T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:346- Finding
Path Traversal Through API-Controlled Output Filenames
- Content
View full analysis
- Remediation
View remediation
Security audit
Midjourney 图片生成替代｜AI 图片生成与编辑
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its image-generation purpose, but it needs Review because a compromised API response could make it save downloaded files outside the intended output folder.
Install only if you are comfortable sending prompts and chosen reference images to AI Hive. Use a virtual environment, avoid confidential images or unreleased brand assets unless AI Hive's terms allow it, and set a dedicated output directory. The publisher should fix output path sanitization and restrict downloads to validated HTTPS media URLs before this is treated as routine-risk.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/imagegen.py:262- Finding
Unrestricted Download of Remote URLs and Unvalidated Content
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:53- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` - Generate and review a complete hashed lock file using an established dependency-management tool. - Install dependencies in an isolated virtual environment rather than the system Python environment. - Document the expected package index and avoid untrusted mirrors. - Add automated dependency vulnerability scanning and a controlled update process. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill invokes a local Python script that can use shell, filesystem, environment, and network capabilities, but the manifest does not declare any tool restrictions or allowed-tools scope. This increases the chance the agent can run with broader privileges than users expect, making misuse or accidental overreach harder to constrain or audit.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description says to use the skill when users search for terms like "Midjourney alternative", "文生图", "图生图", "海报", or "广告图片", which are broad topics that can arise in many ordinary image-generation requests. It does not provide exclusion conditions or negative examples to clarify when the skill should not activate, increasing the risk of unintended invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation states that authenticated traffic, including uploaded images and prompts, is sent to a remote API, but it does not prominently require informed user consent before data leaves the local environment. Users may unknowingly transmit sensitive images, branding assets, or confidential prompts to a third party, creating privacy, confidentiality, and compliance risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 70% confidence
- Finding
The manifest description and markdown content are primarily written in Chinese with embedded English terms, but there is no statement that the skill can respond in the user's preferred language. If organizational policy requires language choice or opt-in, this may be a locale/language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and subsequent user-facing CLI text are written exclusively in Chinese, and the skill does not indicate that Chinese is optional or that the tool is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The initialization flow and related prompts require the user to interact in Chinese, but the file provides no mechanism to select another language and no justification that this is a China-only compliance tool. This is a natural-language locale policy violation rather than a code-security flaw.
- Content
Static analysis
No suspicious patterns detected.