爱创AI-电商专用AI创作智能体工具_AI图片生成_AI视频生成_AI电商详情图生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 1.0.8

Overview

The skill is a coherent AI-commerce service integration, but it needs review because it asks users to paste reusable account tokens and can batch-delete platform assets without a required final confirmation.

Install only if you are comfortable giving this skill a 51aic account token and uploading selected product images to the listed external service domains. Avoid pasting long-lived or broad account tokens into shared conversations, and require the agent to show exact asset IDs and ask for final confirmation before any deletion.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

Authentication Credentials Are Retained in Conversation Context

Content

View full analysis

" BASE_API = "aicraft.51aic.com" def api_post(url, payload, token): data = json.dumps(payload, ensure_ascii=False).encode("utf-8") headers = {"Content-Type": "application/json; charset=utf-8", "Token": token} req = urllib.request.Request(url, data=data, headers=headers) with urllib.request.urlopen(req, timeout=60) as resp: return json.loads(resp.read().decode("utf-8")) ``` The Skill also instructs the Agent to cache a derived payment authorization credential for approximately two hours in the same conversation. ### Technical Analysis A login token and its derived payment authorization value are bearer credentials. Any party that obtains them can potentially act with the privileges associated with the user's account without knowing an additional password. Conversation context is not established as a protected secret store. Depending on the host Agent, it may be included in transcripts, diagnostic logs, model context, tool-call records, observability systems, or persistent conversation storage. The Skill does not require: - ...[truncated 2074 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64

Finding

Broad Credentials Are Transmitted to Multiple Service Domains Without Documented Scope Isolation

Content

View full analysis

" B64=$(openssl base64 -in "$FILE_PATH" | tr -d '\n') curl -s -X POST "https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2" \ -H "Content-Type: application/json; charset=utf-8" \ -H "Token: " \ -d "{\"ossFilePath\":\"tools/aiCraft/1m/$DATE/$UUID.$EXT\",\"fileBase64\":\"data:$MIME;base64,$B64\"}" ``` The same class of user token is also transmitted to the main API: ```bash curl -s -X POST "https://aicraft.51aic.com/api/v1/Conversation/Search" \ -H "Content-Type: application/json; charset=utf-8" \ -H "Token: " \ -d '{"projectType": "IMAGE", "pageIndex": 1, "pageSize": 1, "sortField": "lastMessageAt", "sortType": "desc"}' ``` A derived authorization credential is subsequently sent to a payment API on the file-service domain: ```bash curl -s -X POST "https://api.fzputi.com/payment/api/v1/Vas/GetQuantityByPackageType" \ -H "Content-Type: application/json; charset=utf-8" \ -H "Authorization: $AUTH" \ -d '{"ValueAddedServicesType": 4}' ``` ### Technical Analysis The network transfers are related to the declared cloud image and video processing functionality. In particular, base64 encoding is a transparent API transport format rather than covert obfuscation. Uploading a user-selected image is necessary when the requested operation must be performed by a remote cloud service. The security concern is credential delegation, not the base64 operation itself. The Skill sends authenticatio ...[truncated 2471 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:544

