AI虚拟买手穿搭内容｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 24, 2026 · 4:05 PM UTC
• Version: 1.0.0

Overview

This is a disclosed AI-HIVE styling-content helper that uses user-selected media and API calls, with no evidence of hidden exfiltration, destructive behavior, or automatic privileged actions.

Install only if you are comfortable sending selected product/reference media and prompts to AI-HIVE and storing an API key locally. Confirm parameters before cost-generating calls, keep SKU, price, inventory, and authorization facts under human review, and do not use the upload command for unrelated sensitive files.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents executable workflows that use environment variables, local file access, shell commands, and outbound network access, but it does not declare corresponding permissions. This weakens reviewability and least-privilege controls: a caller or platform may treat the skill as lower risk than it actually is, while the included commands can access secrets, local media, and remote APIs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared purpose is a narrowly scoped virtual stylist workflow, but the documented behavior extends to broad AI-HIVE account inspection, generic chat, model enumeration, standalone media upload, generic image/video generation, asset downloading, and local ffmpeg processing. This scope expansion creates a confused-deputy risk: users and reviewers may authorize a styling skill while it effectively grants a more general remote-content-generation and local media-processing toolchain with access to account data and files.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file presents itself as a virtual-stylist image tool, but the codebase implements a broader generic AI client with text chat, video generation, account-info access, media upload, and task polling. This expands the capability surface beyond the advertised skill purpose, increasing the chance that an agent or downstream caller uses privileged operations that were not expected or reviewed in the stylist-skill context.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill metadata promises SKU-constrained, purchaseable outfit composition, but the enforcement logic only validates image-count rules and forwards arbitrary prompts to a general image model. In this context, that mismatch can lead to fabricated outfit recommendations, non-existent product combinations, or outputs that violate business/policy assumptions about using only user-provided real SKUs.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The skill includes a user-info endpoint that retrieves account and wallet data, which is not necessary for a narrowly scoped stylist image-generation tool. Even if intended for diagnostics, exposing account metadata in a content-generation skill increases unnecessary access to potentially sensitive billing or identity information.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The parser advertises an 'upload image' action, but the underlying upload path accepts arbitrary files and infers MIME from many image, video, and audio extensions, defaulting to application/octet-stream otherwise. That discrepancy broadens what data can be exfiltrated to the remote API and can mislead users or calling agents into trusting the command as image-only.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill metadata explicitly claims it will only compose content from user-provided real SKUs, but the implementation forwards arbitrary free-form prompts and arbitrary media into video generation without validating SKU provenance or constraining outputs to approved catalog items. In a commerce/marketing context, this gap can enable creation of misleading promotional content for non-existent, unapproved, or counterfeit products, undermining trust and policy compliance.

Static analysis

No suspicious patterns detected.