T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:91- Finding
API Credential Disclosure Through Arbitrary Base URL Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
电商广告创意工作室｜AI-HIVE
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its advertised ad-creative purpose, but its network and credential handling are too broad and could leak an AI-HIVE API key or selected media if redirected or misconfigured.
Install only after reviewing the network risks. Use the default AI-HIVE URL, avoid untrusted AI_HIVE_BASE_URL or --base-url values, use a limited/rotatable API key, and assume any reference media you pass may be uploaded to the AI-HIVE workflow. The publisher should restrict trusted hosts, validate upload/download URLs, and add download size limits before this is treated as low-risk.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:266- Finding
Unvalidated Server-Supplied URLs Control Media Uploads and Result Downloads
- Content
View full analysis
- Remediation
View remediation
MAX_DOWNLOAD_BYTES: raise SystemExit("Download exceeds the allowed size") output.write(chunk) ``` 8. Write downloads to a temporary file first, verify expected media type and file signature, and atomically move the file into the output directory only after successful validation. 9. Document clearly that selected reference media is transferred to a third-party service and require user confirmation before the first upload. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A skill presented as a specialized e-commerce ad-planning tool but implementing broader media/AI operations creates a privilege and expectation gap. In practice, such a gap can allow misuse for generic generation, external service consumption, or access to account/model data under the cover of a narrowly approved business function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A skill presented as a specialized e-commerce ad-planning tool but implementing broader media/AI operations creates a privilege and expectation gap. In practice, such a gap can allow misuse for generic generation, external service consumption, or access to account/model data under the cover of a narrowly approved business function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
A skill presented as a specialized e-commerce ad-planning tool but implementing broader media/AI operations creates a privilege and expectation gap. In practice, such a gap can allow misuse for generic generation, external service consumption, or access to account/model data under the cover of a narrowly approved business function.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and includes runnable examples that rely on environment variables, local file access, shell execution, and network calls, but it does not declare any explicit tool scope or permissions boundary. This creates a confused-deputy risk where a host may grant broader capabilities than users expect, making it easier for the skill to read/write files, use secrets, or invoke external services without clear policy constraints.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Overly broad trigger conditions increase the chance that this skill activates for generic marketing or content requests that do not require its networked/media-generation capabilities. That can route unrelated user prompts into a more privileged workflow, increasing exposure of user data, chance of unintended external API use, and accidental billing or policy bypass.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language prompt explicitly requires a "production-ready Chinese workflow," which forces a specific language regardless of user preference. This is a locale/language policy issue because the file does not offer any opt-in choice or alternative language handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file's user-facing natural language is entirely Chinese, including the module description, CLI description, skill name, search aliases, and required/artifact labels, but it does not state that the skill is China-region-specific or offer any language/locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file presents itself as a narrowly scoped ecommerce ad-creative image skill, but actually embeds a much broader API client with chat, video generation, model listing, upload, and account-related operations. This scope mismatch violates least privilege and increases the chance that a caller or orchestrator will expose unintended capabilities, enabling misuse outside the advertised skill boundary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language descriptions entirely in Chinese for the module docstring and later CLI help/output strings, with no indication that users can choose another language or locale. The policy explicitly disallows forcing a specific language without opt-in, and this file presents the skill as a general-purpose tool rather than a clearly region-specific one.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Including user-info retrieval and generic text-chat in an image-creative skill exposes unnecessary account and model interaction surfaces that are unrelated to the advertised task. In a skill ecosystem, these hidden extra capabilities can be abused to enumerate account details, consume credits, or route arbitrary prompts through a broader backend than users or reviewers expect.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file presents itself as a narrowly scoped ecommerce ad-creative video skill, but the implementation exposes a generic AI utility covering chat, model enumeration, account lookup, upload, image generation, and video generation. This scope mismatch violates least privilege and increases the blast radius: any caller with access to the skill can invoke capabilities unrelated to the advertised purpose, including introspecting account data and using arbitrary models.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains prominent natural-language descriptions and CLI output in Chinese, beginning with the module docstring and continuing through user prompts. Because the skill does not offer a language/locale option or justify a China-specific locale constraint, it conflicts with the policy against forcing a specific language without user opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill includes a user-info endpoint that retrieves account information and wallet balance, which is unrelated to generating ecommerce ad creatives. Even if the data is only printed locally, exposing billing/account metadata through an over-broad skill can leak sensitive operational information to unauthorized users or downstream tooling.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill exposes a generic text chat method that accepts arbitrary prompts, optional system prompts, images, and model IDs, which is materially broader than a fixed ad-creative video studio workflow. In context, this turns the skill into a general-purpose LLM gateway, enabling prompt injection, policy bypass attempts, and unintended use of the account's API quota outside the declared purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The description defines usage entirely through Chinese trigger phrases and Chinese-language task framing, with no indication that other languages are supported or that the user can choose a locale. This can amount to an implicit language constraint without user opt-in.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The ability to enumerate all available models is broader than necessary for a skill that already has fixed configured model mappings in SKILL_CONFIG. While model listing is not as sensitive as account data, it reveals platform capabilities and can facilitate misuse of other exposed generic operations by helping users select unintended models.
- Content
Static analysis
No suspicious patterns detected.