Finding

Destructive Batch Asset Deletion Does Not Require Final Confirmation

Content

View full analysis

" \ -d '{"assetIds": ["", ""]}' ``` The corresponding PowerShell implementation is: ```powershell $Body = '{"assetIds": ["", ""]}' $BodyBytes = [System.Text.Encoding]::UTF8.GetBytes($Body) Invoke-RestMethod -Uri "https://aicraft.51aic.com/api/v1/Asset/BatchDelete" -Method POST -Headers @{"Content-Type"="application/json; charset=utf-8"; "Token"=""} -Body $BodyBytes ``` The evaluation scenario also expects the Agent to search for failed style-replication assets, filter them, and call `Asset/BatchDelete` without specifying an intervening confirmation step. ### Technical Analysis Batch deletion is a destructive operation whose target set is produced by Agent interpretation and API filtering. Natural-language requests such as “delete failed works” can be ambiguous because failure status, asset type, date range, pagination, and ownership may not be represented exactly as expected. The Skill does not mandate: - Showing the complete target list and deletion count. - Obta ...[truncated 1974 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill mandates invocation for a very broad set of generic ecommerce image-related requests, including any scenario involving image upload or mention of related brand terms. This can force routing of sensitive user content and tokens to an external third-party service even when a narrower or local capability would suffice, increasing the chance of unnecessary data disclosure and overreach.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The eval explicitly expects batch deletion of assets after a search for failed style-replication works, but does not require any user confirmation, preview, or recovery step. This creates a clear path to unintended destructive actions from ambiguous or mistaken prompts, leading to irreversible loss of user assets.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to save the user's login token in conversation context for automatic reuse. Persisting bearer credentials in chat/session context increases the risk of accidental disclosure, cross-request misuse, logging exposure, or reuse beyond the user's intended scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

text

主 API 地址:    https://aicraft.51aic.com
文件上传地址:   https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2
图片 CDN:      https://oss.fzputi.com/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

text

主 API 地址:    https://aicraft.51aic.com
文件上传地址:   https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2
图片 CDN:      https://oss.fzputi.com/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

text

主 API 地址:    https://aicraft.51aic.com
文件上传地址:   https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2
图片 CDN:      https://oss.fzputi.com/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 478)May include surrounding context.

text

主 API 地址:    https://aicraft.51aic.com
文件上传地址:   https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2
图片 CDN:      https://oss.fzputi.com/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 615)May include surrounding context.

text

主 API 地址:    https://aicraft.51aic.com
文件上传地址:   https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2
图片 CDN:      https://oss.fzputi.com/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 627)May include surrounding context.

text

主 API 地址:    https://aicraft.51aic.com
文件上传地址:   https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2
图片 CDN:      https://oss.fzputi.com/

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The upload example explicitly transmits base64-encoded local image contents and a bearer token to an external domain. In this skill's context, where use is mandated for broad image-related requests, that creates a significant risk of unnecessary exposure of user media and credentials.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

MIME="image/$EXT"
[ "$EXT" = "jpg" ] && MIME="image/jpeg"

curl -s -X POST "https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d "{\"ossFilePath\":\"tools/aiCraft/1m/$DATE/$UUID.$EXT\",\"fileBase64\":\"data:$MIME;base64,$B64\"}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The upload example explicitly transmits base64-encoded local image contents and a bearer token to an external domain. In this skill's context, where use is mandated for broad image-related requests, that creates a significant risk of unnecessary exposure of user media and credentials.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

MIME="image/$EXT"
[ "$EXT" = "jpg" ] && MIME="image/jpeg"

curl -s -X POST "https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d "{\"ossFilePath\":\"tools/aiCraft/1m/$DATE/$UUID.$EXT\",\"fileBase64\":\"data:$MIME;base64,$B64\"}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes destructive asset deletion functionality without requiring an explicit confirmation step, preview of affected asset IDs, or undo/safety guidance. An agent following this skill could delete user assets based on ambiguous intent or a mistaken selection, causing irreversible loss of user data.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 574)May include surrounding context.

md

常见错误及处理方式：

| 错误码   | 含义              | 处理方式                                                                                                                    |
| -------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------- |
| 401      | Token 无效或过期  | 引导用户重新获取 token                                                                                                      |
| 999      | 任务发布失败      | 常见原因：① prompt 为空或不符合模式要求（非 Agent/自由创作模式必须使用默认 prompt）；② 参数格式错误。检查 prompt 和各字段值 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 576)May include surrounding context.

