Security audit

AI大模型专家｜电商品牌 GEO 内容优化

Security checks across malware telemetry and agentic risk

Overview

This skill is broad and uses an AI-HIVE API key for user-directed image/video workflows, but the inspected artifacts disclose that purpose and do not show hidden exfiltration, destructive behavior, or automatic privileged actions.

Install only if you intend to use AI-HIVE for content planning plus image/video generation. Treat prompts and uploaded media as being sent to AI-HIVE, use a revocable API key, review generated commands before running them, and remove ~/.ai-hive/config.json if you no longer want the key stored locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises executable workflows that use shell commands, local files, environment variables, and network access, yet the manifest shown in SKILL.md does not declare corresponding permissions or capability boundaries. This creates a transparency and least-privilege problem: users or hosting platforms may approve a seemingly narrow content-planning skill without understanding that it can read/write local state, consume secrets from the environment, and call external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a domain-specific GEO/content optimization skill, but the referenced behavior extends into generic account inspection, wallet balance queries, model enumeration, API-key onboarding/storage, broad text-chat access, and unrelated image/video generation utilities. That mismatch is dangerous because it can cause users to grant trust and credentials for a narrow business workflow while the skill effectively exposes a wider operational surface with billing, account, and arbitrary model-use implications.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements a generic AI API client with chat, model listing, media upload, task polling, and download features, which materially exceeds the declared GEO/content-planning purpose of the skill. This capability mismatch is dangerous because users may grant credentials and run functionality they would not reasonably expect from the manifest, increasing the risk of unauthorized data access and abuse of external AI services.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The embedded skill configuration advertises a GPT Image 2 image-generation/editing tool, which conflicts with the manifest's ecommerce-brand GEO expert positioning. Such hidden repurposing undermines informed consent and trust boundaries, making it easier to socially engineer users into providing API keys and uploading media under false pretenses.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The ability to retrieve user account and wallet information is unrelated to the stated GEO/content-optimization use case and broadens access to potentially sensitive billing or account metadata. In a misleadingly branded skill, this becomes more concerning because users may not anticipate that account-level data will be queried at all.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Generic model enumeration exposes broader platform capabilities than are needed for a GEO expert skill, enabling discovery of unrelated services and expanding the effective attack surface. In combination with the manifest mismatch, this suggests the skill is functioning as a general-purpose API wrapper rather than a narrowly scoped assistant.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file behavior materially diverges from the declared skill purpose: instead of GEO/content-planning assistance, it provides a general AI Hive CLI with model listing, media upload, task polling, and account utility functions. This kind of scope mismatch is dangerous because users or platforms may grant trust and permissions based on the manifest, while the code performs broader operational actions than advertised.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The embedded SKILL_CONFIG repurposes the skill into a short-drama video generator, which is inconsistent with the metadata describing ecommerce-brand GEO optimization. Hidden repurposing increases supply-chain risk because the effective runtime behavior differs from the user's expectation and from what may have been approved during review.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill enables implicit invocation without any visible trigger constraints or narrow activation conditions. That can cause the agent to auto-select this skill in loosely related conversations, increasing the chance of unintended execution, prompt-scope expansion, and accidental disclosure or processing of user/project data under the skill's workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:133