Seedream 5.0 Lite 多参考图生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:03 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its image-generation purpose, but it has review-worthy containment gaps around API-controlled downloads and local file writes.

Review before installing. Use this only if you are comfortable sending the selected reference images and prompts to AI Hive, storing an API key locally, and writing outputs under your user account. Prefer running it in a constrained directory or container until the downloader validates result hosts and sanitizes output filenames.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:263

Finding

Unvalidated API-Controlled Result URL Enables Arbitrary Network Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:263-268, 352-357
Vulnerability Type: Server-Side Request Forgery through an untrusted result URL
Risk Level: Medium

Vulnerable Code:

python

def download_file(url, out_path, timeout=300):
    """Stream a file download and display progress."""
    print(f"[download] {out_path.name}")
    try:
        resp = requests.get(url, stream=True, timeout=timeout)
        resp.raise_for_status()

python

for i, item in enumerate(succeeded):
    result_url = item.get("resultUrl")
    if not result_url:
        continue
    ext = ".mp4" if "video" in task_type.lower() else ".png"
    filename = f"{task_type}_{task_id}_{i+1}{ext}"
    out_path = out_dir / filename
    download_file(result_url, out_path)

Technical Analysis

The resultUrl value is obtained from a remote API response and passed directly to requests.get without validating its scheme, hostname, resolved IP address, port, or redirect destination. The Requests library follows redirects by default for GET requests.

If the AI Hive API, an upstream task provider, or the relevant API response is compromised, an attacker can cause the client to issue a GET request to an arbitrary destination reachable from the user's machine. Potential destinations include loopback services, private network hosts, cloud metadata endpoints, and link-local services.

Attack Path

1. An attacker gains the ability to influence a generation-task API response.
2. The attacker places an arbitrary URL in the completed task item's resultUrl, such as an internal HTTP service or a redirector leading to a private address.
3. The client identifies the task item as completed and calls download_file.
4. requests.get connects to the attacker-selected destination and follows redirects without destination validation.
5. The response body is written to the configured output directory.

...[truncated 623 chars]

Remediation

View remediation

Remediation Suggestions

• Permit only HTTPS result URLs.
• Maintain an explicit allowlist of approved object-storage hostnames.
• Reject URLs containing embedded credentials, unexpected ports, fragments, or unsupported schemes.
• Resolve destination hostnames and reject loopback, private, link-local, multicast, reserved, and unspecified IP ranges.
• Disable automatic redirects or validate every redirect target against the same policy.
• Apply download-size limits in addition to the existing timeout.
• Prefer receiving an opaque media identifier from the API and resolving it through a trusted, fixed endpoint rather than accepting an arbitrary URL.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:344

Finding

API-Controlled Filename Component Can Escape the Output Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:344-357
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: Medium

Vulnerable Code:

python

# Download results
out_dir = Path(output_dir)
out_dir.mkdir(parents=True, exist_ok=True)
task_type = task.get("taskType", "task")
for i, item in enumerate(succeeded):
    result_url = item.get("resultUrl")
    if not result_url:
        continue
    ext = ".mp4" if "video" in task_type.lower() else ".png"
    filename = f"{task_type}_{task_id}_{i+1}{ext}"
    out_path = out_dir / filename
    download_file(result_url, out_path)

The resulting path is subsequently opened for writing:

python

with open(str(out_path), "wb") as f:
    for chunk in resp.iter_content(chunk_size=8192):
        if chunk:
            f.write(chunk)

Technical Analysis

taskType is read from the remote task response and inserted into a local filename without sanitization. The generated path is joined to out_dir, but the code does not resolve the path and verify that it remains within that directory.

A value containing directory separators or traversal elements can cause the resulting file to be written outside the intended download directory. If the constructed filename is absolute, pathlib can also discard the preceding out_dir. The file is opened with wb, so an existing file at the resulting location is truncated and overwritten. No exclusive-creation or symbolic-link protection is applied.

