Security audit

Seedream 5.0 Lite 文生图

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused text-to-image helper that uses AI Hive as disclosed, with some ordinary integration risks users should understand.

Install only if you are comfortable using an AI Hive API key and sending prompts to AI Hive. Prefer an isolated virtual environment, consider pinning dependencies, keep the API key scoped and revocable, and choose an output directory with enough space because result downloads are not size-limited by the script.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:71
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:181
Finding: Unrestricted and Unbounded Download of Server-Supplied URLs
Content: View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) print() size_mb = downloaded / (1024 * 1024) print(f"[ok] {out_path} ({size_mb:.1f} MB)") except requests.exceptions.RequestException as e: print(f"\n[error] 下载失败: {e}", file=sys.stderr) ``` The URL is taken directly from the remote task response: ```python for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) # 尾帧 for item in succeeded: last_frame = item.get("lastFrameUrl") if last_frame: out_path = out_dir / f"{task_type}_{task_id}_lastframe.png" download_f ...[truncated 3046 chars]
Remediation: View remediation
MAX_DOWNLOAD_BYTES: raise ValueError("Download exceeds size limit") output.write(chunk) ``` 5. Validate the response `Content-Type` against the expected media type and verify the downloaded file's magic bytes using a trusted image parser. 6. Write to a restrictive temporary file in the destination directory, flush and synchronize it, validate its contents, and then atomically rename it to the final path. 7. Delete temporary or partial files on every failure path. 8. Apply a total download deadline in addition to connection and read timeouts. 9. Consider resolving approved hosts and blocking loopback, link-local, private, and otherwise sensitive address ranges if the storage architecture does not legitimately require them. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose says the skill is for text-to-image generation, but the documented commands also expose initialization/configuration behavior and task querying that are not clearly described in the top-level purpose. This mismatch can mislead operators about what the skill actually does, increasing the chance that browser opening, API key handling, or auxiliary actions are approved without proper scrutiny.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes Python scripts that require shell, network, environment, and likely file access, but it does not declare any tool scope or permissions boundaries. This weakens review and enforcement, making it easier for the skill to use broader capabilities than users or the platform may expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description says to use this skill for broad phrases like "编辑插画", "概念设计", "社媒创意", and "广告提案", which are generic design activities rather than narrowly scoped invocation triggers. Without clearer trigger boundaries or exclusion conditions, the skill may be invoked for many ordinary creative requests beyond its intended Seedream 5 Lite text-to-image workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-level docstring states the tool exposes '允许范围内的参考图上传' and suggests support for reference-image-based generation. In the actual skill-specific path, _validate_image_inputs terminates if any image input is present, so the documentation actively contradicts the behavior of this packaged skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest explicitly says this Seedream 5 Lite skill is for pure text-to-image and '不读取参考图' (does not read reference images). However, the user-facing CLI help for the generate command says '生成或编辑图片' and the prompt help says '图片描述或编辑要求', which advertises editing behavior inconsistent with the skill's declared text-only scope, even though runtime validation later blocks reference images.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 70% confidence
Finding: The description is primarily written in Chinese but also embeds an English directive ("Use this skill for...") without stating a user-selectable language or locale policy. This can create an implicit language preference in skill behavior or metadata without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.