电商主图

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 1.0.0

Overview

The skill largely matches its image-generation purpose, but needs review because it stores an API key and trusts service-provided upload and download URLs without enough validation or size limits.

Install only if you are comfortable sending selected product images and prompts to AI Hive and storing an AI Hive API key locally. Use a virtual environment for dependencies, avoid highly sensitive unreleased images unless you trust the service, and monitor output downloads because the script does not enforce destination allowlists or maximum file sizes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55; related installation guidance also appears in scripts/imagegen.py:7-21
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code:

bash

pip3 install requests

Related runtime guidance:

python

try:
    import requests
except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The setup instructions install requests without a version constraint, lock file, or cryptographic integrity hash. Consequently, the version installed depends on the package index and dependency state at installation time rather than on a release reviewed together with this project.

The package index is not explicitly constrained either, so pip may use a user-configured or environment-configured index. An attacker who compromises the upstream package, a configured package mirror, DNS or network infrastructure, or the local package-index configuration could cause an unintended package release to be installed.

Although requests is a well-known package and there is no evidence that the project intentionally references a malicious dependency, the installation process lacks supply-chain reproducibility and integrity controls.

Attack Path

1. A user follows the documented command and executes pip3 install requests.
2. pip resolves the package using the environment's configured package indexes and selects the current compatible release.
3. An attacker controls or compromises the selected package source, release, or configured mirror.
4. The malicious package or dependency is downloaded and installed.
5. Attacker-controlled Python code executes during installation or when imagegen.py imports and uses the package.

Impact Assessment

Malicious dependency code would run with the privileges of the user performing the ...[truncated 440 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and its transitive dependencies to reviewed versions in a requirements or lock file.
• Include SHA-256 hashes and require verification during installation, for example:

  bash

  python3 -m pip install --require-hashes -r requirements.txt
  

• Generate the lock file from a trusted environment and review dependency changes before updating it.
• Explicitly use a trusted package index where deployment policy permits it.
• Recommend installation inside a dedicated virtual environment rather than into a shared or system-wide Python environment.
• Add automated dependency vulnerability and provenance checks to the release process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:231

Finding

Unvalidated API-Controlled Reference Image Upload Destination

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:231-242
Vulnerability Type: Unvalidated externally supplied upload URL, method, and headers
Risk Level: Medium

Vulnerable Code:

python

upload_url = token["upload"]["url"]
upload_method = token["upload"].get("method", "PUT")
upload_headers = token["upload"].get("headers", {})

with open(str(path), "rb") as f:
    try:
        oss_resp = requests.request(
            upload_method, upload_url, headers=upload_headers,
            data=f, timeout=300,
        )

Technical Analysis

The upload-token API response controls the destination URL, HTTP method, and request headers used to transfer the selected reference image. The client does not verify that the URL uses HTTPS, belongs to an approved object-storage hostname, uses an expected port, or resolves to a permitted network destination. It also does not restrict the returned method to the expected upload operation or validate redirects.

This creates a trust-boundary weakness: the fixed AI Hive API endpoint indirectly controls a second outbound request carrying user-selected image data. If the API response, service account, backend, or response path is compromised, the script will upload the file to an arbitrary destination.

The authorization header containing the AI Hive API key is not included in this object-storage request, which limits credential exposure. However, the image contents and API-supplied upload headers are still transmitted to the unvalidated destination.

Attack Path

1. The user invokes the generation or upload command with a commercially sensitive reference image.
2. The script requests an upload token from the fixed AI Hive API.
3. An attacker compromises the service or otherwise gains control over the upload-token response.
4. The response supplies an attacker-controlled URL, an unsafe plaintext URL, or a URL that redirects to an attacker-controlled host ...[truncated 890 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the returned URL and require the https scheme.
• Maintain an explicit allowlist of documented object-storage hostnames and permitted ports.
• Reject URLs containing user information, unexpected ports, unsupported schemes, or unapproved hosts.
• Restrict upload_method to the method required by the API contract, normally PUT.
• Allow only necessary upload headers and reject dangerous or unexpected header names.
• Disable redirects for uploads, or manually validate every redirect target against the same scheme and hostname policy.
• Consider resolving and checking destination addresses to prevent access to loopback, link-local, private, and other restricted networks where this is compatible with the approved storage service.
• Display the validated destination hostname before uploading sensitive data.
• Document clearly that reference images are transmitted to the AI Hive service and its approved storage provider.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:267

