Security audit

AI图片提示词大师｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a disclosed AI-HIVE image-prompt and image-generation helper, but users should notice that it can store an API key and make networked, potentially billable API calls when they choose to run its commands.

Install only if you intend to use AI-HIVE for image-prompt workflows and are comfortable providing an AI-HIVE API key. Review generated parameters before running commands, use only authorized reference media, watch for possible API charges, and remove ~/.ai-hive/config.json if you no longer want the stored key on this machine.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises executable examples that use environment variables, local files, shell commands, and outbound network access, yet no permissions are declared. This creates a transparency and governance gap: hosts or users may invoke a skill without understanding it can access sensitive execution surfaces, increasing the chance of unintended file access, key exposure, or external API calls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented purpose is narrowly framed as image-prompt assistance, but the finding indicates broader behaviors including video generation, generic chat/multimodal calls, account and wallet retrieval, and model catalog access. This mismatch is dangerous because users and policy engines may grant trust appropriate for a prompt-writing tool while the skill can reach billing, account metadata, and broader model operations outside the declared scope.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest expands the skill from generating image prompts into producing runnable workflows and executable AI-HIVE commands. That broadening increases the chance the agent will take operational actions or emit action-ready instructions beyond the user’s original intent, which can enable misuse, unsafe automation, or execution of unreviewed external-service operations.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file is packaged as an image-prompt skill, but the script contains a broader generic AI client with chat, model enumeration, task polling, media upload, user-info, and video-generation functionality. Excess capability increases attack surface and creates opportunities for misuse beyond the declared purpose, violating least-privilege expectations for skills.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: User-info retrieval exposes account metadata and wallet/balance information that is unnecessary for an image-prompt-master skill. Even if intended for diagnostics, including it in the same skill expands what a caller can learn about the user's account and may leak sensitive billing context.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Video generation support is outside the declared scope of an image-prompt-master skill and gives the package more powerful media-generation behavior than users would reasonably expect. In this context, unnecessary modality expansion increases misuse potential and weakens trust boundaries around the skill's intended function.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The module docstring explicitly describes a generic AI capability tool, contradicting the skill's declared narrow purpose. This mismatch is a strong indicator of repackaging or scope drift and matters because reviewers and users may rely on manifest claims that do not reflect actual code behavior.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: Using the generic trigger term "Prompt" makes the skill eligible for many unrelated requests, increasing the risk of accidental invocation. Over-broad activation can route users into a skill that performs networked and potentially billable actions or collects additional inputs when a simpler, safer skill would have sufficed.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Enabling implicit invocation without tight trigger constraints allows the skill to activate in broader contexts than intended. Because this skill can steer users toward runnable commands and external AI-HIVE operations, unexpected activation raises the risk of unwanted tool use, scope creep, or bypass of normal user intent checks.

Static analysis

No suspicious patterns detected.