T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:66- Finding
API Credential Disclosure Through an Unrestricted Custom Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
GPT Image 2 图片编辑
Security checks for vulnerabilities and agentic risk
Overview
This image-editing skill mostly does what it says, but its API key handling and downloaded output paths are under-scoped enough to require review before installation.
Install only if you trust AI Hive and are comfortable uploading source images and prompts to that service. Avoid setting custom base URLs unless you fully trust the endpoint, use a dedicated low-privilege API key, run it in an isolated environment, and choose an output directory where accidental overwrites would not matter.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:339- Finding
Arbitrary File Overwrite Through Unsanitized Server-Controlled Result Names
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:67- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file is presented as a narrowly scoped GPT Image 2 image-editing skill, but it actually ships a general-purpose AI Hive client with chat, video, model enumeration, account inspection, and generic upload flows. This scope mismatch is dangerous because users, reviewers, or higher-level agents may grant it broader trust and permissions than intended, enabling capability creep and misuse outside the advertised purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file includes a text-chat pathway with optional system prompts and image uploads, which is unrelated to the advertised image-editing-only purpose. In an agent environment, hidden text-generation capability materially changes the trust model because it can be repurposed for unrestricted general interaction, prompt handling, and exfiltration-oriented workflows not expected by users of an image editor.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The video-generation implementation is outside the declared GPT Image 2 image-editing scope and introduces a materially different capability set. This increases risk because a caller expecting constrained image editing could unknowingly gain access to more expensive, more privacy-impacting, or policy-sensitive media generation behaviors.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes shell commands, performs networked initialization/task retrieval, and reads/writes files via
scripts/imagegen.py, yet it declares nopermissionsorallowed-toolsscope. This creates an over-privileged integration surface where a host agent may expose broader capabilities than necessary, increasing the chance of unintended file access, command execution, or data exfiltration if the skill or its inputs are abused.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description says to use this skill for broad phrases like image editing, AI retouching, object replacement, recoloring, people editing, and batch versions, without defining clear activation boundaries or exclusions. These terms are common, high-level requests and could cause unintended invocation when a user is asking generally about image editing rather than specifically for this skill's workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill title, operational instructions, and example prompts are written in Chinese and implicitly require Chinese-language usage, but there is no statement offering the user a language choice or explaining that the skill is intentionally limited to a Chinese-speaking context. This creates a language/locale policy concern because the skill appears to enforce a specific language by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and user-facing guidance are written entirely in Chinese, and the script's prompts, errors, and help text consistently assume Chinese as the interaction language. This imposes a specific language/locale on users without any visible opt-in or alternative language selection, which matches the language/locale policy violation criteria.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-info command exposes account and wallet querying despite being unnecessary for image editing. In a skill context, this unnecessarily expands access to sensitive account metadata and can be abused for reconnaissance, billing discovery, or privacy-invasive inspection unrelated to the task the user requested.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The models command permits discovery of all available models even though the skill is supposed to be fixed to GPT Image 2 editing. This broadens the skill from a single-purpose editor into a capability-discovery surface, making it easier to pivot into unauthorized or unexpected model usage.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing natural language that switches to Chinese for the substantive content, but it does not indicate that the skill is intended only for a Chinese-speaking audience or offer any alternative language. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Line L2 includes the placeholder text "请替换为你的APIKey", which forces Chinese-language output in a user-facing configuration example. This can violate language/locale policy when no opt-in, alternative language, or documented locale restriction is provided.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The error message for rule == 'none' says '此文生图 Skill 不接受参考图片', implying a text-to-image skill context, while SKILL_CONFIG and validation for this file enforce rule 'image' and require at least one input image. This documentation/message framing contradicts the actual intent of this packaged skill as an image-edit tool.
- Content
Static analysis
No suspicious patterns detected.