Security audit

GPT Image 2 多参考图生成

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a coherent AI Hive image-generation helper, but it handles API credentials and downloads remote output with under-scoped controls that merit Review before installation.

Install only if you are comfortable giving this skill an AI Hive API key, uploading selected reference media to AI Hive, and allowing it to download generated files locally. Avoid setting AI_HIVE_BASE_URL or --base-url unless you fully trust that endpoint, use a dedicated low-privilege API key if possible, run it from a contained environment, and choose an output directory where accidental overwrites would not matter.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:92
Finding: Bearer Credential Disclosure Through an Unrestricted API Base URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:405
Finding: Remote-Controlled Path Traversal During Generated Media Download
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:314
Finding: Unrestricted Server-Supplied URLs Enable Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:78
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
``` The script also instructs users to perform the same unpinned installation: ```python """AI Hive OpenAPI Skill — general AI capability invocation tool. Dependencies: requests (pip3 install requests) """ ``` ```python try: import requests except ImportError: print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The installation instructions resolve `requests` without a version constraint, lockfile, integrity hash, trusted package index requirement, or isolated environment. The selected package and its transitive dependencies can therefore change over time and depend on the user's pip configuration. The package name is legitimate and no malicious dependency is embedded in the repository. The risk arises from mutable dependency resolution and potentially unsafe or compromised package indexes. If an attacker controls the configured index, proxy, or dependency metadata, malicious code may be installed and then executed when `requests` is imported. ### Attack Path 1. A user follows the documented `pip3 install requests` instruction. 2. Pip resolves the package through the user's configured package index or mirror. 3. The index, mirror, network path, or relevant package release is compromised. 4. Pip installs attacker-controlled package content or a malicious transitive dependency. 5. The installed code executes during installation or when `imagegen.py` imports `requests`. ### Impact Assessment Dependency installation and import run with the privileges of the invoking user. A compromised ...[truncated 346 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell commands, installs packages, reads local files, and appears to perform networked uploads, yet it declares no explicit tool scope or permission boundaries. That makes the runtime capabilities broader than the metadata suggests, increasing the chance of unintended file access, arbitrary command execution paths, or data exfiltration through image upload workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description lists many broad activation phrases such as multi-image fusion, outfit change, brand visuals, interior matching, and ad composition without defining clear trigger boundaries or exclusions. In a markdown skill description, this can make it unclear when this specific skill should activate versus other general image-editing or design skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Most of the user-facing instructions and examples are written in Chinese, and the file does not state that language selection is optional or region-specific. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is marketed as a narrowly scoped GPT Image 2 multi-reference image skill, but it actually embeds a broad general-purpose AI Hive CLI with chat, video, model enumeration, upload, and account operations. This scope expansion increases the attack surface and enables callers to invoke capabilities that were not disclosed by the skill’s stated purpose, undermining least privilege and review assumptions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level documentation describes a general AI capability tool, which conflicts with the advertised identity of a fixed GPT Image 2 multi-reference skill. Misleading documentation is dangerous in a security review context because it obscures the real scope of accessible features and can cause reviewers or orchestrators to grant trust based on false assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code embeds its primary natural-language description and operational guidance entirely in Chinese, which effectively forces a specific language/locale for users. The file does not provide any opt-in, alternative locale, or documented justification for restricting usage to Chinese.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill exposes arbitrary text-chat capability despite being declared as a fixed GPT Image 2 multi-reference image tool. This allows misuse of the skill as a general LLM client, bypassing expected scope restrictions and potentially enabling prompt-based data handling or unintended API consumption outside the reviewed image workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Video-generation support is unrelated to the declared GPT Image 2 multi-reference image purpose and materially broadens the skill’s capabilities. In this context, hidden multimedia generation features increase operational and security risk because reviewers and users may assume a narrower permission and cost profile than the code actually implements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese across the substantive entries. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the regional constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The string literal on L2 uses Chinese text ('请替换为你的APIKey') as the only user-facing placeholder. This imposes a specific language in a user-visible configuration example without opt-in or documented locale justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Exposing user-info/account inspection in an image-generation skill is unnecessary and leaks account metadata beyond the declared function of the skill. Even if limited to the authenticated user, it widens available capabilities and may reveal wallet, identity, or subscription details to workflows that only needed image generation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.