Security audit

Seedream 5.0 Lite 商品详情页

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but its result downloader trusts remote task data in a way that could fetch unexpected URLs or write outside the chosen output folder.

Review before installing. Use this only with an AI Hive account you trust, avoid running it in directories containing sensitive files, set a dedicated output directory, and prefer an isolated virtual environment with pinned dependencies. Do not use it on networks where unintended requests to internal HTTP services would be risky until URL and path validation are tightened.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:259
Finding: Untrusted API response fields permit unrestricted downloads and output-directory traversal
Content: View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) print() size_mb = downloaded / (1024 * 1024) print(f"[ok] {out_path} ({size_mb:.1f} MB)") except requests.exceptions.RequestException as e: print(f"\n[error] Download failed: {e}", file=sys.stderr) ``` ```python # Download results out_dir = Path(output_dir) out_dir.mkdir(parents=True, exist_ok=True) task_type = task.get("taskType", "task") for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) # Last frame for item in succeeded: last_frame = item.get("lastFrameUrl") if last_frame: out_path = out_dir / f"{task_type}_{task_id}_lastframe.png" download_file(last_frame, o ...[truncated 2884 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:75
Finding: Dependency installation instructions use an unpinned package version
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes Python scripts that can install packages, read local files, write outputs, access environment variables, and send network requests, but it does not declare any explicit tool or permission scope. This creates an avoidable trust gap: an agent may grant broader execution than users expect, increasing the risk of unintended shell, file, or network actions if the skill is invoked in a permissive runtime.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description contains many broad trigger phrases covering multiple e-commerce platforms, image types, and workflows, which can cause the skill to be invoked in loosely related contexts. Over-broad routing increases the chance that the skill runs on requests it was not intended for, exposing users to unnecessary file, shell, and network-capable behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and all user-facing instructions are written exclusively in Chinese, and the CLI prompts throughout the file also assume Chinese interaction. Under the policy for natural-language constraints, this is a locale/language restriction without an explicit opt-in or alternative language path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The instructions require a fixed model and the file content is written to operate in Chinese-language output patterns without offering any user language or locale choice. This can be a language/locale policy concern when the skill is used in broader contexts where users may expect language preference selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The sample value for api_key includes Chinese text (请替换为你的APIKey), which imposes a specific language in user-facing configuration content. There is no accompanying opt-in, alternative locale, or documented justification that this file is intended only for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes a narrowly scoped Seedream 5 Lite PDP generation skill, but this script includes generic task and upload commands that operate independently of generating detail-page modules. Those capabilities extend beyond the user-facing description of producing PDP content through module generation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: For a product-detail-page image generation skill, launching a browser to a chat URL with from=cli-skill&skill=... is an ancillary attribution/onboarding capability rather than a direct requirement of generating images. This goes beyond the core purpose described in the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.