T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:230- Finding
Unvalidated API Response Values Enable Arbitrary Outbound Requests and Path Traversal Writes
- Content
View full analysis
- Remediation
View remediation
Security audit
Seedream 5.0 Lite 电商主图
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly an AI image-generation wrapper, but it overstates its ecommerce compliance checks and has network/download handling that deserves review before installation.
Install only if you are comfortable sending product images and prompts to AI Hive and storing an API key locally. Do not rely on the skill as an automated ecommerce compliance reviewer; manually verify SKU accuracy, platform rules, and promotional claims before publishing. Prefer an isolated Python environment and a dedicated output directory until URL allowlisting, filename sanitization, download limits, clearer data-handling disclosure, and pinned dependencies are added.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:75- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
``` ### Technical Analysis The installation instructions install `requests` without specifying a reviewed version or package hash. Package resolution therefore depends on the package indexes and configuration active at installation time. Although `requests` is a legitimate and widely used package, an unpinned installation is mutable: later versions may introduce incompatible behavior or security regressions, and a compromised or maliciously configured package index could provide an unsafe artifact. Python packages may execute code during installation and are subsequently imported and executed by `scripts/imagegen.py`. ### Attack Path 1. A user follows the documented `pip3 install requests` command. 2. Pip resolves the dependency using the user's currently configured indexes, mirrors, and version-selection rules. 3. A compromised index, hostile mirror, or future compromised release supplies an unsafe package artifact. 4. Package-controlled code executes during installation or when `imagegen.py` imports `requests`. 5. The code runs with the privileges of the user performing the installation or invoking the Skill. ### Impact Assessment A malicious dependency could execute arbitrary code with the installing user's privileges. This could expose local files, environment variables, API credentials, generated media, and other resources available to that account. No malicious dependency is currently bundled in the reviewed project, and the finding does not establish that the official `requests` package is compromised. The risk arises from mutable, unverified dependency resolution. ]]>- Remediation
View remediation
--hash=sha256: ``` 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Pin and hash transitive dependencies as well as the direct `requests` dependency. 5. Use an isolated virtual environment rather than modifying a global Python installation. 6. Explicitly use a trusted package index and prevent unreviewed supplemental indexes. 7. Periodically update the lock file after security review and vulnerability scanning. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims four safety/compliance gates for SKU facts, channel rules, thumbnail recognizability, and promotional compliance, but the described behavior indicates those checks are not actually implemented and prompts are merely forwarded to an image-generation backend. This is dangerous because users may rely on nonexistent validation for regulated marketplace content, leading to false assurance, policy violations, and publication of misleading or noncompliant product imagery.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises executable capabilities involving shell, filesystem, environment access, and network access but does not declare any tool scope or permission boundaries in the skill manifest. That creates unnecessary ambiguity about what the skill may do at runtime and increases the risk of over-privileged execution, especially since it sends requests to an external API and writes local configuration/results.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description and core instructions are written as mandatory Chinese-language guidance for using the skill, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill effectively constrains interaction to a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill discloses that images are saved and sent to a fixed external API, but it does not specify what user-supplied images, prompts, metadata, or task artifacts are transmitted, stored, or retained. This lack of data-flow transparency can expose sensitive product assets, unpublished marketing materials, or proprietary prompts to unintended third-party processing without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing natural-language strings and documentation entirely in Chinese, including the module docstring and CLI guidance. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation when no alternative or opt-in mechanism is provided.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is marketed as a tightly constrained ecommerce-main-image workflow with compliance checks, but the implementation exposes a generic image client that accepts arbitrary prompts, arbitrary model parameters, direct media uploads, and raw task access. This mismatch can cause operators or downstream systems to trust the skill for policy-constrained generation when no such enforcement exists, enabling bypass of expected content, branding, or compliance safeguards.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes generating ecommerce main images, not browser automation or attribution/tracking behavior. The init flow constructs a URL containing from=cli-skill and the skill name, then launches the user's browser, which is ancillary account/onboarding behavior outside the core stated purpose.
- Content
Static analysis
No suspicious patterns detected.