Security audit

快手电商图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real AI Hive image-generation helper, but it exposes credential-bearing API calls to user-configurable endpoints without adequate safeguards.

Review this skill before installing. Use it only if you trust the AI Hive service and publisher, avoid setting custom base_url values, protect AI_HIVE_BASE_URL and ~/.ai-hive/config.json from modification, and prefer pinned dependencies. Expect it to upload selected media and store an API key locally if you run init.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:71
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` 3. Install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Pin and hash all transitive dependencies, not only `requests`. 5. Use a trusted package index explicitly and protect index configuration from unauthorized modification. 6. Perform dependency vulnerability and provenance checks as part of release preparation. 7. Advise users not to run dependency installation with administrative privileges. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:91
Finding: Bearer API Credential Can Be Sent to an Arbitrary or Plaintext Base URL
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes Python scripts, installs a package, and describes capabilities consistent with shell, network, filesystem, and environment access, but it does not declare any explicit tool scope or permission boundaries. This increases the risk of overbroad execution if the hosting agent auto-enables tools, making unintended file access, network calls, or shell execution harder to constrain and audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description says "Use this skill for" followed by many broad ecommerce-image phrases, but it does not define clear trigger constraints, exclusions, or negative examples. Several phrases are generic enough within normal commerce conversations that they could cause unintended invocation when a user is only discussing images rather than explicitly requesting this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file is written entirely in Chinese and the description implicitly fixes the skill's interaction locale to Chinese, but it does not offer a language choice or state that the skill is intentionally restricted to a Chinese-speaking regional context. This can violate language/locale policy when users have not opted into that language.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is marketed as an ecommerce image-generation/editing skill, but it embeds a generic AI client with broader capabilities including chat, video, model enumeration, upload, and account-related API access. This capability mismatch violates least-privilege expectations and increases the attack surface: a consumer or orchestrator that trusts the skill description may unknowingly grant credentials to code that can do substantially more than advertised.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring explicitly describes a generic multi-capability AI tool, which contradicts the specialized ecommerce image-skill metadata. This inconsistency is a security concern because it signals that the shipped code may not match the reviewed intent, undermining trust, review accuracy, and permission scoping.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring and many user-facing messages are written only in Chinese, and the CLI does not provide any language or locale opt-in/selection. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The presence of account-information access in a skill whose stated purpose is image generation is an unnecessary privilege expansion. Even if not invoked by the skill-specific entrypoint, retaining code that can query user info or wallet data creates a latent confidentiality risk if the broader CLI path is exposed, reused, or accidentally called with the same API key.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Video-generation support is unrelated to the declared image-only purpose and broadens what can be done with the provided API key and uploaded media. In a skill ecosystem, this kind of hidden extra capability is dangerous because policy, consent, and monitoring may be scoped only to image editing while the code can perform additional expensive or sensitive operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains substantive skill-related natural-language content entirely in Chinese, with no indication that users may choose another language or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in a user-facing configuration artifact. There is no indication that the skill is region-specific or that users may choose another language, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.