Security audit

GPT Image 2 角色一致性图片

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but it can send the user's AI Hive API key to any configured API server if that setting is changed.

Install only if you trust AI Hive and keep the default API host. Avoid setting --base-url, AI_HIVE_BASE_URL, or config base_url to an untrusted server, because the API key and selected media workflow can follow that endpoint. Use a virtual environment for dependencies and treat ~/.ai-hive/config.json as a sensitive credential file.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:77
Finding: Bearer API Key Disclosure Through an Unrestricted Custom Base URL
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:77
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing natural language almost entirely in Chinese, but there is no indication that the skill is intentionally region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice or justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill includes executable shell commands and network-capable Python usage, but the manifest does not declare any explicit tool scope or permission boundaries. This creates an avoidable trust gap: an agent may execute file, shell, environment, or network actions without clear least-privilege constraints or user-visible approval expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description and the body of the skill are predominantly written in Chinese, and the examples/instructions assume Chinese prompts and interaction. There is no indication that users may choose another language or that the locale restriction is required for a region-specific purpose, which makes this a language/locale policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file embeds a full-featured AI Hive client for chat, video, model listing, user-info, uploads, and task polling, while the declared skill is narrowly for GPT Image 2 character-consistency image generation. This scope mismatch expands the attack surface and grants operators capabilities unrelated to the advertised purpose, increasing the risk of misuse, policy bypass, or unexpected data handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code file contains user-facing natural language that is consistently fixed to Chinese, including the module description and subsequent CLI UX, but it does not provide any opt-in or language selection mechanism. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's prompts, status logs, help guidance, and error handling are written in Chinese throughout the file, which means users are forced into a specific language experience. Because there is no selectable locale or explicit justification for a Chinese-only interface, this conflicts with the language/locale policy described in SQP-3.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Exposing a user-info endpoint in a character-consistency image skill is unjustified and can reveal account metadata or wallet/balance information unrelated to the user’s intended task. In a least-privilege review, this is dangerous because it permits unnecessary account inspection and increases the blast radius if the skill is invoked unexpectedly or by a confused deputy flow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Including arbitrary text chat capability allows the skill to be repurposed beyond image generation, sending user prompts and optional uploaded media to unrelated models or workflows. In the context of a narrowly advertised image-consistency skill, this unnecessary generality can surprise users, weaken safety boundaries, and broaden opportunities for prompt/data exfiltration through unintended API usage.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Video generation support materially exceeds the stated image-only purpose and introduces additional media ingestion, processing, and download paths. That added functionality increases attack surface, resource consumption, and the chance that users or orchestrators invoke powerful capabilities they did not intend to authorize under this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The placeholder value for the API key includes Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill offers a language choice or that the locale constraint is required for a region-specific use case.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.