Security audit

GPT Image 2 产品图生成

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its product-image purpose, but it can send the user's AI Hive API key to any configured API base URL without validation.

Review this before installing if you use real API credits or confidential product images. Use only the default trusted AI Hive base URL unless you fully control the endpoint, avoid setting AI_HIVE_BASE_URL from untrusted instructions, and consider installing dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:53
Finding: API Credential Disclosure Through an Unrestricted Base URL
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:68
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
``` ```python try: import requests except ImportError: print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The documented installation command installs `requests` without a version constraint, lockfile, integrity hash, or explicitly trusted package index. The version and transitive dependencies resolved by this command can therefore change over time. This makes the installation non-reproducible and exposes users to supply-chain risk if a future package or transitive dependency release is compromised. It can also introduce unexpected compatibility or security regressions without any change to the audited project. The finding does not establish that the current `requests` package is malicious. The weakness is that the project delegates dependency selection and integrity entirely to mutable package-index state at installation time. ### Attack Path 1. A user follows the setup instructions and runs `pip3 install requests`. 2. `pip` queries its configured package index and resolves the latest permitted release and transitive dependencies. 3. If the index, account, release, mirror, or dependency resolution path has been compromised, a malicious package artifact is downloaded. 4. Package installation logic may execute with the privileges of the user running `pip`. 5. Malicious package code can subsequently execute when `imagegen.py` imports `requests`. ### Impact Assessment Successful exploitation of the dependency supply chain could execute code with the privileges of ...[truncated 405 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell commands, installs packages, performs network access, and reads/writes files, but it does not declare any explicit tool restrictions or permissions. In an agent environment, this expands the executable surface area and can let the skill run with more capabilities than users or platform policy may expect, increasing the risk of command execution, unintended file access, and outbound data exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description uses broad trigger language such as 'Use this skill for' across many product-image scenarios without clear activation boundaries. That can cause over-invocation in unrelated contexts, leading an agent to run file/network/shell-backed workflows when the user only asked for general advice or lightweight help.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level docstring describes this file as a general-purpose AI Hive tool for text chat, image generation, video generation, model queries, media upload, and task polling. However, the actual entrypoint at L843 invokes skill_main, whose parser only exposes generate/task/upload and hardcodes the model to GPT Image 2 via SKILL_CONFIG and skill_generate. This is an active documentation contradiction, not merely an omission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and user-facing instructions are written entirely in Chinese, and later prompts/messages also assume Chinese-speaking users. Because this file is a general-purpose image generation skill rather than a clearly region-specific compliance tool, the lack of language choice or opt-in creates a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file uses only Chinese for substantive user-facing text, which can constitute a language/locale policy issue when no opt-in or scope limitation is provided. The file does not indicate that the skill is intended only for Chinese-speaking users or a China-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language description is partially in Chinese and partially in English, but there is no statement that the user may choose the interaction language or that the bilingual format is intentional. This can create a language-policy issue if the skill appears to impose a language or locale without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The placeholder value 请替换为你的APIKey is presented only in Chinese, which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may choose another language, so this appears to violate the language/locale neutrality policy.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest presents the skill as generating ecommerce product images and photography sets from reference images. The exposed skill CLI also provides standalone task inspection and arbitrary file upload commands, which are ancillary platform operations rather than direct product-image generation behavior. While related to the backend workflow, they broaden the skill surface beyond what the manifest tells a user to expect.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.