Seedream 5.0 Lite 商品精修

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.0

Overview

The skill matches its product-photo retouch purpose, but it needs review because it trusts server-provided upload and download locations too broadly.

Install only if you are comfortable sending selected product images and prompts to AI Hive and storing an API key locally. Review the upload/download URL handling before using it with confidential product photos or in a sensitive network environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/imagegen.py:215

Finding

Unvalidated Server-Provided Upload Destination

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:215-224
Vulnerability Type: Unrestricted remote upload destination and HTTP method
Risk Level: High

python

media_id = token["mediaId"]
upload_url = token["upload"]["url"]
upload_method = token["upload"].get("method", "PUT")
upload_headers = token["upload"].get("headers", {})

# PUT to object storage without the API key, using the returned headers
print(f"[2/3] Uploading file to object storage...")
with open(str(path), "rb") as f:
    try:
        oss_resp = requests.request(
            upload_method, upload_url, headers=upload_headers,
            data=f, timeout=300,
        )

Technical Analysis

The upload-token API response controls the URL, HTTP method, and headers used to transmit the selected local image. The client does not verify that the URL uses HTTPS, belongs to an approved object-storage domain, or resolves to a public address. It also does not restrict the returned method to an expected upload method such as PUT.

Although the primary API endpoint is fixed, a compromised AI Hive service, compromised upstream component, or maliciously altered API response could instruct the client to transmit the image to an arbitrary external or internal endpoint.

Attack Path

1. A user invokes the generation or upload command with a local image.
2. The client requests an upload token from the fixed AI Hive API.
3. A compromised service or upstream component returns an attacker-controlled upload.url, upload.method, or upload.headers value.
4. The client opens the user-selected image.
5. requests.request() sends the image body to the attacker-selected destination without destination validation.
6. The attacker receives the image or causes the client to issue a request against a network service reachable from the user's machine.

Impact Assessment

Successful exploitation can disclose the complete contents ...[truncated 483 chars]

Remediation

View remediation

Remediation Suggestions

• Require the upload URL to use HTTPS.
• Maintain an explicit allowlist of approved object-storage hostnames and reject all other destinations.
• Resolve the destination and reject loopback, private, link-local, multicast, and other non-public address ranges.
• Restrict upload methods to the exact methods required by the service, such as PUT or POST.
• Allowlist permitted upload headers rather than forwarding every server-provided header.
• Disable redirects for upload requests or validate every redirect destination using the same policy.
• Consider cryptographically binding upload-token responses to an expected storage provider and media identifier.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:330

Finding

Unvalidated Result URLs and Unsafe Output Filename Construction

Content

View full analysis

Vulnerability Details

File Location: scripts/imagegen.py:246-255 and scripts/imagegen.py:330-346
Vulnerability Type: Unrestricted remote download and path traversal
Risk Level: Medium

python

def download_file(url, out_path, timeout=300):
    """Stream download a file and display progress."""
    print(f"[download] {out_path.name}")
    try:
        resp = requests.get(url, stream=True, timeout=timeout)
        resp.raise_for_status()
        total = int(resp.headers.get("content-length", 0))
        downloaded = 0
        with open(str(out_path), "wb") as f:
            for chunk in resp.iter_content(chunk_size=8192):

python

out_dir = Path(output_dir)
out_dir.mkdir(parents=True, exist_ok=True)
task_type = task.get("taskType", "task")
for i, item in enumerate(succeeded):
    result_url = item.get("resultUrl")
    if not result_url:
        continue
    ext = ".mp4" if "video" in task_type.lower() else ".png"
    filename = f"{task_type}_{task_id}_{i+1}{ext}"
    out_path = out_dir / filename
    download_file(result_url, out_path)

# Last frame
for item in succeeded:
    last_frame = item.get("lastFrameUrl")
    if last_frame:
        out_path = out_dir / f"{task_type}_{task_id}_lastframe.png"
        download_file(last_frame, out_path)

Technical Analysis

The task response supplies resultUrl, lastFrameUrl, and taskType, while task_id originates from the task-creation response during normal generation. These values are used without URL or filename validation.

requests.get() follows redirects by default. Consequently, a compromised task API can direct the client to arbitrary URLs or redirect it to internal network locations.

