T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/campaign_lineage.py:256- Finding
Server-Controlled Upload URL Lacks Destination Allowlisting
- Content
View full analysis
- Remediation
View remediation
Security audit
Image2 营销图片｜Campaign 资产血缘
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but it uploads user-selected campaign assets and stores an API key while leaving important network and credential-handling boundaries under-specified.
Review this skill before installing if your campaign or product images are confidential. Use --preview first, avoid entering real API keys directly in shell commands, prefer a restricted key, and only run live generation if you trust AI Hive and any storage domains it returns for uploads and downloads.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:157- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:157- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs users to run a Python script that uses shell execution, reads local files, writes auth state, and performs network requests, but it does not declare any explicit tool scope or permissions. This creates an avoidable over-privilege and transparency problem: an agent or user may invoke the skill without a clear boundary on what filesystem paths, environment data, or network destinations are intended, increasing the chance of misuse or unsafe execution assumptions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The invocation text is extremely broad, covering generic marketing-image creation and many platforms and workflow tools, so the skill may be triggered in situations beyond its narrowly documented lineage use case. Over-broad routing can cause unintended execution of a networked/scripted skill when the user only asked for general advice, increasing exposure to unnecessary tool use and confused-deputy behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring is written entirely in Chinese, and all user-facing CLI help and error/output strings throughout the script are also Chinese-only. This creates a locale/language constraint with no opt-in or alternative, which matches the policy category for forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The natural-language description is partly in Chinese and partly in English, but the file does not state that the user can choose their preferred language or that the mixed-language behavior is required for a specific region. This can violate language/locale policy by implicitly forcing a language presentation without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. This file does not offer an alternative locale or explain that the skill is intended only for Chinese-speaking users or a China-specific deployment.
- Content
Static analysis
No suspicious patterns detected.