curl when a proxy is detected. The command string directly interpolates the url variable, which is constructed from a user-provided model identifier (--model or -m flag). Since this input is not sanitized or escaped before being placed inside a double-quoted shell string, an attacker can perform command injection by providing a model ID containing shell metacharacters (e.g., "; <malicious_command>; #). This allows for arbitrary code execution on the host machine.\n- [DATA_EXFILTRATION]: The skill facilitates and recommends the use of a third-party proxy service, xheai.cc. When the xheai provider is used, the script sends the user's OPENAI_API_KEY to api.xheai.cc. This practice exposes sensitive authentication credentials to an unverified third party, significantly increasing the risk of API key theft and unauthorized usage of the user's accounts.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from prompts and external files that can influence command-line arguments. An attacker could craft a malicious input that tricks the agent into selecting the Google provider and passing a malicious payload to the --model parameter, triggering the shell command injection vulnerability described in the [COMMAND_EXECUTION] finding.\n- [CREDENTIALS_UNSAFE]: The scripts/main.ts file loads environment variables from a .env file located in the current working directory (.baoyu-skills/.env). This behavior allows for configuration poisoning; if a user is tricked into running the skill within a directory containing a malicious .env file, an attacker could override API keys, base URLs, or proxy settings to intercept or manipulate credentials and network traffic.

baoyu-image-gen