T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:91- Finding
Bearer API Key Can Be Transmitted over Plaintext HTTP Through an Unvalidated Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
GPT Image 2 图片生成与编辑
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its image-generation purpose, but it handles an API key and can send it to an unvalidated custom API URL, so it needs review before installation.
Install only if you are comfortable giving this skill an AI Hive API key and uploading selected reference images to AI Hive. Keep the default HTTPS API endpoint, do not set AI_HIVE_BASE_URL or --base-url to an untrusted or http:// address, and avoid using the upload command on sensitive local files. Use a virtual environment and pinned dependencies where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:82- Finding
Runtime Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
``` The script also instructs users to install the same dependency when it is unavailable: ```python try: import requests except ImportError: print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The installation instructions request the latest available `requests` release without specifying a reviewed version, locking transitive dependencies, or verifying package hashes. Dependency resolution therefore changes over time and is dependent on the package index and resolver state at installation. The package name is legitimate and there is no evidence that this project intentionally introduces a malicious or typosquatted dependency. The risk arises from mutable supply-chain resolution: a future compromised release, compromised index path, dependency takeover, or incompatible update could be installed before the Skill executes. ### Attack Path 1. A user follows the documented `pip3 install requests` command. 2. Pip queries its configured package index and resolves the current release of `requests` and its transitive dependencies. 3. If the selected release or any dependency is compromised, or the user's package-index configuration points to an unsafe source, attacker-controlled installation code or package contents are installed. 4. The malicious dependency executes with the privileges of the user running pip or when `imagegen.py` imports and uses it. 5. It may access the same process environment and user-readable files, including the AI Hive API key. This is a supply-chain exposure rather than eviden ...[truncated 630 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose is limited to GPT Image 2 image generation/editing, but the detected behavior includes chat, video generation, model enumeration, user-info/wallet queries, and browser/API initialization flows. This mismatch is dangerous because users and policy systems may authorize the skill for a narrow purpose while the implementation has access to broader and more sensitive functionality, enabling data exposure, unexpected charges, or capability abuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes shell commands, performs network activity, and reads/writes files, but it does not declare any explicit tool scope or permissions. This creates an authority gap where reviewers and orchestrators cannot easily constrain what the skill is allowed to do, increasing the risk of unintended filesystem or network access if the underlying scripts are broader than the markdown suggests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description says to use this skill when users search terms such as "OpenAI image generation", "图片生成编辑", "AI修图", and "营销海报", which are broad, common request categories rather than narrowly scoped trigger phrases. It does not provide exclusion conditions or negative examples, increasing the chance of unintended invocation for generic image-editing conversations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The natural-language instructions and examples are written entirely in Chinese, and the description does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring states that this tool wraps text chat, image generation, video generation, model queries, media upload, and task polling as a general AI capability caller. However, the manifested skill is specifically scoped to GPT Image 2 image generation and editing, so embedding broader text/video operations in the shipped skill code exceeds the described behavior at the semantic level.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code embeds the primary skill description and many CLI prompts in Chinese, which effectively forces a specific language experience for all users. The file does not provide any user choice, locale negotiation, or justification that the skill is intentionally region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill manifest describes a tool for GPT Image 2 image generation and editing workflows, but the code implements a full text chat endpoint and command flow. Text chat is a distinct capability and is not necessary to perform the stated image-generation/editing purpose of this skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest scopes the skill to GPT Image 2 and image-centric tasks such as generation, editing, compositing, background replacement, and posters. The presence of video generation support is a separate modality and is not justified by the stated purpose of an image-only GPT Image 2 skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains substantive user-facing natural language in Chinese across the changelog entries, but it does not indicate that the skill is Chinese-only or provide any user opt-in or language alternative. Under the language/locale policy rule, forcing a specific language without documented justification can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The example API key value includes Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. For a general example config, this can violate language/locale neutrality when no opt-in or justification is provided.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The skill-specific parser describes itself as a GPT Image 2 image skill, yet it exposes generic operational subcommands such as raw media upload and task querying inherited from the broader utility. While these may support implementation, the inline CLI description presents a narrower intent than the available command surface.
- Content