The output filename is built by directly interpolating taskType and taskId. Path separators and traversal components are not removed, and the resolved path is not checked to ensure that it remains inside `output_d ...[truncated 1747 chars]

Remediation

View remediation

Remediation Suggestions

• Require result URLs to use HTTPS and match an explicit allowlist of approved result-storage domains.
• Resolve destination addresses and reject private, loopback, link-local, multicast, and reserved address ranges.
• Disable redirects or validate each redirect destination before following it.
• Sanitize taskType and taskId to a conservative filename character set such as letters, digits, underscores, and hyphens.
• Construct the candidate path, resolve it, and verify with Path.relative_to() or an equivalent check that it remains under the resolved output directory.
• Generate local filenames independently of remote metadata where possible.
• Use exclusive file creation or prompt before overwriting existing files.
• Enforce a maximum download size while streaming to prevent uncontrolled disk consumption.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:73

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:73 and scripts/imagegen.py:14-18
Vulnerability Type: Unpinned and unverifiable dependency installation
Risk Level: Low

bash

pip3 install requests

python

try:
    import requests
except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The installation instructions request the latest package version resolved from the user's active pip index. The project provides no pinned version, lockfile, hash verification, or explicit trusted index.

The package name is correct and no dependency-confusion namespace is visible in the project. Nevertheless, mutable dependency resolution reduces reproducibility and means that installation behavior can change after the Skill has been reviewed.

Attack Path

1. A user follows the documented pip3 install requests instruction.
2. Pip resolves the package using the current environment and configured package indexes.
3. A compromised package index, malicious mirror, poisoned local pip configuration, or future compromised release supplies unreviewed package content.
4. The package or its installation process executes with the privileges of the user running pip.
5. Subsequent Skill execution imports and runs that installed dependency.

Impact Assessment

A malicious dependency can execute code with the privileges of the installing or invoking user, potentially accessing that user's files, environment variables, and API credentials. The actual likelihood is reduced because requests is a well-known package and the project does not direct users to an obviously untrusted source. No malicious dependency is included in the audited project itself.

Remediation

View remediation

Remediation Suggestions

• Pin requests to a reviewed version or narrowly bounded compatible version.
• Provide a requirements.txt or lockfile with cryptographic hashes.
• Recommend installation from an explicitly trusted package index.
• Periodically review and update pinned dependencies for published security advisories.
• Prefer an isolated virtual environment instead of installing into a global Python environment.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a local Python script that can read files, write files, access environment data, use the shell, and make network requests, yet the manifest does not declare any tool permissions or allowed-tool scope. This weakens policy enforcement and reviewability: an agent/runtime may grant broader capabilities than users expect, increasing the risk of unintended file access, secret exposure, or outbound data transfer if the script or future edits are abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description and main instructions are written as mandatory Chinese guidance for the skill, and the examples/prompts are all provided only in Chinese. This creates a locale/language constraint without explicitly offering the user a choice of language or documenting a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file uses Chinese-only docstrings, prompts, status messages, help text, and CLI guidance, which effectively requires users to interact in Chinese. The policy allows locale constraints only when clearly justified or when the user is offered a language choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a narrowly scoped product-retouch skill that preserves product structure, material, labels, and commercial facts. However, the CLI accepts any prompt via --prompt and arbitrary --param key=value pairs, and forwards them directly to the generic image generation endpoint, with no code-level enforcement of retouch-only behavior or preservation constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example API key value includes Chinese-only instructional text ("请替换为你的APIKey"), which imposes a specific language in a user-facing configuration artifact. There is no indication that the skill is region-specific or that users can choose their preferred language, so this conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The docstring says the tool only exposes fixed-model image generation, limited reference-image upload, task query, and API key initialization. Yet the actual CLI includes distinct upload, task, and init commands and supports general-purpose parameter forwarding, so the documentation understates and partially mischaracterizes the surfaced interface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The stated purpose is to retouch authorized product photos through AI Hive. In addition to generation/editing, the script provides separate task and upload subcommands that let callers query arbitrary task IDs and upload images independently, which broadens the practical behavior beyond the manifest's focused retouch workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.