Image 2 多参考图生成

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:10 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent AI Hive image-generation helper that handles user-selected images and an API key, with some ordinary integration risks users should manage.

Install only if you are comfortable sending the selected reference images and prompts to AI Hive. Prefer setting AI_HIVE_API_KEY or using the protected config file instead of pasting a real key into a shared shell command, and run the tool from a normal user account in a virtual environment with a pinned dependency if possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:179

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:179 and scripts/reference_contract.py:14-16
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

SKILL.md:179:

bash

pip3 install requests

scripts/reference_contract.py:14-16:

python

try:
    import requests
except ImportError:
    raise SystemExit("缺少 requests，请运行 pip3 install requests")

Technical Analysis

The documented installation command retrieves the latest available requests release without specifying an exact version, integrity hash, lock file, or trusted package source. Consequently, installations are not reproducible and the dependency selected at installation time can differ from the version reviewed or tested by the project author.

No evidence indicates that the legitimate requests package is currently malicious. The risk arises if the configured package index, dependency resolution path, package publisher account, or an upstream release is compromised. A malicious or unexpectedly incompatible release could execute code during installation or when imported by reference_contract.py.

Attack Path

1. An attacker compromises an upstream package release, package publisher account, configured Python package index, or network/package-resolution environment.
2. A user follows the documented pip3 install requests command.
3. pip resolves and installs the attacker-controlled or otherwise unreviewed release because no version or hash is enforced.
4. Malicious installation hooks or imported package code execute under the account running the command.
5. The malicious dependency can access files, environment variables, and API credentials available to that account.

This exploitation path is conditional on supply-chain or package-index compromise; the audited project does not itself contain evidence of a malicious dependency.

Impact Assessment

Successful exploitat ...[truncated 397 chars]

Remediation

View remediation

Remediation Suggestions

• Declare dependencies in a version-controlled requirements or lock file using an audited exact version.
• Enforce package integrity with hashes, for example through pip install --require-hashes -r requirements.txt.
• Install dependencies inside an isolated virtual environment under a nonprivileged account.
• Use an explicitly configured and trusted package index.
• Add automated dependency vulnerability and provenance scanning.
• Update the error message and documentation to reference the locked installation procedure rather than an unconstrained pip3 install requests command.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/reference_contract.py:227

Finding

Insufficient Validation of Server-Supplied Upload and Download URLs

Content

View full analysis

Vulnerability Details

File Location: scripts/reference_contract.py:227-235 and scripts/reference_contract.py:302-313
Vulnerability Type: Unrestricted remote URL handling and unbounded file download
Risk Level: Medium

Vulnerable Code

Upload handling at scripts/reference_contract.py:227-235:

python

url = transfer["url"]
if urlparse(url).scheme != "https":
    raise SystemExit("素材上传地址必须使用 HTTPS")
try:
    with path.open("rb") as handle:
        response = requests.request(
            transfer.get("method", "PUT"), url,
            headers=transfer.get("headers", {}), data=handle, timeout=300,
        )

Download handling at scripts/reference_contract.py:302-313:

python

def safe_download(url, destination):
    if urlparse(url).scheme != "https":
        raise SystemExit("结果下载地址必须使用 HTTPS")
    destination.parent.mkdir(parents=True, exist_ok=True)
    try:
        with requests.get(url, stream=True, timeout=300) as response:
            response.raise_for_status()
            with destination.open("wb") as handle:
                for chunk in response.iter_content(8192):
                    if chunk:
                        handle.write(chunk)
    except requests.RequestException as exc:
        raise SystemExit("结果下载失败：" + str(exc))
    print("[saved]", destination)

Technical Analysis

The implementation verifies only that the initial server-supplied URL uses the https scheme. It does not validate the destination hostname, port, resolved IP address, response content type, file signature, or response size.

The upload ticket controls the destination URL, HTTP method, and request headers. If the AI Hive API or its response path is compromised, it can direct the client to transmit a selected reference image to any HTTPS endpoint controlled by the attacker. The implementation also accepts arbitrary HTTP method values from the response.

The down ...[truncated 2549 chars]

Remediation

View remediation

Remediation Suggestions

• Maintain an explicit allowlist of approved upload and download hostnames or validate URLs against domains returned through a separately authenticated service configuration.
• Permit only the HTTP methods required by the protocol, such as PUT for uploads and GET for downloads.
• Reject user-info components, unexpected ports, fragments, malformed hostnames, and resolved private, loopback, link-local, or reserved IP addresses unless explicitly required.
• Disable automatic redirects or validate every redirect target before following it.
• Enforce maximum upload and download sizes. Validate Content-Length when present and stop streaming when the byte limit is exceeded.
• Download into a temporary file, verify the image signature and decoded format, and atomically rename it only after validation succeeds.
• Validate response content types, while treating them only as an additional check rather than trusting them alone.
• Remove partial files when a request, validation step, or size check fails.
• Consider cryptographically binding upload and result URLs to expected media identifiers if the API supports signed metadata.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents executable commands and references a script that uses shell, file, environment, and network capabilities, but it does not declare any tool scope or permission boundaries. This creates an authorization gap: an agent or reviewer cannot easily determine what capabilities are intended, increasing the risk of over-privileged execution, unsafe invocation, or accidental access to local files, environment secrets, and external services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description is primarily written in Chinese and does not state that other languages are supported or let the user opt into a preferred language. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup instructions tell users to pass an API key directly on the command line and mention environment/config storage without any credential-handling warning. Command-line secrets can leak via shell history, process listings, logs, screenshots, or shared terminals, making credential exposure more likely in real use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring is written as an instruction/description entirely in Chinese, and the CLI-facing help and error strings throughout the file are also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that alternative locales are supported.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.