T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:86- Finding
Unvalidated Network Destinations Allow Credential Disclosure, Image Exfiltration, and SSRF
- Content
View full analysis
- Remediation
View remediation
Security audit
GPT Image 2 商品精修
Security checks for vulnerabilities and agentic risk
Overview
This product-retouch skill is coherent, but its API and image-transfer code permits unvalidated endpoints and unsafe downloads, so it should be reviewed before use.
Install only if you are comfortable sending selected product images and an AI Hive API key through this script. Use the default AI Hive endpoint, avoid untrusted base URLs or config files, choose a safe output directory, and treat this as Review-worthy until URL validation, safe filenames, and download limits are added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:362- Finding
Unsanitized Task Metadata Enables Output Path Traversal and Unbounded File Downloads
- Content
View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) ``` ```python out_dir = Path(output_dir) out_dir.mkdir(parents=True, exist_ok=True) task_type = task.get("taskType", "task") for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) # Last frame for item in succeeded: last_frame = item.get("lastFrameUrl") if last_frame: out_path = out_dir / f"{task_type}_{task_id}_lastframe.png" download_file(last_frame, out_path) ``` ### Technical Analysis The output filename incorporates `taskType` and `task_id` without sanitization. In the generation workflow, these values originate from API responses. If either contains path separators or traversal components such as `../`, joining the resulting string to `out_dir` can produce ...[truncated 2145 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains substantive skill documentation only in Chinese, which can amount to a language-policy issue when no user opt-in or locale limitation is stated. The file does not indicate that the skill is intentionally region-specific or provide an alternative language option.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill invokes a local Python script, reads user-supplied image paths, writes configuration and output files, and makes network requests, yet it declares no explicit tool scope or permission boundaries. That creates an over-privileged execution model where an agent may use shell, filesystem, environment, and network capabilities more broadly than intended, increasing the blast radius if the script or surrounding orchestration is abused.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description and operating instructions are written to prescribe use in Chinese and do not indicate that the user may choose another language or locale. This is a natural-language policy concern because the skill appears to impose a specific language without opt-in or an explicit justified locale restriction.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a narrowly scoped product-photo retouching skill focused on fidelity-preserving edits to existing product images. However, the generate command accepts arbitrary prompts and only optionally accepts reference images, which enables broader text-to-image generation rather than just retouching existing product photos.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The placeholder value for
api_keyuses Chinese text (请替换为你的APIKey), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users can choose their preferred language, so this appears to violate the language/locale policy.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest emphasizes using GPT Image 2 to retouch product photography through AI Hive editing. Exposing a generic task lookup command allows inspection of generation tasks independently of the declared retouching action, which is a broader operational capability than the user-facing description suggests.
- Content
Static analysis
No suspicious patterns detected.