Security audit

Shopify 电商图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does the advertised AI image-generation work, but it handles API credentials in a way that can send them to a user- or environment-controlled API endpoint.

Review before installing. Use this only with a trusted AI Hive endpoint, avoid setting `AI_HIVE_BASE_URL` or `--base-url` unless you fully trust the destination, use a limited API key, and install dependencies in a virtual environment. Be aware that product images you provide will be uploaded to the service and generated outputs are downloaded locally.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:109
Finding: Stored API Credentials Can Be Redirected to an Arbitrary Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:82
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing natural language almost exclusively in Chinese, which can impose a language constraint on users without opt-in. The policy for SQP-3 flags language or locale restrictions unless the skill offers choice or clearly justifies the locale limitation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes Python scripts, installs dependencies, and relies on shell, file, environment, and likely network access, but it does not declare any explicit tool scope or permissions boundary. This creates an authorization gap where an agent may run the skill with broader capabilities than intended, increasing the risk of unintended command execution, filesystem access, or external requests if task inputs or downstream scripts are abused.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file is presented as a Shopify image-generation/editing skill, but the implementation is a broad generic AI client that exposes text chat, video generation, model enumeration, task polling, user-info lookup, and arbitrary media upload. This scope mismatch increases attack surface and enables capability abuse beyond the user’s expected consent, including unintended account data access and use of unrelated generative endpoints.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring explicitly describes a generic AI capability tool rather than a Shopify-specific image skill, which materially contradicts the declared purpose. This kind of misleading packaging is dangerous because reviewers and users may grant trust, tokens, or files under a narrower expectation than the code actually implements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring and all user-facing guidance in this file are written in Chinese, including setup, prompts, errors, and command help. There is no indication that users can opt into another language, which may violate an organizational language/locale policy requiring user choice rather than a forced locale.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Arbitrary text chat is unrelated to Shopify image editing and allows this skill to act as a general-purpose LLM client. That broadens the trust boundary, increases opportunities for prompt misuse or data leakage through an unrelated endpoint, and defeats the principle that a narrowly described skill should only expose narrowly required capabilities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Video generation is outside the declared image-generation/editing scope, yet the code includes full support for uploading image/video/audio inputs and submitting video jobs. This expands the skill’s effective permissions and can be abused for unreviewed media processing workflows that users and reviewers would not expect from an image-only Shopify skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description includes Chinese text alongside English, which imposes a multilingual presentation choice without explaining whether this skill is intended for bilingual users or offering a language preference. Under the policy rule, language or locale constraints should be opt-in or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example API key value includes Chinese-only instructional text ("请替换为你的APIKey"), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may use another language, so this appears to violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: User-info and wallet-balance retrieval are unrelated to creating Shopify product images and expose unnecessary account metadata. In a skill context, this violates least privilege and can normalize collection of billing/account information that the user did not expect to share for image editing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.