Security audit

即梦 Dreamina 图片生成替代｜AI 图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly matches its AI Hive image-generation purpose, but its helper script trusts remote service responses in ways that could overwrite local files or send/download data outside the documented scope.

Review this skill before installing. Use it only if you trust the AI Hive service and are comfortable sending prompts and selected reference images to it. Prefer a dedicated output directory with no important files, avoid sensitive reference images, and consider patching URL allowlists, filename sanitization, and download size/type limits before routine use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:219
Finding: Unvalidated Server-Provided Upload and Download URLs Enable Data Exfiltration and Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:320
Finding: Path Traversal in Server-Controlled Output Filenames Allows Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:247
Finding: Unbounded and Unvalidated Result Downloads Permit Disk Exhaustion and Arbitrary Content Storage
Content: View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) print() size_mb = downloaded / (1024 * 1024) print(f"[ok] {out_path} ({size_mb:.1f} MB)") except requests.exceptions.RequestException as e: print(f"\n[error] Download failed: {e}", file=sys.stderr) ``` ### Technical Analysis The download loop writes data until the remote server closes the response. There is no maximum response size, disk-space check, or streamed-byte limit. `Content-Length` is used only for progress reporting and is neither required nor enforced. The function also does not verify the response `Content-Type`, inspect the downloaded file signature, or decode the result as a valid image or video. The local extension is inferred from remote task metadata rather than the actual response content. Finally, the destination is written directly rather than through a temporary file. Network interruption, validation failure, or process termination can therefore leave a partial file at the ...[truncated 1209 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes local scripts, performs package installation, reads local files, and makes network requests, but it does not declare any explicit tool scope or permission boundaries. This creates an avoidable least-privilege failure: an agent may execute shell, filesystem, environment, and network actions without a clear contract, increasing the chance of unintended command execution, data exposure, or outbound requests beyond user expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description contains broad trigger phrases such as general searches for Dreamina alternatives, Chinese image generation, marketing images, and stable domestic image APIs, which can cause the skill to activate for requests outside its narrow migration purpose. Over-broad routing is dangerous here because the skill includes code execution and networked image-generation workflows, so accidental invocation could lead to unnecessary external data transfer or execution of commands when a simpler or safer skill should have handled the request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and all user-facing CLI messages are written exclusively in Chinese, and the skill provides no language selection, fallback, or notice that it is limited to Chinese users. This is a natural-language policy concern because it imposes a specific locale on all users without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.