Security audit

跨境电商内容本地化｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE ecommerce localization helper that uses user-directed API calls, media uploads/downloads, and local API-key setup for its stated purpose.

Install only if you expect to use AI-HIVE for ecommerce localization and generated media. Treat API-key setup and media upload as real account actions: use authorized assets, review commands before running them, confirm pricing/routing before billable generation, and avoid storing or pasting keys where they may be logged.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill exposes code paths that can access environment variables, local files, the network, and the shell, but it does not declare permissions or clearly constrain those capabilities. That creates a trust and sandboxing gap: users or hosting platforms may treat it as low-risk documentation while it can invoke external APIs, read/write local state, and execute helper commands such as ffmpeg.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is narrow ecommerce localization, but the described behavior includes generic AI-HIVE account access, model enumeration, arbitrary media upload, local credential storage, browser-based API-key initialization, and asset download workflows. This mismatch is dangerous because users may authorize the skill for benign copy-localization tasks while it can interact with broader account resources and local system state beyond what its description implies.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file is framed and implemented as a general-purpose AI Hive client that supports chat, model listing, uploads, image generation, video generation, and task polling, which materially exceeds the advertised scope of a cross-border ecommerce localization video skill. Over-broad capability increases attack surface and makes it easier to repurpose the skill for unintended operations unrelated to the declared business function.

Context-Inappropriate Capability

Low

Confidence: 86% confidence
Finding: The skill includes a user-info command that retrieves account and wallet balance data, which is not necessary for producing localized ecommerce video content. Even if not overtly exfiltrating data, exposing unrelated account metadata violates least privilege and could disclose sensitive billing or account state to callers.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The skill can enumerate generic models across types, which is broader than necessary for its specialized localization/video purpose. Model discovery can leak platform capability inventory and enable users to pivot into unsupported text/image workflows using the same toolchain.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The module docstring explicitly markets the code as a 'general AI capability invocation tool,' contradicting the skill's claimed specialized localization role. This mismatch is a strong indicator that the packaged skill is acting as a wrapper for a much broader API surface than users or reviewers may expect.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The default prompt hard-codes Chinese output and a specific workflow style without checking the user's language preference or consent. This can override user intent, cause unexpected data transformation, and increase the chance that users unknowingly send requests into a broader workflow than intended.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Implicit invocation is enabled, but the skill description covers broad ecommerce, marketing, localization, and AI-HIVE command generation behaviors without tight activation constraints. This increases the risk of the skill being auto-triggered in adjacent conversations, causing unrequested tool-routing, generation of runnable commands, or unintended handling of sensitive commercial content.

Static analysis

No suspicious patterns detected.