registry / koishi-plugin-aka-ai-image-generator / 0.8.11

koishi-plugin-aka-ai-image-generator@0.8.11

AI image generator for Koishi (V2: semantic supplier UI, image protocols, credit billing).

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A chat user can supply an image URL that the Koishi host fetches. The fetched bytes can then be sent to the configured image-generation provider, creating SSRF-mediated data exposure.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes an image generation or editing command with an HTTP image URL.

Impact

Potential access to reachable internal services and exfiltration of response bytes to a configured provider.

Mechanism

Unrestricted server-side image fetch followed by provider upload.

Rationale

Source inspection found no malicious lifecycle, persistence, credential harvesting, or arbitrary payload execution. However, unrestricted user-controlled image fetching creates a concrete SSRF path whose response is forwarded to external configured AI providers.

Evidence

dist/index.jspackage.json

Network endpoints2

generativelanguage.googleapis.comapi.openai.com/v1

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

`dist/index.js` downloads caller-provided image URLs through `ctx.http.get` without host restrictions.
Downloaded URL content is base64-encoded and submitted to configured image-provider requests.
The request path supports `http` image inputs and the download helper accepts arbitrary non-`internal:` URLs.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
`new Function` only implements an ESM fallback for two fixed optional ChatLuna module specifiers.
Observed API keys are configuration fields used as provider credentials and are redacted in logs.
Filesystem writes are limited to plugin data under `ctx.baseDir/data/aka-ai-image-generator`.

Behavioral surface

Source

DynamicRequireEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 440 KB of source, external domains: api.openai.com, generativelanguage.googleapis.com, yunwu.ai

Source & flagged code

4 flagged

dist/index.jsView file

Lines 18-58javascript

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

21 // If the importer is in node compatibility mode or this is not an ESM

22 // file that has been converted to a CommonJS file using a Babel-

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// src/index.ts

31var index_exports = {};

32__export(index_exports, {

33 Config: () => Config2,

34 apply: () => apply,

35 inject: () => inject,

36 name: () => name

37});

38module.exports = __toCommonJS(index_exports);

39var import_node_path = __toESM(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L38

41// src/shared/chatluna-tool-definitions.ts

42var AI_GENERATOR_TOOL_DEFINITIONS = [

43 {

44 name: "aigc_generate_image",

45 description: "Generate one or more images from a natural-language prompt.",

46 usage: "Use this for pure text-to-image requests. Prefer this when the user asks to generate a fresh image without referencing an existing one.",

47 riskLevel: "low",

48 inputSchema: {

49 type: "object",

50 properties: {

51 prompt: { type: "string", description: "Image generation prompt." },

52 numImages: {

53 type: "number",

54 minimum: 1,

55 maximum: 4,

56 description: "Number of images to generate."

57 },

58 aspectRatio: {

Lines 421-461javascript

421var import_node_module = require("module");

422var runtimeRequire = (0, import_node_module.createRequire)(`${process.cwd()}/package.json`);

423async function loadChatLunaRuntime() {

424 const [chatlunaModule, langchainToolsModule] = await Promise.all([

425 loadRuntimeModule("koishi-plugin-chatluna/services/chat"),

426 loadRuntimeModule("@langchain/core/tools")

427 ]);

428 const ChatLunaPlugin = chatlunaModule.ChatLunaPlugin;

429 const StructuredTool = langchainToolsModule.StructuredTool;

430 if (!ChatLunaPlugin) {

431 throw new Error("ChatLunaPlugin export not found from koishi-plugin-chatluna/services/chat.");

432 }

433 if (!StructuredTool) {

434 throw new Error("StructuredTool export not found from @langchain/core/tools.");

435 }

436 return { ChatLunaPlugin, StructuredTool };

437}

438async function loadRuntimeModule(specifier) {

439 try {

440 return runtimeRequire(specifier);

441 } catch (requireError) {

442 const dynamicImport = new Function("s", "return import(s)");

443 return dynamicImport(specifier).catch((importError) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L441

444 const requireMessage = requireError instanceof Error ? requireError.message : String(requireError);

445 const importMessage = importError instanceof Error ? importError.message : String(importError);

446 throw new Error(

447 `failed to load runtime module "${specifier}"; require: ${requireMessage}; import: ${importMessage}`

448 );

449 });

450 }

451}

452

453// src/bridge/chatluna/tool-runtime.ts

454var import_koishi = require("koishi");

455

456// src/shared/billing.ts

457function calculateGenerationCost(params) {

458 const numImages = normalizePositiveInteger(params.numImages, 1);

