Security audit

Stable Diffusion 图片生成替代｜AI 图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI Hive image-generation helper with some operational and supply-chain cautions, but no evidence of hidden, destructive, or deceptive behavior.

Install only if you are comfortable sending prompts, selected reference images, and an AI Hive API key to AI Hive. Prefer using a pinned requirements file, avoid running it with highly sensitive images, and monitor output downloads because result URLs and file sizes are not tightly constrained.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:55
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:243
Finding: Unbounded Downloads from Server-Provided URLs
Content: View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) print() size_mb = downloaded / (1024 * 1024) print(f"[ok] {out_path} ({size_mb:.1f} MB)") except requests.exceptions.RequestException as e: print(f"\n[error] 下载失败: {e}", file=sys.stderr) ``` ```python for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) # 尾帧 for item in succeeded: last_frame = item.get("lastFrameUrl") if last_frame: out_path = out_dir / f"{task_type}_{task_id}_lastframe.png" download_file(last_frame, out_path) ``` ### Technical Analysis The client downloads `resultUrl` and `lastFrameUrl` values supplied by the remote API without validating their scheme, destination host, port, or redirect target. The ...[truncated 2074 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose frames the skill as a migration/translation aid for Stable Diffusion-style workflows, but the content mainly instructs users to call a fixed remote model, initialize credentials, and fetch tasks locally. This mismatch can mislead users and orchestrators into granting trust or invoking the skill in contexts where hidden network access, local state changes, and data export are not expected.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a Python script with installation, initialization, task retrieval, and remote API access, yet the manifest does not declare any tool scope or allowed-tools boundaries. This creates an under-specified trust boundary: a caller may assume a documentation-only migration helper while the skill can read environment/config, write local files, use shell, and make network requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description says to use the skill when users search terms including broad phrases like '文生图' and '图生图', which are generic image-generation requests rather than narrowly scoped migration intents. This can cause the skill to activate for ordinary image tasks instead of only Stable Diffusion workflow migration scenarios.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings and CLI guidance entirely in Chinese, including its module docstring and all user-facing prompts. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The file content is primarily written in Chinese with embedded English terms, but it does not state that the skill should adapt to the user's preferred language. This may create a language-policy issue if the skill responds in a fixed language without user opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The init flow opens a browser to a URL that includes a skill-derived query parameter (skill={skill_name}) explicitly noted for backend attribution. This leaks usage metadata unrelated to core image generation and can enable tracking of which skill/tool a user is invoking, even if the value is not highly sensitive by itself. In this context the value is fixed from SKILL_CONFIG by default, which limits attacker control, but it still creates unnecessary telemetry and privacy exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.