Security audit

抖音电商图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Douyin e-commerce image-generation skill, but it needs review because its configurable API endpoint can receive API keys and uploaded media without clear host scoping or warning.

Install only if you trust AI Hive and understand that prompts, selected product images, and the API key are sent to the configured service. Avoid custom base URLs unless you fully trust the host, protect ~/.ai-hive/config.json and AI_HIVE_API_KEY as credentials, and prefer installing dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:91
Finding: Custom API Endpoint Can Expose Bearer Credentials and Uploaded Media
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:72
Finding: Unpinned Dependency Installation Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese across the substantive changelog entries. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the restriction is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill invokes shell commands, installs a Python package, and runs a script that can use network, filesystem, environment, and shell capabilities, yet the manifest declares no explicit tool restrictions. That creates an overly broad execution surface where a caller or downstream runtime may grant more access than the skill actually needs, increasing the chance of unintended file access, network egress, or command execution abuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description is broad enough to match many generic image-generation or editing requests, which can cause the agent to invoke this skill outside its intended e-commerce context. Overbroad routing is risky because the skill contains code execution paths and external dependencies, so unnecessary invocation expands exposure to its operational privileges.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is presented as a Douyin e-commerce image generation/editing skill, but its implementation exposes a broad generic AI Hive client with text chat, video generation, model enumeration, upload, and user-info functionality. This scope mismatch violates least-privilege expectations for a narrowly declared skill and increases the attack surface by giving downstream users capabilities they would not reasonably expect from the skill metadata.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s user-facing description and operational prompts are written exclusively in Chinese, and the skill does not provide any opt-in or alternative locale handling. Under the policy rule for natural-language constraints, this is a language/locale restriction that is not justified as a region-specific tool in the file itself.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Retrieving user account and wallet information is unrelated to generating or editing e-commerce images and unnecessarily expands access to potentially sensitive billing data. In a skill context, this can enable unexpected data exposure or reconnaissance about the connected account without a business need tied to the advertised function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The text chat capability is outside the declared purpose of e-commerce image generation/editing and creates an unnecessary general-purpose model interaction channel. That broader capability can be abused for unintended prompting, policy bypass attempts, or hidden data handling that users would not expect from an image-only skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Video generation is materially broader than the skill's stated image-generation/editing scope, especially in an e-commerce context where users may trust the skill to handle only still-image assets. Including video support enlarges the operational and abuse surface, including extra media ingestion paths and long-running generation workflows unrelated to the declared purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The natural-language description is primarily in Chinese but includes an English imperative ("Use this skill for ...") and does not state any language preference or opt-in behavior. This can create a language-policy issue if the skill implicitly assumes or enforces a language presentation without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The placeholder string 请替换为你的APIKey is written only in Chinese, which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may choose another language, so this appears to violate the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.