ClawHub
Back to skill

Security audit

产品图生成

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI Hive product-image generation wrapper with some credential and dependency hygiene risks users should manage.

Install dependencies in a virtual environment, pin or verify `requests` if supply-chain reproducibility matters, avoid passing the API key on the command line, and upload only product/reference images you are comfortable sending to AI Hive for generation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:55
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:55; also referenced in scripts/imagegen.py:7 and scripts/imagegen.py:21
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: Medium

Complete Vulnerable Code Snippet:

bash
pip3 install requests

Technical Analysis

The installation instruction retrieves whichever version of requests the configured package index currently resolves as the latest release. It does not specify an audited version, use a lock file, or verify an integrity hash.

This makes dependency resolution mutable and non-reproducible. Although the audited project does not identify a presently malicious requests package, compromise of the package distribution channel, package-index configuration, or a future release could cause users to install code that was not part of this audit. Python package installation may execute package build or installation logic, and imported dependency code executes within the image-generation process.

Attack Path

  1. An attacker compromises a relevant package release, package-index account, configured mirror, or dependency distribution path.
  2. A user follows the documented pip3 install requests instruction.
  3. The package installer resolves and installs the attacker-controlled or compromised release because no version or hash is enforced.
  4. Malicious installation logic or imported runtime code executes under the user's account.
  5. The malicious dependency may access data available to the process, including the AI Hive API key, selected reference images, generated outputs, and user-writable files.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user running pip3 or the Skill. The scope depends on the installation environment. A normal user installation could expose that user's files and credentials, while an installation performed with elevated privile ...[truncated 213 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin requests to a specifically audited version rather than installing the latest available release.
  • Maintain dependencies in a version-controlled requirements or lock file.
  • Require package hashes, for example through pip install --require-hashes -r requirements.txt.
  • Install dependencies in an isolated virtual environment with no elevated privileges.
  • Use a trusted package index and restrict or verify configured mirrors.
  • Add automated dependency vulnerability and integrity scanning to the release process.
  • Update both SKILL.md and the missing-dependency message in scripts/imagegen.py so they provide the same hardened installation procedure.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/imagegen.py:439
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:439-440; the supplied value is consumed at scripts/imagegen.py:566-569
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Low

Complete Vulnerable Code Snippet:

python
def add_common_args(parser):
    parser.add_argument("--api-key", help="AI Hive API Key (sk-api-*)")
    parser.add_argument("--verbose", action="store_true", help="详细日志")

The credential is subsequently accepted when constructing the configuration:

python
config = Config(
    api_key=getattr(args, "api_key", None),
    verbose=getattr(args, "verbose", False),
)

Technical Analysis

Accepting a secret through --api-key places the API key in the command-line argument vector. Depending on the operating system and execution environment, arguments may be exposed through process inspection, shell history, terminal logging, job metadata, audit systems, monitoring agents, or automation logs.

The project already supports safer alternatives through AI_HIVE_API_KEY and ~/.ai-hive/config.json, with the configuration file changed to mode 0600. Retaining the command-line option unnecessarily provides a weaker credential-entry channel.

Attack Path

  1. A user invokes the Skill with an API key in the command, such as imagegen.py generate --api-key ....
  2. The shell records the command in history, or the running process exposes its argument vector through local process-inspection facilities or telemetry.
  3. Another local user, administrator, monitoring integration, log reader, or later account compromise obtains the recorded key.
  4. The exposed key is reused against the AI Hive API.
  5. The attacker performs operations authorized for that key until it is revoked or expires.

Impact Assessment

Exploitation does not directly elevate operating-system privileges. It can disclose the user's AI Hive API credentia ...[truncated 375 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the --api-key command-line argument from all subcommands.
  • Prefer the existing permission-restricted configuration file or integration with an operating-system secret store.
  • If interactive entry is required, read the key through a masked prompt using getpass.getpass() rather than through command-line arguments.
  • Permit environment-variable use only where process environments are appropriately protected, since environment variables may also be exposed by some diagnostic systems.
  • Update usage documentation so it does not recommend passing credentials directly on the command line.
  • Advise users who previously used --api-key to clear relevant shell history and logs and rotate potentially exposed keys.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes shell commands, reads local files, uses network access, and likely consumes environment-provided secrets, yet it does not declare any explicit tool scope or permission boundaries. That creates unnecessary ambient authority: an agent may run with broader capabilities than intended, increasing the blast radius if the script is modified, misused, or combined with adversarial inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description and the document content are written in Chinese and present the skill's invocation/use cases in that language only, without indicating that other languages are supported or that the user may choose a preferred locale. This can violate language/locale policy when a skill imposes a specific language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The embedded skill config and parser description label this as a '通用图片能力和商业场景搜索入口' and 'AI Hive 裸接口图片 Skill', which broadens the apparent intent beyond the manifest's specific product-image matrix use case. This inline documentation presents the tool as a generic image interface, contradicting the more constrained product-image positioning.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill exposes a generic task subcommand that can query arbitrary generation task IDs, which goes beyond the declared product-image generation scope. While this does not directly enable code execution or credential theft, it expands the skill into a more general AI Hive API client and may allow users to access metadata or outputs from unrelated tasks if task IDs are guessable or shared across contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.