Security audit

Instagram INS 电商图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but its API-key and download handling could expose credentials or write files outside the intended output folder under unsafe endpoint or server-response conditions.

Install only if you trust AI Hive and the publisher. Do not use custom --base-url or AI_HIVE_BASE_URL values unless you fully trust the endpoint, use a limited API key, and review output paths before downloading generated results. Prefer installing dependencies in a virtual environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:91
Finding: Arbitrary API Base URL Can Expose the Bearer API Key
Content: View full analysis
` header to every request made to the configured endpoint. An attacker who can influence a command, environment variable, or configuration file can therefore redirect authenticated requests to an attacker-controlled HTTP server. Plaintext HTTP is also accepted, allowing credentials and request data to be intercepted in transit. The implementation also relies on the HTTP client's default redirect behavior without explicitly ensuring that authen ...[truncated 1219 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:395
Finding: Server-Controlled Task Metadata Enables Output Path Traversal
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:71
Finding: Unpinned Runtime Dependency Creates a Supply-Chain Risk
Content: View full analysis
``` The script also instructs users to run the same unconstrained installation command when the dependency is missing at `scripts/imagegen.py:18-22`: ```python try: import requests except ImportError: print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The installation instructions request the latest version of `requests` available from the user's configured package index. No exact version, integrity hash, lock file, or trusted package-index policy is specified. This makes installations non-reproducible and permits dependency behavior to change after the Skill has been audited. Although the reviewed project does not contain evidence that the current `requests` package is malicious, future package compromise, an unsafe package-index configuration, or an incompatible release could introduce malicious or vulnerable code into the Skill's runtime. Python package installation may execute package build logic, and imported dependency code executes with the privileges of the invoking user. ### Attack Path 1. The user follows `SKILL.md` or the script's missing-dependency message and runs `pip3 install requests`. 2. `pip` resolves a package version from the user's currently configured package index or mirror. 3. Because no version or hash is specified, the selected artifact may differ from the artifact reviewed and tested by the project maintainers. 4. If the resolved release or package source is compromised, malicious installation or import-time code executes. 5. The dependency runs with the same operating-system permissions as ...[truncated 594 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a Python script and instructs users to install dependencies and run tasks, which implies access to shell, filesystem, environment, and potentially network capabilities, but it does not declare any explicit tool restrictions in the skill metadata. Without least-privilege scoping, an agent or runtime may grant broader access than necessary, increasing the blast radius if the script, task inputs, or downstream services are compromised or behave unexpectedly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is presented as a specialized Instagram e-commerce image skill, but the implementation is a general-purpose AI client with chat, image, video, upload, model enumeration, user-info, and task polling. This capability mismatch violates least privilege and expands what a caller can do if they invoke the script directly, increasing the attack surface and enabling unintended data access or service use beyond the declared skill scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains user-facing natural-language descriptions and prompts in Chinese, including the module docstring and later CLI help/output strings, but does not indicate that the skill is Chinese-only or provide any user opt-in for language selection. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script presents operational guidance, error messages, and API-key setup instructions entirely in Chinese to end users. There is no mechanism to choose language or any note that the skill is restricted to a Chinese-speaking audience, so the locale is effectively enforced by default.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Exposing user account and wallet retrieval in an image-generation skill gives the skill access to billing and account metadata unrelated to creating Instagram assets. In this context, that unnecessary access broadens data exposure and could be abused to enumerate sensitive account state or spending information if a user or agent runs undocumented commands.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The chat/text endpoint allows arbitrary multimodal text interaction unrelated to the declared Instagram image editing purpose. In a constrained skill context, this creates covert extra functionality that can be used to process unrelated prompts and files, undermining policy enforcement and increasing the risk of unintended data transmission to the backend.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Video generation, including image/video/audio uploads and frame controls, materially exceeds the stated scope of an Instagram image-generation/editing skill. This enlarged media-processing surface can be abused to upload and process additional user content types, causing unnecessary exposure of media data and unauthorized consumption of service capabilities.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s natural-language content from L05 onward is presented only in Chinese, which can impose a language constraint on users or maintainers who do not read that language. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The placeholder value for api_key includes Chinese text (请替换为你的APIKey), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users can choose their preferred language.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level docstring says this is a '通用 AI 能力调用工具' and documents generic chat, image generation, video generation, model query, media upload, and task polling capabilities. That active documentation conflicts with the specialized manifest intent of an Instagram e-commerce image generation/editing skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.