PhotoRoom 图片生成替代｜AI 图片生成与编辑

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:10 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI image-generation helper that uploads user-selected product images to AI Hive and stores an API key locally, with no evidence of hidden or destructive behavior.

Install only if you are comfortable sending selected product images and prompts to AI Hive. Use the local config file or environment variable for the API key instead of `--api-key`, and prefer installing dependencies in a virtual environment with pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:53 and scripts/imagegen.py:7,21
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:53:

bash

pip3 install requests

scripts/imagegen.py:7:

python

Dependency: requests (pip3 install requests)

scripts/imagegen.py:19-22:

python

try:
    import requests
except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

The messages in the Python source are translated here for clarity; the executable installation command is unchanged.

Technical Analysis

The documented installation procedure resolves requests and its transitive dependencies from the package index at installation time without a version constraint, lockfile, package hash, or trusted-index restriction. Consequently, the dependency graph that users receive can change after this Skill has been audited.

Although requests is a legitimate package and the project does not contain evidence that it intentionally selects a malicious dependency, this installation pattern weakens supply-chain reproducibility. A compromised package release, package-index account, index mirror, or transitive dependency could introduce code that was not present during the audit. Python package installation and import-time initialization may execute code under the installing or invoking user's account.

Attack Path

1. A user follows the installation instruction and runs pip3 install requests.
2. pip queries its configured package index or mirror and resolves the latest compatible package set.
3. An attacker who has compromised a relevant package release, maintainer account, dependency, or configured mirror supplies malicious package content.
4. The malicious package is installed without a project-provided hash comparison detecting the substitution.
5. Malici ...[truncated 773 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency file that pins exact versions, including relevant transitive dependencies.

2. Record cryptographic hashes and install with hash verification, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate and review a lockfile through a dependency-management tool such as pip-tools.

4. Document an approved HTTPS package index and avoid untrusted mirrors.

5. Use an isolated virtual environment rather than installing into a shared or privileged Python environment.

6. Add automated dependency vulnerability and integrity scanning to the release process.

7. Replace the bare installation instruction in both the documentation and error message with the locked, hash-verified procedure.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/imagegen.py:401

Finding

API Key Can Be Supplied Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:66-68,80,401-403
Vulnerability Type: Sensitive credential exposure through command-line arguments
Risk Level: Low

Vulnerable Code

scripts/imagegen.py:66-68:

python

def _resolve_api_key(self, cli_key):
    if cli_key:
        return cli_key

scripts/imagegen.py:80:

python

"  · Command-line argument: --api-key sk-api-xxxxx\n"

scripts/imagegen.py:401-403:

python

def add_common_args(parser):
    parser.add_argument("--api-key", help="AI Hive API Key (sk-api-*)")
    parser.add_argument("--verbose", action="store_true", help="Detailed logging")

The displayed messages and help text are translated here for clarity; the argument name and program behavior are unchanged.

Technical Analysis

The CLI explicitly accepts the AI Hive API key through --api-key. Command-line arguments are not an appropriate secret-transport mechanism on many systems because they may be recorded in shell history, terminal logs, process accounting, diagnostic bundles, automation logs, or command-line telemetry. Depending on operating-system process visibility, another local user or process may also be able to inspect the argument while the program is running.

The implementation does not print the CLI key during normal operation, and it also supports safer alternatives through the AI_HIVE_API_KEY environment variable and a configuration file protected with mode 0600. The issue is therefore limited to users who select the explicitly documented command-line option.

Attack Path

1. A user invokes the Skill with a command such as:

   bash

   python3 scripts/imagegen.py generate --api-key sk-api-secret-value --prompt "..."
   

2. The complete command is stored in shell history, captured by a CI/CD log, exposed through process inspection, or retained by system diagnostics.

3. A local attacker, log reader, sup ...[truncated 832 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key argument and its documentation.
2. Prefer the existing mode-0600 configuration file or integrate an operating-system credential store.
3. For interactive use, accept a key through hidden terminal input with getpass.getpass() rather than a visible command argument.
4. For automation, read the secret from a protected file descriptor or secret-management integration. If an environment variable remains supported, warn users that some debugging and deployment systems may capture environment values.
5. Ensure CI/CD examples use masked secret variables and never interpolate the key directly into a logged command.
6. Document key revocation and rotation procedures for users who previously supplied credentials through the CLI.
7. Avoid displaying even partial key values where they are not operationally necessary.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes shell, filesystem, environment, and network-capable commands but does not declare any explicit tool scope or permission boundaries. That creates unnecessary ambiguity about what an agent may execute and increases the blast radius if the skill is invoked in an unexpected context or later modified with unsafe inputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad enough to match many ordinary image-editing requests, which can cause the skill to auto-activate outside its narrow intended use. Over-broad routing is dangerous because it may funnel user requests into a skill that performs networked code-backed operations, increasing the chance of unintended execution and data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The text states "模型锁定为 public_model_nano_banana_pro", which hard-codes a specific model choice in natural language. This is a policy-style constraint imposed without user opt-in or explanation of why no alternative is allowed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.