Security audit

Canva 图片生成替代｜AI 图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI image-generation helper that sends user-chosen prompts and reference images to AI Hive and stores generated images locally.

Before installing, understand that prompts, selected reference images, and the AI Hive API key are used with an external AI Hive service. Only upload images you have rights to use, and remove ~/.ai-hive/config.json if you no longer want the skill to retain the API key locally.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and instructs use of shell execution, filesystem access, environment usage, and outbound network requests, yet declares no permissions. That mismatch is dangerous because it hides the true capability surface from reviewers and users, making it easier for a skill to exfiltrate secrets, modify local files, or invoke external services without explicit approval.

Static analysis

No suspicious patterns detected.