Hitem3D

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:47 AM UTC
• Version: 0.2.2

Overview

The skill matches its Hitem3D image-to-3D purpose, but it needs review because its script exposes API tokens and credentials more than necessary.

Review before installing. Use only with images you are comfortable sending to Hitem3D, expect credit consumption for generation jobs, avoid running the auth command in logged terminals, and prefer a scoped short-lived token if available. Rotate Hitem3D credentials if tokens or Authorization headers may have been captured in logs or process monitoring.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hitem3d.sh:151

Finding

Bearer Token Exposed Through Standard Output

Content

View full analysis

&2 _die "Auth failed" fi } ``` ### Technical Analysis The public `auth` command returns the Hitem3D bearer token directly through standard output. This conflicts with the security rule in `SKILL.md` that bearer tokens must never be echoed. Standard output may be retained in Agent transcripts, CI logs, terminal capture systems, shell automation, or observability platforms. The token is therefore exposed outside the minimum internal scope required to authenticate subsequent API calls. Although internal command substitution also relies on this output, the same function is directly accessible through the command dispatcher as `scripts/hitem3d.sh auth`, making accidental disclosure straightforward. ### Attack Path 1. A user, Agent, diagnostic process, or CI job invokes `scripts/hitem3d.sh auth`. 2. The script authenticates with the configured AK/SK credentials. 3. The returned bearer token is printed to standard output. 4. A transcript, build log, terminal recorder, or other output collector stores the token. 5. A party with access to that output retrieves the token. 6. ...[truncated 639 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hitem3d.sh:151

Finding

Authentication Secrets Exposed in Curl Process Arguments

Content

View full analysis

&2 _die "Auth failed" fi } ``` Bearer tokens are passed through the same mechanism: ```bash cmd_balance() { local token token=$(get_token) curl -fsS -X GET "${API_BASE}/open-api/v1/balance" \ -H "Authorization: Bearer ${token}" \ -H "Content-Type: application/json" } ``` ```bash _submit_single() { local token="$1" local curl_args=( -fsS -X POST "${API_BASE}/open-api/v1/submit-task" -H "Authorization: Bearer ${token}" -F "model=${MODEL}" -F "request_type=${REQUEST_TYPE}" -F "resolution=${RESOLUTION}" -F "format=${FORMAT}" -F "images=@${IMAGE}" ) [[ -n "$FACE" ]] && curl_args+=(-F "face=${FACE}") [[ -n "$CALLBACK_URL" ]] && curl_args+=(-F "callback_url=${CALLBACK_URL}") curl "${curl_args[@]}" } ``` ```bash cmd_status() { local task_id="${1:-}" [[ -n "$task_id" ]] || _die "Missing task_id" local token tok ...[truncated 2120 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hitem3d.sh:171

Finding

Polling Workflow Repeatedly Reauthenticates With Long-Lived Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

Use this skill to turn images into downloadable 3D models via `scripts/hitem3d.sh`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/hitem3d.sh (reported line 5)May include surrounding context.

sh

# hitem3d.sh — CLI wrapper for Hitem3D API
#
# Commands:
#   auth                                  Get access token
#   balance                               Query credit balance
#   generate <image> [options]            Submit single-image task
#   generate-multi <img...> --views BITS  Submit multi-view task (2-4 images)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/hitem3d.sh (reported line 548)May include surrounding context.

sh

# hitem3d.sh — CLI wrapper for Hitem3D API
#
# Commands:
#   auth                                  Get access token
#   balance                               Query credit balance
#   generate <image> [options]            Submit single-image task
#   generate-multi <img...> --views BITS  Submit multi-view task (2-4 images)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes a shell script and provides numerous executable command patterns, but it does not declare any explicit tool restrictions such as allowed-tools or permissions. That creates an overly broad execution surface where the agent may run shell commands without a narrowly scoped policy boundary, increasing the chance of unintended command execution or abuse if user-controlled inputs are passed through operational workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example prompt at this line is very broad and can match ordinary user requests like converting an image to 3D without any explicit skill-selection boundary. In agent ecosystems that rely on natural-language trigger matching, overly generic invocation phrases can cause unintended activation, route sensitive files or user content into this skill unexpectedly, and increase the chance of unreviewed external API usage and downloads.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The English example trigger is similarly broad and lacks qualifiers that would distinguish this skill from general-purpose image, design, or 3D tools. Because this skill can submit jobs, wait, and download outputs from an external service, accidental invocation is more dangerous here than for a read-only skill: it can consume credits, transmit user-provided images, and create unintended files or artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The example prompts are exclusively in Chinese, and the guide does not indicate that the skill supports multiple languages or lets the user choose a locale. This can constitute a language/locale policy issue because it implicitly constrains use to a specific language without documenting opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generate path posts local image content to an external service using curl multipart upload, but the script provides no explicit user disclosure at the point of action about sending user files off-system. The surrounding comments and help text describe submission mechanics, but they do not warn that local images will be transmitted to a third-party API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This markdown file describes uploading user-provided images to a remote API and optionally sending status updates to a callback URL, both of which can affect user data privacy. The section is purely operational and does not include any warning or disclosure about external data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The script reads access and secret keys from environment variables and transmits them to obtain an API token, but it does not include a user-facing notice that sensitive credentials are required and will be used for remote authentication. The environment variable list names the fields, yet it does not warn users to treat them as secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.