自动广告生成器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 1.0.1

Overview

This ad-generation skill has a coherent creative purpose, but its install and runtime behavior include under-disclosed external execution and paid network API use.

Review this skill before installing. Do not run the documented `curl | bash` installer unless you independently trust and verify the Dreamina source. Treat the PIL backend as potentially networked and paid unless the code is changed to call PIL directly. Use a restricted environment with only the image files and API credentials you intend the skill to access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:261

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

dreamina-cli.tar.gz" | sha256sum --check ``` 7. Document the files the installer creates and the permissions it needs. 8. Install into a user-scoped directory without administrator privileges. 9. Make Dreamina explicitly optional because local Pillow generation does not require it. 10. Replace the mutable URL in `package.json` with a pinned package version and lockfile integrity metadata. 11. If no independently verifiable official release exists, do not recommend automated installation of the CLI. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_background.py:61

Finding

Documented Local Pillow Backend Silently Attempts External DALL-E Generation

Content

View full analysis

Remediation

View remediation

maximum_size: raise ValueError("Downloaded image exceeds size limit") output.write(chunk) ``` 7. Restrict downloads to HTTPS and expected provider-controlled hosts. 8. Decode and verify the downloaded file with Pillow before treating it as an image. 9. Apply Pillow decompression-bomb protections and reasonable pixel-dimension limits. 10. Catch specific expected exceptions rather than all exceptions, and report clearly whether local fallback occurred. 11. Add tests asserting that `--backend pil` performs no network calls and does not access API credentials. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description significantly overstates and generalizes the functionality. The supplied code is a narrowly scoped local compositor for automotive ads: it resizes a background to 1080x1920, places a car image with shadow, optionally adds a celebrity and logo, and overlays text in one of three preset styles. There is no implementation of AI background generation, no Dreamina/即梦 integration, no generalized multi-industry templates, and no multi-platform export logic. While the code does fit part of the description at a high level—creating advertisement poster composites—it is materially narrower in purpose and capabilities than declared, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad commercial-poster creation skill spanning multiple industries and full ad-layout production. The supplied code is much narrower: it only creates a standalone background image, specifically tuned to luxury automotive aesthetics, using either DALL-E or a local PIL gradient fallback. There is no code for assembling posters, placing products, adding text, handling uploaded images, supporting non-automotive industries, or exporting specialized platform variants. Additionally, the code relies on an external OpenAI image API and downloads the resulting image via HTTP, which is a resource access capability not reflected in the declared permissions. This is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill instructs users to install Dreamina via 'curl ... | bash', which executes a remotely fetched script without inspection or integrity verification. If the remote host, network path, or script is compromised, arbitrary code can run on the system immediately with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

### 必需的二进制文件
- `python3` - Python 3.8+
- `dreamina` - Dreamina CLI (通过 `curl -s https://jimeng.jianying.com/cli | bash` 安装)

### 必需的环境变量
- `DREAMINA_API_KEY` - Dreamina API 密钥

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This repeats the same unsafe installation pattern in the prerequisites section, again normalizing execution of an unverified remote script. Duplicating the instruction increases the likelihood that operators will follow it, making compromise more probable.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

Prerequisites

bash

# Install Dreamina CLI
curl -s https://jimeng.jianying.com/cli | bash

# Login (required before use)
dreamina login --headless

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The explicit '| bash' command chains network retrieval directly into shell execution, eliminating any review boundary between download and execution. In a skill context, this is especially dangerous because it can encourage automated or semi-automated environments to run attacker-controlled code.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

Prerequisites

bash

# Install Dreamina CLI
curl -s https://jimeng.jianying.com/cli | bash

# Login (required before use)
dreamina login --headless

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill declares requirements for binaries, environment variables, and demonstrates shell/network/file-capable workflows, but does not define any explicit tool scope such as allowed-tools or permissions. That omission increases the blast radius if the skill is invoked automatically, because an agent may grant broader execution capabilities than necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough that the skill may activate for generic requests about ads, posters, or style replication, even when the user did not intend to invoke a shell/network-capable workflow. In the context of a skill with external tooling and downloads, overbroad activation increases the chance of unintended execution and data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This JSON eval defines the prompt, title, slogan, and expectations entirely in Chinese, which implicitly constrains the skill to a specific language/locale. The file does not indicate that Chinese output is optional, user-selected, or required for a justified region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains multiple user-facing prompts entirely in Chinese, such as the generator title, backend selection, and input questions. Because the skill does not offer an alternative language or obtain user opt-in for the locale, it creates a natural-language policy issue under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file uses NotoSansSC fonts throughout the typography presets and includes Chinese-only example copy in the text configuration docstring. This suggests the skill is designed around a specific language/locale, but there is no user opt-in or documentation that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dreamina_backend.py (reported line 16)May include surrounding context.

python

def check_login():
    """Check if user is logged in to Dreamina."""
    result = subprocess.run(
        ["dreamina", "user_credit"],
        capture_output=True,
        text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dreamina_backend.py (reported line 25)May include surrounding context.

python

def check_login():
    """Check if user is logged in to Dreamina."""
    result = subprocess.run(
        ["dreamina", "user_credit"],
        capture_output=True,
        text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dreamina_backend.py (reported line 62)May include surrounding context.

python

print(f"   Prompt: {prompt[:60]}...")
    print(f"   Ratio: {ratio}, Model: {model_version}")
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Generation failed: {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dreamina_backend.py (reported line 117)May include surrounding context.

python

print(f"   Prompt: {prompt[:60]}...")
    print(f"   Ratio: {ratio}, Model: {model_version}")
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Generation failed: {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dreamina_backend.py (reported line 77)May include surrounding context.

python

def query_result(submit_id):
    """Query result of a submitted task."""
    result = subprocess.run(
        ["dreamina", "query_result", f"--submit_id={submit_id}"],
        capture_output=True,
        text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dreamina_backend.py (reported line 89)May include surrounding context.

python

def upscale_image(submit_id):
    """Upscale an existing image."""
    result = subprocess.run(
        ["dreamina", "image_upscale", f"--submit_id={submit_id}"],
        capture_output=True,
        text=True

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The document switches into Chinese for dependency and platform sections while other parts are in English, but it does not state that the language is optional or user-selectable. This can impose a language expectation on users without opt-in, which may conflict with language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The JSON contains a Chinese phrase in the usage field while the surrounding content is otherwise English. This creates an implicit language/locale inconsistency that could surface user-facing content in a language the user did not choose, and there is no documented opt-in or region-specific justification in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file includes a dedicated section titled 'Chinese Typography Specifics' with prescriptive instructions such as using full-width Chinese punctuation and character-count guidance, but it does not state that these recommendations are optional, user-selected, or limited to Chinese-language campaigns. That can amount to an implicit locale preference without opt-in, which falls under natural-language language/locale policy concerns.

Content

No source excerpt is available for this finding.