Security audit

Image2 广告图片｜可归因测图单元

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate ad-image workflow, but its helper script uses broader network transfer behavior than the documentation says.

Review before installing if your product images are confidential. Use only with an AI Hive account and images you intend to send to the service, prefer a virtual environment with pinned dependencies, and consider disabling downloads or limiting the output directory until the publisher documents and restricts allowed upload/download hosts and file sizes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ad_test_cell.py:202
Finding: Insufficient Validation of Server-Provided Upload and Download URLs
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:172
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
``` The script also instructs users to run the same unpinned installation when the module is unavailable: ```python try: import requests except ImportError: raise SystemExit("缺少 requests，请运行 pip3 install requests") ``` ### Technical Analysis The installation command resolves the newest available `requests` release and its transitive dependencies at installation time. No reviewed version, lock file, package hash, isolated environment, or package-index restriction is provided. The referenced `requests` package name is legitimate and no malicious dependency is included in the repository. Nevertheless, mutable dependency resolution makes installations non-reproducible and exposes users to future upstream compromise, malicious package-index configuration, or incompatible releases. ### Attack Path 1. A user follows the documented `pip3 install requests` instruction. 2. `pip` queries the user’s configured package index and resolves package versions at that time. 3. A compromised index, compromised upstream release, or maliciously configured higher-priority index supplies altered package content. 4. Installation executes package build or installation behavior in the user’s Python environment. 5. The malicious dependency subsequently runs when `ad_test_cell.py` imports `requests`. This exploitation path depends on compromise or unsafe configuration of the dependency supply chain; no such compromise is present in the audited project itself. ### Impact Assessment Impact depends on the privileges used to run `pip`. A malicious dependency could execute with th ...[truncated 286 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a local Python script, reads local product image files, may write outputs/state, uses environment variables such as SKILL_PATH, and makes outbound network requests to an external API, yet it declares no explicit tool/permission scope. This weakens sandboxing and review because an agent may grant broader shell, file, env, and network access than users expect, increasing the blast radius if the script or skill content is modified or abused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The file contains explicit natural-language instructions that the localized Google Display example reserve copy for a '德语批准稿' and use a '德语落地页'. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation, and this example does not present an explicit language choice at the point of instruction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code presents its primary description and user-facing error/help text in Chinese, which effectively forces a specific language for users. Under the policy, language constraints should either be optional, user-selectable, or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example API key value uses Chinese text ('请替换为你的APIKey') in a user-facing configuration template. This imposes a specific language in natural-language content without any opt-in or explanation that the file is intended only for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.