eBay 电商图片生成与编辑

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent AI Hive-backed eBay image generation helper, with normal runtime commands scoped to image generation, task lookup, upload, and API-key setup.

Use a dedicated AI Hive API key, avoid uploading private or unrelated files, and prefer installing requests in a virtual environment with pinned versions. Expect selected listing photos to be sent to AI Hive and generated files to be saved locally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:68

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:68-71
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

bash

pip3 install requests
python3 "$SKILL_PATH/scripts/imagegen.py" init --skill-name ebay-ecommerce-image-generation-editing
python3 "$SKILL_PATH/scripts/imagegen.py" task --task-id <taskId>

Technical Analysis

The documented setup procedure installs requests without a version constraint, lockfile, cryptographic hash, explicit trusted package index, or isolated environment. Consequently, the package and its transitive dependency versions resolved at installation time can differ from those reviewed during this audit.

Although no malicious dependency is currently embedded in the repository, this installation pattern creates supply-chain exposure. A compromised package release, dependency, configured package index, or future incompatible version could introduce arbitrary installation-time or import-time behavior.

Attack Path

1. An attacker compromises a future release of requests, one of its transitive dependencies, or a package index configured on the user's system.
2. The user follows the documented pip3 install requests instruction.
3. pip resolves and installs the attacker-controlled package version because no approved version or hash is enforced.
4. Malicious package code executes during installation or when scripts/imagegen.py imports requests.
5. The code runs with the privileges of the user invoking the installation or Skill.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. This may expose the AI Hive API key, uploaded media, accessible local files, environment variables, and other user-level credentials. It could also alter downloaded outputs or make unauthorized network requests.

The scope is normally limited to the invoking account, but it could be broader if the user installs the dependency with elevated p ...[truncated 53 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dependency manifest that pins an audited version of requests and every transitive dependency.
2. Generate and enforce cryptographic hashes, for example with a hash-locked requirements.txt and:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Document installation in a dedicated virtual environment rather than the system Python environment.
4. Use an explicitly trusted package index and prevent fallback to untrusted or privately configured indexes where feasible.
5. Add automated dependency vulnerability and integrity scanning to the release process.
6. Periodically update pinned versions through a reviewed and tested dependency-update workflow.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose is narrow eBay image editing, but the underlying tooling reportedly includes broader capabilities such as chat, video generation, account/balance queries, model enumeration, generic uploads/downloads, and interactive API-key setup with local credential storage. This mismatch is dangerous because reviewers and users may authorize the skill for a limited image-editing use case while it can perform materially broader actions, increasing the risk of data exposure, credential mishandling, and unintended external operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill exposes code-execution-capable behaviors (shell, network, file read/write, env access) but does not declare any tool scope or permission boundaries in the skill manifest. That makes the runtime trust model unclear and can lead to over-privileged execution, especially if this skill is invoked in environments where users or orchestrators assume the manifest fully describes what the skill can do.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file is presented as a specialized eBay image-generation/editing skill, but it actually wraps a broad generic AI client with chat, video, model enumeration, account inspection, and media upload capabilities. This capability mismatch expands the attack surface and violates least-privilege expectations: a caller selecting an image skill could unknowingly gain access to unrelated operations and data flows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module documentation explicitly describes a generic AI capability tool, contradicting the specialized eBay image-skill identity. This kind of deceptive or mismatched packaging is dangerous because reviewers, orchestrators, and users may grant trust and permissions based on the narrow skill description while the code enables substantially broader actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing prompts/messages in this skill are written in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. Under the policy, language constraints should either be optional or clearly justified as region-specific; this file does not provide such justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generic chat function enables arbitrary text interaction with the backend model, which is outside the declared purpose of eBay image editing. This can be abused to perform unrelated tasks, transmit arbitrary prompts and attached images, and bypass policy assumptions that the skill is constrained to listing-image workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The full video-generation pipeline materially exceeds the advertised scope of an eBay image-generation/editing skill. Extra media ingestion and generation paths increase exposure to misuse, higher-cost operations, and policy bypass by enabling arbitrary video and audio processing under a misleadingly narrow skill label.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains user-facing natural language almost entirely in Chinese, but it does not indicate that the skill is China-specific or provide any user opt-in for the language/locale. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description includes Chinese-language invocation text alongside English, but the file does not state whether the skill is intended specifically for Chinese-speaking users or provide any language/locale selection. Under the policy rule, locale or language constraints should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The get_user_info capability allows account/profile and potentially billing or balance data retrieval, which is unrelated to creating eBay listing images. In a narrowly scoped marketplace-image skill, exposing account inspection increases unnecessary data access and can leak sensitive operational information if invoked by an agent or user unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.