459 const defaultCost = normalizeNonNegativeNumber(params.config.defaultCreditCostPerImage, 1);

460 const modelCost = normalizeOptionalNonNegativeNumber(params.modelMapping?.creditCostPerImage);

461 const creditCostPerImage = modelCost ?? defaultCost;

Lines 2395-2435javascript

2395 }

2396 if (Array.isArray(error)) {

2397 return error.map((item) => sanitizeError(item));

2398 }

2399 if (typeof error === "object") {

2400 const sanitized = {};

2401 for (const key in error) {

2402 const lowerKey = key.toLowerCase();

2403 if (lowerKey.includes("apikey") || lowerKey.includes("api_key") || lowerKey.includes("api-key") || lowerKey === "key" || lowerKey === "authorization" || lowerKey === "token" || lowerKey === "secret" || lowerKey === "password") {

2404 sanitized[key] = "[REDACTED]";

2405 continue;

2406 }

2407 sanitized[key] = sanitizeError(error[key]);

2408 }

2409 return sanitized;

2410 }

2411 return error;

2412}

2413function sanitizeString(str) {

2414 if (typeof str !== "string") return str;

2415 return str.replace(/key["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'key="[REDACTED]"').replace(/apikey["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'apikey="[REDACTED]"').replace(/api_key["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'api_key="[REDACTED]"').replace(/api-key["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'api-key="[REDACTED]"').replace(/x-api-key["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'x-api-key="[REDACTED]"').replace(/authorization["'\s:=]+(Bearer\s+)?([a-zA-Z0-9_-]{10,})/gi, 'authorization="[REDACTED]"').replace(/Bearer\s+([a-zA-Z0-9_-]{10,})/gi, "Bearer [REDACTED]").replace(/([?&])key=([a-zA-Z0-9_-]{10,})/gi, "$1key=[REDACTED] ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L2415

2416}

2417async function downloadImageAsBase64(ctx, url, timeout, logger, maxSize = 10 * 1024 * 1024) {

2418 try {

2419 let buffer;

2420 if (url.startsWith("internal:")) {

2421 logger.debug("\u68C0\u6D4B\u5230 Koishi \u5185\u90E8\u534F\u8BAE URL\uFF0C\u4F7F\u7528 ctx.http.file() \u83B7\u53D6", { url: url.substring(0, 80) });

2422 try {

2423 const fileResult = await ctx.http.file(url, { timeout: timeout * 1e3 });

2424 buffer = Buffer.from(fileResult.data);

2425 logger.info("Koishi \u5185\u90E8\u534F\u8BAE\u8D44\u6E90\u83B7\u53D6\u6210\u529F", {

2426 url: url.substring(0, 80),

2427 size: buffer.length,

2428 type: fileResult.type

2429 });

2430 } catch (internalError) {

2431 logger.error("Koishi \u5185\u90E8\u534F\u8BAE\u8D44\u6E90\u83B7\u53D6\u5931\u8D25", {

2432 url: url.substring(0, 80),

2433 error: sanitizeError(internalError),

2434 message: internalError?.message

2435 });

Long lines were clipped for display.

dist/index.mjsView file

Lines 2358-2398javascript

2358 }

2359 if (Array.isArray(error)) {

2360 return error.map((item) => sanitizeError(item));

2361 }

2362 if (typeof error === "object") {

2363 const sanitized = {};

2364 for (const key in error) {

2365 const lowerKey = key.toLowerCase();

2366 if (lowerKey.includes("apikey") || lowerKey.includes("api_key") || lowerKey.includes("api-key") || lowerKey === "key" || lowerKey === "authorization" || lowerKey === "token" || lowerKey === "secret" || lowerKey === "password") {

2367 sanitized[key] = "[REDACTED]";

2368 continue;

2369 }

2370 sanitized[key] = sanitizeError(error[key]);

2371 }

2372 return sanitized;

2373 }

2374 return error;

2375}

2376function sanitizeString(str) {

2377 if (typeof str !== "string") return str;

2378 return str.replace(/key["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'key="[REDACTED]"').replace(/apikey["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'apikey="[REDACTED]"').replace(/api_key["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'api_key="[REDACTED]"').replace(/api-key["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'api-key="[REDACTED]"').replace(/x-api-key["'\s:=]+([a-zA-Z0-9_-]{10,})/gi, 'x-api-key="[REDACTED]"').replace(/authorization["'\s:=]+(Bearer\s+)?([a-zA-Z0-9_-]{10,})/gi, 'authorization="[REDACTED]"').replace(/Bearer\s+([a-zA-Z0-9_-]{10,})/gi, "Bearer [REDACTED]").replace(/([?&])key=([a-zA-Z0-9_-]{10,})/gi, "$1key=[REDACTED] ...

