T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:231- Finding
Unvalidated Server-Controlled URLs Enable SSRF and Reference Image Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
直播带货图片
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a real AI image-generation helper, but it lets remote API responses control upload/download destinations and local output filenames too broadly.
Install only if you trust AI Hive and are comfortable sending selected reference images to its service and related storage endpoints. Use a virtual environment, avoid running it on networks with sensitive internal HTTP services, choose a dedicated output folder, and treat the stored API key as a credential.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:346- Finding
Unsanitized Remote Metadata Is Used to Construct Download Paths
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:52- Finding
Unpinned Runtime Installation of a Third-Party Dependency
- Content
View full analysis
``` The script documentation repeats the same unconstrained installation instruction: ```python """AI Hive image generation task utility. Only exposes fixed-model image generation, permitted reference-image upload, task lookup, and API key initialization. Dependency: requests (pip3 install requests) """ ``` ### Technical Analysis The project instructs users to install `requests` without specifying a reviewed version, hash, lockfile, package index, or isolated environment. Package resolution therefore depends on mutable external repository state at installation time. The package name is legitimate and no dependency-confusion or typosquatting package is present in the audited project. Nevertheless, the unconstrained installation prevents reproducible dependency resolution and can unexpectedly install a future incompatible or compromised release. ### Attack Path 1. A user follows the documented `pip3 install requests` instruction. 2. `pip` resolves the latest package version available from its configured indexes. 3. A compromised upstream release, compromised package index, or maliciously configured additional index supplies dependency content. 4. The dependency is installed into the selected Python environment. 5. Its code executes when `imagegen.py` imports `requests`, with the privileges of the invoking user. ### Impact Assessment A malicious dependency release could execute arbitrary Python code with the privileges of the user running or installing the skill. Depending on that user's permissions, this could expose local files, environment variables, the AI Hive API key, and network access. There is no evidence th ...[truncated 162 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes shell commands, performs package installation, reads local files, and makes outbound network requests, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization gap where an agent may execute more capabilities than a reviewer or runtime expects, increasing the risk of unintended file access, command execution, or external data transmission if the skill is misused or modified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and all user-facing prompts/messages are written only in Chinese, including setup, errors, and operational guidance. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which this file does not do.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The parser and fixed config present this as a generic 'AI Hive 裸接口图片 Skill' with open-ended prompt, parameter, routing, and batch controls, even though the manifest frames it as a livestream-visual tool. This mismatch increases the chance that callers use the skill as a general-purpose image API proxy, bypassing intended product scoping and any policy assumptions attached to the livestream-only context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill exposes
taskanduploadsubcommands that are not narrowly scoped to the advertised livestream-image use case. This broadens the capability surface from a single-purpose image-generation helper into a more general media/task client, which can enable unintended data upload workflows and access to arbitrary task metadata under the user's API key.- Content
Static analysis
No suspicious patterns detected.