Finding

Unvalidated Result Downloads Permit Arbitrary Destinations and Unbounded File Writes

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:267-276; URL sources are processed at scripts/imagegen.py:352-364
Vulnerability Type: Unvalidated remote download and missing response-size controls
Risk Level: Medium

Vulnerable Code:

python

resp = requests.get(url, stream=True, timeout=timeout)
resp.raise_for_status()
total = int(resp.headers.get("content-length", 0))
downloaded = 0
with open(str(out_path), "wb") as f:
    for chunk in resp.iter_content(chunk_size=8192):
        if chunk:
            f.write(chunk)
            downloaded += len(chunk)

The URL is taken directly from task response fields:

python

result_url = item.get("resultUrl")
if not result_url:
    continue
download_file(result_url, out_path)

last_frame = item.get("lastFrameUrl")
if last_frame:
    download_file(last_frame, out_path)

Technical Analysis

Task responses provide resultUrl and lastFrameUrl, and the client downloads those URLs without validating their scheme, hostname, port, resolved address, redirect targets, media type, file signature, or expected maximum size.

Streaming avoids loading the entire response into memory, but it does not limit the number of bytes written to disk. A missing or false Content-Length value does not stop the transfer. The timeout is also a per-request or socket-operation control rather than a reliable total transfer-size or total-duration limit.

The saved extension is selected from task metadata rather than verified response content. Therefore, arbitrary data can be saved with a .png extension. The script does not automatically execute the downloaded file, reducing immediate code-execution risk, but downstream image viewers or processing pipelines may still consume it.

Attack Path

1. A user submits or queries an image-generation task.
2. An attacker compromises the task-response service or gains the ability to alter a task's ...[truncated 1278 chars]

Remediation

View remediation

Remediation Suggestions

• Require HTTPS and permit downloads only from documented, approved result-storage hostnames.
• Disable redirects or validate every redirect target before following it.
• Reject loopback, link-local, private, and otherwise restricted network destinations where they are not explicitly required.
• Define a conservative maximum result size and enforce it against both Content-Length and the cumulative streamed byte count.
• Apply a total transfer deadline in addition to the existing request timeout.
• Require an expected image media type and verify the file signature using a trusted image parser before accepting the file.
• Download into a securely created temporary file in the destination directory.
• Delete partial files on timeout, validation failure, or size-limit violation.
• Atomically rename the temporary file to the final filename only after all checks pass.
• Avoid trusting task metadata alone to determine the output extension.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands, reads local files, installs packages, and makes authenticated network requests, but it does not declare any explicit tool scope or permission boundaries. That creates an avoidable over-privilege condition where an agent may grant broader capabilities than users expect, increasing the blast radius if the skill is misused or modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description includes a long set of invocation phrases such as '商品主图', 'SKU 图', and '商品卡', which are generic ecommerce/image terms rather than clearly bounded trigger phrases. Without explicit scope limits or negative examples, the skill could be invoked for broad everyday image-editing requests that only loosely match these terms.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This is a code file, so natural-language policy checks apply to docstrings, CLI help text, and printed messages. The file consistently presents descriptions and interaction prompts only in Chinese, with no indication that users can select another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest promises accurate, reusable product main-image variants for ecommerce channels, but skill_generate forwards user-supplied prompts and parameters directly to a general image generation API with only a fixed model ID. There is no code enforcing white-background, scene, spec, activity-padding, SKU-truth, or channel-specific output constraints, so the actual behavior is broad image generation/editing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a narrowly scoped skill for generating reusable ecommerce product main images from SKU truth data, but the CLI exposes generic task, upload, and init subcommands and labels itself as an "AI Hive 裸接口图片 Skill". Those capabilities make the file a more general-purpose AI Hive image utility rather than a purpose-limited ecommerce-main-image skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill's natural-language description and instructions are written entirely in Chinese while also presenting itself for broad multi-platform use, but it does not state that language is optional or user-selectable. This can violate language/locale policy when a skill effectively assumes a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.