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L2378

2379}

2380async function downloadImageAsBase64(ctx, url, timeout, logger, maxSize = 10 * 1024 * 1024) {

2381 try {

2382 let buffer;

2383 if (url.startsWith("internal:")) {

2384 logger.debug("\u68C0\u6D4B\u5230 Koishi \u5185\u90E8\u534F\u8BAE URL\uFF0C\u4F7F\u7528 ctx.http.file() \u83B7\u53D6", { url: url.substring(0, 80) });

2385 try {

2386 const fileResult = await ctx.http.file(url, { timeout: timeout * 1e3 });

2387 buffer = Buffer.from(fileResult.data);

2388 logger.info("Koishi \u5185\u90E8\u534F\u8BAE\u8D44\u6E90\u83B7\u53D6\u6210\u529F", {

2389 url: url.substring(0, 80),

2390 size: buffer.length,

2391 type: fileResult.type

2392 });

2393 } catch (internalError) {

2394 logger.error("Koishi \u5185\u90E8\u534F\u8BAE\u8D44\u6E90\u83B7\u53D6\u5931\u8D25", {

2395 url: url.substring(0, 80),

2396 error: sanitizeError(internalError),

2397 message: internalError?.message

2398 });

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

dist/index.jsView file

2415patternName = generic_password severity = medium line = 2415 matchedText = return s..."');

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L2415

38module.exports = __toCommonJS(index_exports); L39: var import_node_path = __toESM(require("path")); L40:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L38

441} catch (requireError) { L442: const dynamicImport = new Function("s", "return import(s)"); L443: return dynamicImport(specifier).catch((importError) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L441

dist/index.mjsView file

2378patternName = generic_password severity = medium line = 2378 matchedText = return s..."');

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L2378

Findings

3 Medium5 Low

MediumSecret Patterndist/index.js

MediumDynamic Requiredist/index.js

MediumSecret Patterndist/index.mjs

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 18-58javascript

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

21 // If the importer is in node compatibility mode or this is not an ESM

22 // file that has been converted to a CommonJS file using a Babel-

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// src/index.ts

31var index_exports = {};

32__export(index_exports, {

33 Config: () => Config2,

34 apply: () => apply,

35 inject: () => inject,

36 name: () => name

37});

38module.exports = __toCommonJS(index_exports);

39var import_node_path = __toESM(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L38

41// src/shared/chatluna-tool-definitions.ts

42var AI_GENERATOR_TOOL_DEFINITIONS = [

43 {

44 name: "aigc_generate_image",

45 description: "Generate one or more images from a natural-language prompt.",

46 usage: "Use this for pure text-to-image requests. Prefer this when the user asks to generate a fresh image without referencing an existing one.",

47 riskLevel: "low",

48 inputSchema: {

49 type: "object",

50 properties: {

51 prompt: { type: "string", description: "Image generation prompt." },

52 numImages: {

53 type: "number",

54 minimum: 1,

55 maximum: 4,

56 description: "Number of images to generate."

57 },

58 aspectRatio: {

Lines 421-461javascript

421var import_node_module = require("module");

422var runtimeRequire = (0, import_node_module.createRequire)(`${process.cwd()}/package.json`);

423async function loadChatLunaRuntime() {

424 const [chatlunaModule, langchainToolsModule] = await Promise.all([

425 loadRuntimeModule("koishi-plugin-chatluna/services/chat"),

426 loadRuntimeModule("@langchain/core/tools")

427 ]);

428 const ChatLunaPlugin = chatlunaModule.ChatLunaPlugin;

429 const StructuredTool = langchainToolsModule.StructuredTool;

430 if (!ChatLunaPlugin) {

431 throw new Error("ChatLunaPlugin export not found from koishi-plugin-chatluna/services/chat.");

432 }

433 if (!StructuredTool) {

434 throw new Error("StructuredTool export not found from @langchain/core/tools.");

435 }

436 return { ChatLunaPlugin, StructuredTool };

437}

438async function loadRuntimeModule(specifier) {

439 try {

440 return runtimeRequire(specifier);

441 } catch (requireError) {

442 const dynamicImport = new Function("s", "return import(s)");

443 return dynamicImport(specifier).catch((importError) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L441

444 const requireMessage = requireError instanceof Error ? requireError.message : String(requireError);

