Security audit

Image 2 商品精修

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent product-photo retouching helper that sends user-selected images to AI Hive, with some disclosed operational risks around API-key storage, dependency installation, and remote transfer URLs.

Install in a dedicated virtual environment, consider pinning dependencies, and use this only with images you are willing to send to AI Hive. Prefer an environment variable or a dedicated low-scope API key if you do not want a key saved under ~/.ai-hive/config.json, and review downloaded outputs before publishing them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:155
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/retouch_ticket.py:207
Finding: Insufficient Validation of Server-Provided Upload and Download URLs
Content: View full analysis
", media_id) return media_id ``` Download handling: ```python def safe_download(url, destination): if urlparse(url).scheme != "https": raise SystemExit("结果下载地址必须使用 HTTPS") destination.parent.mkdir(parents=True, exist_ok=True) try: with requests.get(url, stream=True, timeout=300) as response: response.raise_for_status() with destination.open("wb") as handle: for chunk in response.iter_content(8192): if chunk: handle.write(chunk) except requests.RequestException as exc: raise SystemExit("结果下载失败：" + str(exc)) print("[saved]", destination) ``` ### Technical Analysis The script accepts transfer URLs supplied by the remote API and verifies only that their parsed scheme is `https`. It does not validate: - The destination hostname or ...[truncated 3024 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs users to run a local Python script that can read files, access environment variables, write output, and make network requests, but it does not declare any explicit tool/permission scope. That mismatch increases the chance the skill is executed with broader capabilities than intended, making accidental data exposure, unsafe file access, or unintended outbound requests harder to govern and review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description contains very broad keywords and competitor/comparison terms, which can cause the skill to trigger for many generic image-editing requests rather than only narrow product-retouch tasks. Over-broad activation is risky because it may route unrelated user content into a workflow that performs local file handling and external API submission, increasing the chance of unintended data processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script stores a live API key on disk when auth is used, but there is no explicit warning, confirmation, or secure secret-store integration before doing so. Although the file is chmod'd to 0600, users may not realize credentials are being persisted, which increases the risk of accidental long-term exposure through backups, dotfile syncing, shared home directories, or later local compromise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: User-visible descriptions, errors, help text, and status messages throughout the script are written only in Chinese. This imposes a specific language on all users without opt-in or documented justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes a skill for controlled product-photo retouching via GPT Image 2, but this file also implements an auth command that writes API credentials to ~/.ai-hive/config.json. Persisting credentials is not part of the retouching capability itself and is not justified by the stated end-user purpose of localized image repair.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.