Security audit

商品详情页套图一键生成

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill mostly matches its stated purpose, but its downloader trusts remote task data enough to create file overwrite and unbounded download risk.

Review before installing. Use this only if you trust the AI Hive service and are comfortable storing an API key locally, uploading selected product reference images, and saving generated outputs. Prefer running it in an isolated environment and choosing a non-sensitive output directory until the downloader validates returned URLs, enforces size limits, and prevents output-directory escape.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:350
Finding: Server-Controlled Task Type Permits Output-Directory Escape and File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:258
Finding: Unrestricted API-Supplied Download URLs Enable Server-Side Request Forgery and Unbounded Downloads
Content: View full analysis
Remediation: View remediation
MAX_DOWNLOAD_BYTES: raise ValueError("Download exceeds the permitted size") downloaded = 0 with open(out_path, "xb") as output: for chunk in resp.iter_content(chunk_size=8192): if not chunk: continue downloaded += len(chunk) if downloaded > MAX_DOWNLOAD_BYTES: raise ValueError("Download exceeds the permitted size") output.write(chunk) ``` ]]>

T08 · Insecure Dependencies

Note

Location: SKILL.md:74
Finding: Unpinned Third-Party Dependency Installation Produces a Non-Reproducible Supply Chain
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell commands, installs packages, reads local files, writes outputs, and makes network requests, but it does not declare any explicit tool scope or permissions boundaries. That creates unnecessary ambient authority: an agent may execute filesystem and network operations beyond what a reviewer expects, increasing the chance of unsafe execution or data exfiltration if the script or surrounding instructions are modified or abused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill’s natural-language description and instructions are written entirely in Chinese and do not indicate that users may choose another language or locale. Under the policy, a language constraint should either be optional or explicitly justified; neither is stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file contains user-facing natural-language strings and documentation exclusively in Chinese, including the module docstring and operational prompts. That can violate a language/locale policy when users are not given an explicit language choice and no region-specific justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.