Attack Path

1. An attacker compromises or otherwise controls the generation-task API response.
2. The attacker supplies a crafted taskType containing path traversal components or an absolute path.
3. The application concatenates the untrusted value with the task identifier and extension.
4. out_dir / filename resolves syntactically to a location outside the intended output directory.
5. download_file r ...[truncated 685 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use API-controlled values in local filenames. Generate filenames from trusted constants, local counters, and validated task identifiers.
• If taskType must be retained, map recognized values to fixed local names rather than sanitizing arbitrary input.
• Resolve both the output directory and final output path, then verify with Path.is_relative_to or an equivalent check that the final path remains below the output directory.
• Reject absolute paths, path separators, traversal sequences, control characters, and platform-specific alternate separators.
• Open new files in exclusive mode where overwriting is unnecessary.
• Consider protection against symbolic-link attacks, such as descriptor-relative file operations and no-follow semantics on supported platforms.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:73

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:73-77
Vulnerability Type: Mutable and unverifiable third-party dependency installation
Risk Level: Low

Vulnerable Code:

bash

pip3 install requests
python3 "$SKILL_PATH/scripts/imagegen.py" init --skill-name seedream-5-lite-multi-reference-image
python3 "$SKILL_PATH/scripts/imagegen.py" task --task-id <taskId>

The script repeats the same unpinned installation guidance:

python

"""AI Hive image-generation task utility.

Dependencies: requests (pip3 install requests)
"""

Technical Analysis

The installation instruction resolves the latest package version available from the user's configured Python package index. The project supplies no exact version, hash, constraints file, lockfile, or index restriction. Consequently, the code installed in response to the documented command can change after the skill has been reviewed.

This does not establish that the legitimate requests package is malicious. It is a supply-chain hardening deficiency: compromise of the package, its release process, the configured index, or dependency resolution could introduce unintended code into the runtime environment.

Attack Path

1. A user follows the documented pip3 install requests instruction.
2. Pip resolves package content from the user's configured package index without a project-provided version or hash constraint.
3. A compromised index, compromised future release, or unsafe index configuration supplies unintended package content.
4. Installation hooks or imported package code execute with the privileges of the user running pip or the skill.

Impact Assessment

Malicious dependency code would execute with the privileges of the Python environment's owner. It could access files, environment variables, API keys, and network resources available to that user. The practical risk is reduced because the named dependency is the well-know ...[truncated 133 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and its transitive dependencies to reviewed versions through a lockfile or constraints file.
• Require cryptographic hashes with pip's --require-hashes option.
• Document a trusted package index explicitly and avoid untrusted supplemental indexes.
• Use python -m pip within a dedicated virtual environment instead of modifying a shared interpreter.
• Establish a dependency-update process that reviews vulnerability advisories and regenerates verified hashes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is narrowly framed as controlled multi-reference image generation, but the skill behavior reportedly includes API key initialization, browser opening, local credential storage, task querying, and result downloading that are not clearly disclosed. This mismatch undermines informed consent and review, and it is especially risky because users may provide sensitive images or credentials while assuming the skill only performs simple generation with lineage controls that are not actually enforced.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes shell, network, environment, and file read/write capabilities without declaring any explicit tool scope or permissions boundary. That makes it harder for a caller or review system to understand what the skill can do and increases the risk of unintended command execution, credential handling, local file access, or outbound requests beyond the user’s expectation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description lists many generic activation phrases such as multi-image generation, style reference, brand visuals, and commercial pictures without clearly delimiting when this skill should or should not be invoked. In a manifest-style file, this breadth can cause unintended triggering for ordinary image-editing requests that are not specifically about Seedream 5 Lite multi-reference lineage-controlled generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file is predominantly written in Chinese and presents the skill behavior and prompts in Chinese without offering a language choice or documenting that the skill is intentionally region-specific. This can violate a language/locale policy when users have not explicitly opted into Chinese-only interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains user-facing docstrings, prompts, help text, and status messages entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest prominently claims the skill can '追踪每个身份、物体、结构、材质、构图和色板来自哪里' (track where each element comes from). In the implementation, generation is performed by sending prompt text, uploaded image media IDs, and opaque params to the backend, with no code that annotates, enforces, records, or reports per-reference provenance mapping.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example API key value includes the phrase "请替换为你的APIKey" in Chinese, which imposes a specific language in user-facing configuration content. The file does not offer an alternative language, user opt-in, or a documented region-specific justification for this locale choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes a narrowly scoped skill for generating Seedream 5 Lite images from multiple authorized reference images with controlled source inheritance. However, the code also exposes a generic task command to inspect arbitrary generation tasks and an upload command that uploads images independently of any generation request, which are auxiliary capabilities not described in the manifest.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.