ClawHub
Back to skill

Security audit

Seedream 5.0 Lite 图生图

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent image-editing skill that uploads user-selected images to AI Hive and stores an API key, with some install and credential-handling cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable sending the selected reference images and prompts to AI Hive and storing an AI Hive API key locally. Prefer using a virtual environment and pinned dependencies, and avoid running `init` on shared multi-user systems with weak filesystem controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:75
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:75
Vulnerability Type: Supply-chain risk caused by an unpinned runtime dependency
Risk Level: Medium

Vulnerable Code

bash
pip3 install requests
python3 "$SKILL_PATH/scripts/imagegen.py" init --skill-name seedream-5-lite-image-to-image
python3 "$SKILL_PATH/scripts/imagegen.py" task --task-id <taskId>

The script directly imports the dependency:

python
try:
    import requests
except ImportError:
    print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The documented installation command installs the latest version of requests and its transitive dependencies without a version constraint, lock file, integrity hash, or reproducible dependency manifest. Consequently, the code that executes on a user's system may differ from the dependency version reviewed during the skill audit.

This does not demonstrate that the current requests package is malicious. The weakness is that future package changes, a compromised upstream release, a compromised package index, or dependency-resolution changes could introduce unreviewed code. Python packages and their installation mechanisms can execute code with the privileges of the user performing the installation.

Attack Path

  1. An attacker compromises a future release or a transitive dependency resolved by the unpinned installation.
  2. A user follows the documented pip3 install requests command.
  3. The package manager retrieves the compromised or unexpectedly changed dependency.
  4. Malicious package code executes during installation or when imagegen.py imports and uses the package.
  5. The code operates with the privileges and data access of the user running the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's permissions, an attacker could access local files, environmen ...[truncated 226 chars]

Remediation
View remediation

Remediation Suggestions

  • Add an audited dependency manifest or lock file with exact versions.
  • Pin requests and every transitive dependency to reviewed versions.
  • Include package hashes and install with pip install --require-hashes -r requirements.txt.
  • Use a dedicated virtual environment rather than installing into a shared interpreter.
  • Introduce automated dependency vulnerability and integrity scanning.
  • Review and deliberately update the lock file instead of resolving the latest dependency at every installation.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/imagegen.py:501
Finding

API Key Configuration Is Written Before Secure Permissions Are Applied

Content
View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:501-505
Vulnerability Type: Non-atomic secret-file creation and symbolic-link following
Risk Level: Low

Vulnerable Code

python
config_dir = os.path.dirname(CONFIG_FILE_PATH)
os.makedirs(config_dir, exist_ok=True)
with open(CONFIG_FILE_PATH, "w", encoding="utf-8") as f:
    json.dump({"api_key": api_key}, f, indent=2)
os.chmod(CONFIG_FILE_PATH, 0o600)

Technical Analysis

The API key is written using the standard open(..., "w") operation before the file is restricted to mode 0600. Its permissions at creation time therefore depend on the process umask. Under a permissive umask, the file may temporarily be readable by other local users before chmod is called.

The operation is also not protected against symbolic links. If an attacker can control ~/.ai-hive/config.json or its parent path, open() follows an existing symbolic link and truncates its target. The subsequent chmod() also operates through the configured path. Exploitation requires local access sufficient to manipulate or observe the relevant filesystem path, so this is not a remote vulnerability.

Attack Path

A confidentiality attack can proceed as follows:

  1. The victim runs init in a local multi-user environment with a permissive umask.
  2. open() creates or truncates the configuration file using permissions derived from that umask.
  3. The API key is written before mode 0600 is applied.
  4. Another local user monitoring the path reads the key during the exposure window.

A symbolic-link attack can proceed as follows:

  1. A local attacker gains control of the configuration path or a writable parent directory.
  2. The attacker creates ~/.ai-hive/config.json as a symbolic link to a file writable by the victim.
  3. The victim runs the init command.
  4. The linked target is truncated and replaced with the JSON API-key content.
  5. Depending on the target selected, this may disclose the key or corru ...[truncated 558 chars]
Remediation
View remediation

Remediation Suggestions

  • Create ~/.ai-hive with mode 0700 and verify that it is a real directory owned by the current user.
  • Create secret files with secure permissions from the outset by using os.open() with mode 0600.
  • Use O_CREAT, O_EXCL, and O_NOFOLLOW where supported to prevent unintended replacement and symbolic-link traversal.
  • For configuration replacement, write to a securely created temporary file in the same directory, flush and synchronize it, and atomically install it with os.replace().
  • Before replacing an existing configuration, use lstat() to reject symbolic links and validate that the existing object is a regular file owned by the current user.
  • Set a restrictive umask as defense in depth, but do not rely on umask as the only protection.
  • Handle write and permission-setting failures by removing any partially created secret file.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill exposes meaningful capabilities through its documented workflow and commands—network access to an external API, local file read/write, environment usage, and shell execution—yet it does not declare an explicit tool scope or allowed-tools policy. This weakens least-privilege controls and can let an agent invoke broader capabilities than reviewers or platform policy expect, especially because the skill handles local image files, persists credentials, and performs outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and all user-facing prompts/messages in this file are written exclusively in Chinese, and the skill does not provide any option to select another language or opt in to this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The placeholder value for api_key includes Chinese text (请替换为你的APIKey), which imposes a specific language in user-facing configuration content. The file does not offer a language choice or document a justified locale-specific scope, so this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.