Security audit

AI 试衣商品图｜授权成年模特虚拟试穿

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI virtual try-on tool, but it should be reviewed because sensitive local model and garment images may be uploaded to dynamically supplied HTTPS destinations without a documented host allowlist.

Install only if you are comfortable sending the selected adult model, garment, and background images to AI Hive and any storage endpoint its API returns. Prefer using a dedicated API key with limited quota, avoid entering real secrets directly in shell history, and treat generated outputs as previews rather than fit guarantees.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/authorized_tryon.py:152
Finding: Reference Images Can Be Uploaded to Unrestricted HTTPS Hosts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:130
Finding: API Key Is Accepted and Documented as a Command-Line Argument
Content: View full analysis
``` Command-line implementation: ```python auth = commands.add_parser("auth", help="保存 AI Hive API Key") auth.add_argument("--api-key", required=True) auth.set_defaults(handler=save_auth) return root ``` ### Technical Analysis The documented authentication procedure instructs users to place the complete API key directly in a command-line argument. Command-line secrets can be retained in shell history and may be exposed through process inspection, terminal logging, diagnostic collection, session recording, or command auditing. The stored configuration file is subsequently changed to mode `0600`, which is a positive control, but that does not remove copies already recorded in command history or process metadata. ### Attack Path 1. A user follows the documented command and enters the complete API key after `--api-key`. 2. The shell records the command in its history, or the operating system temporarily exposes it in process arguments. 3. Another local user, support tool, telemetry collector, session recorder, or attacker with access to the user's history retrieves the key. 4. The exposed bearer credential is used to authenticate to AI Hive. 5. The attacker can consume API resources and access whatever account-level operations the key authorizes. ### Impact Assessment The issue does not itself provide operating-system privilege escalation. The obtained privileges are those associated with the exposed AI Hive API key. Depending on server-side authorization, this may permit unauthorized generation requests, media ...[truncated 226 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:130
Finding: Runtime Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
``` Runtime dependency handling: ```python try: import requests except ImportError: raise SystemExit("缺少 requests，请运行 pip3 install requests") ``` ### Technical Analysis The project directs users to install `requests` without specifying a reviewed version, cryptographic hashes, a lockfile, an isolated environment, or an explicitly trusted package index. Consequently, installations are non-reproducible and automatically resolve whichever compatible release and transitive dependencies are available at installation time. The package name is legitimate and no dependency-confusion namespace was identified. The risk arises from unrestricted future package resolution: a compromised package-index account, malicious release, compromised transitive dependency, or incompatible future release could affect users who follow the instructions. Python packages and build backends may execute code during installation, and imported dependency code executes with the privileges of the invoking user. ### Attack Path 1. A user follows the documented `pip3 install requests` command. 2. The package installer resolves the current package and transitive dependency versions from its configured index. 3. A compromised, malicious, or unexpectedly incompatible release is selected because no approved version or hash is enforced. 4. Malicious code executes during installation, build processing, or subsequent import. 5. That code runs with the user's privileges and may access files, credentials, environment variables, or network resources av ...[truncated 573 chars]
Remediation: View remediation
\ --hash=sha256: ``` All transitive dependencies must also be pinned and hashed for `--require-hashes` installations. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell commands, reads local files, installs packages, and sends data to a remote API, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch can cause an agent runtime to grant broader capabilities than users expect, increasing the risk of unintended file access, network exfiltration, or command execution when processing model and garment assets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The placeholder string includes Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may choose another language, so this appears to violate the language/locale policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring and user-facing error/help strings are written in Chinese, and the CLI description/help text throughout the file likewise assumes Chinese-only interaction. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and this file does not provide any language selection or justify a region-specific limitation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This is a JSON manifest/config file, so vague-trigger review applies. The placeholder asks the user to replace the value with an API key but provides no surrounding constraints, examples, or usage context, which can lead to ambiguous setup expectations in automated skill configuration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.