md

| 错误码   | 含义              | 处理方式                                                                                                                    |
| -------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------- |
| 401      | Token 无效或过期  | 引导用户重新获取 token                                                                                                      |
| 999      | 任务发布失败      | 常见原因：① prompt 为空或不符合模式要求（非 Agent/自由创作模式必须使用默认 prompt）；② 参数格式错误。检查 prompt 和各字段值 |
| 积分不足 | 积分不够生成      | 告知用户当前积分和所需积分                                                                                                  |
| 上传失败 | 图片格式/大小不符 | 检查图片格式(jpg/png/webp)和大小(≤10MB)                                                                                     |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 578)May include surrounding context.

md

| -------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------- |
| 401      | Token 无效或过期  | 引导用户重新获取 token                                                                                                      |
| 999      | 任务发布失败      | 常见原因：① prompt 为空或不符合模式要求（非 Agent/自由创作模式必须使用默认 prompt）；② 参数格式错误。检查 prompt 和各字段值 |
| 积分不足 | 积分不够生成      | 告知用户当前积分和所需积分                                                                                                  |
| 上传失败 | 图片格式/大小不符 | 检查图片格式(jpg/png/webp)和大小(≤10MB)                                                                                     |

## API 调用参考

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 579)May include surrounding context.

md

| 401      | Token 无效或过期  | 引导用户重新获取 token                                                                                                      |
| 999      | 任务发布失败      | 常见原因：① prompt 为空或不符合模式要求（非 Agent/自由创作模式必须使用默认 prompt）；② 参数格式错误。检查 prompt 和各字段值 |
| 积分不足 | 积分不够生成      | 告知用户当前积分和所需积分                                                                                                  |
| 上传失败 | 图片格式/大小不符 | 检查图片格式(jpg/png/webp)和大小(≤10MB)                                                                                     |

## API 调用参考

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 594)May include surrounding context.

macOS/Linux：

bash

AUTH=$(curl -s -X POST "https://aicraft.51aic.com/api/v1/PayPackage/GetToken" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{"appType": 6}' | grep -o '"result":"[^"]*"' | sed 's/"result":"//;s/"$//')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 615)May include surrounding context.

macOS/Linux：

bash

curl -s -X POST "https://api.fzputi.com/payment/api/v1/Vas/GetQuantityByPackageType" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Authorization: $AUTH" \
  -d '{"ValueAddedServicesType": 4}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 699)May include surrounding context.

macOS/Linux：

bash

curl -s -X POST "https://aicraft.51aic.com/api/v1/Task/Publish" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 754)May include surrounding context.

macOS/Linux：

bash

curl -s -X POST "https://aicraft.51aic.com/api/v1/Task/GetProgress" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{"conditions":[{"taskJobId":"<任务ID>","taskType":2}]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 810)May include surrounding context.

macOS/Linux：

bash

curl -s -X POST "https://aicraft.51aic.com/api/v1/DetailImage/GenerateBatchImages" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{"batchid": "<batchId>"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 904)May include surrounding context.

macOS/Linux：

bash

curl -s -X POST "https://aicraft.51aic.com/api/v1/DetailImage/GetBatchProgress" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{"batchIds": ["<batchId>"]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This documents an authenticated bulk deletion call to remove user assets on an external service. Because the skill lacks a mandatory confirmation and preview step for deletion, the documented capability materially increases the risk of accidental or manipulated destructive actions.

Content

Scanner excerpt · SKILL.md (reported line 956)May include surrounding context.

macOS/Linux：

bash

curl -s -X POST "https://aicraft.51aic.com/api/v1/Asset/BatchDelete" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{"assetIds": ["<assetId1>", "<assetId2>"]}'

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The eval prompts define very broad activation conditions for an external-content-generation skill without meaningful scope limits or safety gating. This can cause the agent to invoke the skill for loosely related requests and route user data or actions into image/video generation and asset-management workflows that the user did not explicitly intend.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

All prompts and expected outputs are written only in Chinese, and the expected behavior is framed entirely around Chinese-language interactions without any indication that users may choose another language. This can constitute a language/locale policy issue when the skill implicitly assumes a single language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.