445 const importMessage = importError instanceof Error ? importError.message : String(importError);

446 throw new Error(

447 `failed to load runtime module "${specifier}"; require: ${requireMessage}; import: ${importMessage}`

448 );

449 });

450 }

451}

452

453// src/bridge/chatluna/tool-runtime.ts

454var import_koishi = require("koishi");

455

456// src/shared/billing.ts

457function calculateGenerationCost(params) {

458 const numImages = normalizePositiveInteger(params.numImages, 1);

459 const defaultCost = normalizeNonNegativeNumber(params.config.defaultCreditCostPerImage, 1);

460 const modelCost = normalizeOptionalNonNegativeNumber(params.modelMapping?.creditCostPerImage);

461 const creditCostPerImage = modelCost ?? defaultCost;

Lines 2395-2435javascript

2395 }

2396 if (Array.isArray(error)) {

2397 return error.map((item) => sanitizeError(item));

2398 }

2399 if (typeof error === "object") {

2400 const sanitized = {};

2401 for (const key in error) {

2402 const lowerKey = key.toLowerCase();

2404 sanitized[key] = "[REDACTED]";

2405 continue;

2406 }

2407 sanitized[key] = sanitizeError(error[key]);

2408 }

2409 return sanitized;

2410 }

2411 return error;

2412}

2413function sanitizeString(str) {

2414 if (typeof str !== "string") return str;

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L2415

2416}

2417async function downloadImageAsBase64(ctx, url, timeout, logger, maxSize = 10 * 1024 * 1024) {

2418 try {

2419 let buffer;

2420 if (url.startsWith("internal:")) {

2421 logger.debug("\u68C0\u6D4B\u5230 Koishi \u5185\u90E8\u534F\u8BAE URL\uFF0C\u4F7F\u7528 ctx.http.file() \u83B7\u53D6", { url: url.substring(0, 80) });

2422 try {

2423 const fileResult = await ctx.http.file(url, { timeout: timeout * 1e3 });

2424 buffer = Buffer.from(fileResult.data);

2425 logger.info("Koishi \u5185\u90E8\u534F\u8BAE\u8D44\u6E90\u83B7\u53D6\u6210\u529F", {

2426 url: url.substring(0, 80),

2427 size: buffer.length,

2428 type: fileResult.type

2429 });

2430 } catch (internalError) {

2431 logger.error("Koishi \u5185\u90E8\u534F\u8BAE\u8D44\u6E90\u83B7\u53D6\u5931\u8D25", {

2432 url: url.substring(0, 80),

2433 error: sanitizeError(internalError),

2434 message: internalError?.message

2435 });

Long lines were clipped for display.

dist/index.mjsView file

Lines 2358-2398javascript

2358 }

2359 if (Array.isArray(error)) {

2360 return error.map((item) => sanitizeError(item));

2361 }

2362 if (typeof error === "object") {

2363 const sanitized = {};

2364 for (const key in error) {

2365 const lowerKey = key.toLowerCase();

2367 sanitized[key] = "[REDACTED]";

2368 continue;

2369 }

2370 sanitized[key] = sanitizeError(error[key]);

2371 }

2372 return sanitized;

2373 }

2374 return error;

2375}

2376function sanitizeString(str) {

2377 if (typeof str !== "string") return str;

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L2378

2379}

2380async function downloadImageAsBase64(ctx, url, timeout, logger, maxSize = 10 * 1024 * 1024) {

2381 try {

2382 let buffer;

2383 if (url.startsWith("internal:")) {

2384 logger.debug("\u68C0\u6D4B\u5230 Koishi \u5185\u90E8\u534F\u8BAE URL\uFF0C\u4F7F\u7528 ctx.http.file() \u83B7\u53D6", { url: url.substring(0, 80) });

2385 try {

2386 const fileResult = await ctx.http.file(url, { timeout: timeout * 1e3 });

2387 buffer = Buffer.from(fileResult.data);

2388 logger.info("Koishi \u5185\u90E8\u534F\u8BAE\u8D44\u6E90\u83B7\u53D6\u6210\u529F", {

2389 url: url.substring(0, 80),

2390 size: buffer.length,

2391 type: fileResult.type

2392 });

2393 } catch (internalError) {

2394 logger.error("Koishi \u5185\u90E8\u534F\u8BAE\u8D44\u6E90\u83B7\u53D6\u5931\u8D25", {

2395 url: url.substring(0, 80),

2396 error: sanitizeError(internalError),

2397 message: internalError?.message

2398 });

Long lines were clipped for display.