Security audit

AI美妆试妆效果图｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE makeup-preview workflow that uses user-provided images, an API key, and external generation calls, with no evidence of hidden exfiltration or destructive behavior.

Install only if you intend to use AI-HIVE for makeup or commerce image previews. Use authorized images only, expect selected reference files and prompts to be sent to AI-HIVE, review parameters before paid generation, and protect the API key stored in the local config file or environment.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents executable workflows that use environment variables, filesystem access, network calls, and shell commands, yet it declares no permissions. This creates a transparency and least-privilege problem: a host or reviewer may treat the skill as lower risk than it actually is, while the skill can still trigger code paths that read local files, write outputs, invoke external tools, and contact remote APIs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill is presented as a narrow beauty try-on/content-preview tool, but the described behavior extends into broader AI-HIVE functionality such as generic text chat, video generation, account or wallet retrieval, model catalog querying, and generic media upload. That mismatch is dangerous because users and policy systems may grant trust or invoke the skill under a narrow-use assumption, while the implementation can access broader features and data than expected.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file is presented as a narrowly scoped beauty makeup preview skill, but it actually bundles broad-purpose API operations including chat, video, model enumeration, uploads, and account-related access. This scope mismatch increases attack surface and violates least privilege, making it easier for the skill to be repurposed beyond the user’s expected consent boundary.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: Exposing user-info and wallet balance queries is not necessary for a makeup preview generation skill and expands access to account metadata without a clear business need. Even if the data is limited to the authenticated user, unnecessary account inspection increases privacy risk and normalizes overbroad capability exposure.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Including generic text chat and video generation in a beauty image-preview skill creates unnecessary privilege and allows materially different content-generation workflows than the manifest describes. In context, this makes the skill more dangerous because users and platform reviewers may trust it as a limited image-preview tool while it can perform broader AI actions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill enables implicit invocation with no trigger constraints, exclusions, or safety gates, so it may be auto-selected in contexts the user did not clearly intend. Because this skill handles image-generation workflows, reference uploads, and external API operations, over-broad invocation increases the chance of unintended data handling, unnecessary API calls, or the skill being applied to borderline requests without explicit user confirmation.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The default prompt hardcodes Chinese output and does not preserve user language preference or ask for consent. This can cause misleading or unusable responses, and in security-sensitive or compliance-related workflows it may reduce user understanding of what actions the skill will take or what constraints apply.

Static analysis

No suspicious patterns detected.