Security audit

GPT Image 2 海报生成

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI poster tool, but it needs Review because its stored API key can be sent to a custom API endpoint without HTTPS or host validation.

Install only if you trust AI Hive and are comfortable storing an API key locally. Keep the default HTTPS endpoint, avoid using --base-url or AI_HIVE_BASE_URL unless you fully trust the server, and install dependencies in an isolated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:90
Finding: API Key Can Be Transmitted to an Arbitrary or Plaintext Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:68
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` 3. Pin and hash all transitive dependencies, not only the top-level `requests` package. 4. Install with integrity enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 5. Document the expected trusted package index and avoid relying on unreviewed global mirror configuration. 6. Periodically update pinned versions through a controlled review process that includes vulnerability scanning and test execution. 7. Recommend installation in an isolated virtual environment and explicitly discourage privileged or administrator-level package installation. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is narrowly poster generation, but the detected behavior suggests broader capabilities including generic model access, media upload, wallet/account retrieval, browser launch, and task polling outside the stated scope. This mismatch is dangerous because users and policy systems may grant trust based on the benign description while hidden or indirect functionality enables unrelated sensitive actions, expanding the attack surface substantially.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill invokes shell commands, installs packages, accesses files, and appears able to use networked helper scripts, but it does not declare any explicit tool scope or permission boundaries. This creates unnecessary privilege ambiguity: a poster-design skill could execute broader local or network actions than users expect, increasing the risk of unintended command execution, data access, or exfiltration if the helper script is modified or misused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and main instructions are written as requirements for Chinese and bilingual poster production, including phrases like '固定使用' and repeated references to Chinese text handling, without offering the user a language choice. This can violate language/locale policy when a skill imposes a specific language context by default rather than making it optional or clearly region-scoped.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level docstring says this file is a '通用 AI 能力调用工具' wrapping text chat, image generation, video generation, model query, media upload, and task polling. That directly conflicts with the actual wrapped skill identity and manifest, which present a specialized GPT Image 2 poster-generation skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains user-facing natural-language descriptions, prompts, help text, and errors in Chinese only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a focused skill for creating GPT Image 2 posters, but the exposed CLI includes separate task and upload subcommands that let a caller query arbitrary generation tasks and upload images independently of poster creation. Those are broader AI Hive utility capabilities rather than clearly user-facing poster-design behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing natural language entirely in Chinese across the substantive changelog entries. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy violation, and this file does not indicate that the skill is region-specific or provide an alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example API key value uses Chinese text ('请替换为你的APIKey') as the only natural-language guidance in the file. Because this file provides user-facing configuration instructions and does not offer a language choice or explain a region-specific requirement, it creates a locale-specific experience that may violate language policy expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code provides an init command that opens a browser, guides the user through account login, and stores an API key locally. For a narrowly described poster-generation skill, this account/bootstrap workflow is an ancillary platform capability rather than part of the stated design function.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.