Security audit

AI电商运营总控｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE ecommerce planning and media-generation workflow, with expected API-key, upload, and download behavior.

Install this only if you intend to use AI-HIVE for ecommerce content work. Review commands before running them, use only media you are authorized to upload, expect selected files to leave your machine, and keep the API key out of logs or shared repositories.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents executable commands and operational capabilities including environment variable use, local file access, network calls, and shell execution, yet no permissions are declared. This creates a transparency and consent gap: a user or host system may invoke a skill that can access sensitive local resources or make external requests without an explicit permission boundary.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose frames the skill as an e-commerce planning/orchestration assistant, but the detected behavior extends to account queries, wallet balance access, arbitrary model chat, generic media upload, model enumeration, and local credential initialization/storage. This mismatch weakens user trust and expands the attack surface, because a seemingly narrow business-planning skill can perform broader account-affecting or data-handling actions than a user would reasonably expect.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file’s behavior materially exceeds the stated skill purpose: instead of an ecommerce-operations copilot, it implements a general AI Hive CLI with chat, account-info, model enumeration, upload, and media generation features. This capability mismatch increases the attack surface and creates a confused-deputy risk where users may grant trust or credentials under one description while the code performs broader actions.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: Exposing user-info and model-listing capabilities is not inherently malicious, but these functions collect account metadata and enumerate backend capabilities beyond what an ecommerce copilot needs. In a mismatched skill, such extra functions can aid reconnaissance, increase user surprise, and normalize overbroad API-key use.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The embedded skill interface is narrowly focused on video generation, not ecommerce operations control as advertised. This discrepancy can mislead users about what the skill does, leading them to provide prompts, media, and API credentials to a component whose real function and data flows are materially different from the declared purpose.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest enables implicit invocation with no visible trigger constraints, allowing the skill to be auto-selected for loosely related requests. Because this skill can generate runnable AI-HIVE commands and operational marketing workflows, over-broad invocation increases the chance of unintended execution paths, policy bypass through misrouting, or use on requests the user did not clearly authorize.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The default prompt hard-codes Chinese output and prescribes a specific response shape regardless of the user's language preference or context. This can cause instruction precedence problems, reduce user control, and increase the risk that users accept generated commands they cannot fully review, especially when the skill produces runnable operational output.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The upload flow sends local files to remote object storage and the AI Hive service without an explicit consent/privacy warning at the time of transfer. Users may unknowingly upload sensitive local media, and because presigned upload destinations are accepted from the API response, private content is transmitted off-host by default.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The task polling flow automatically downloads remote result URLs and writes files to a default directory, which creates an implicit filesystem side effect. Although the filenames are locally constructed and path traversal is not apparent, silent remote-to-disk writes can surprise users and may consume storage or persist unwanted content.

Static analysis

No suspicious patterns detected.