Security audit

用户晒单素材转广告｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI-HIVE workflow for turning authorized customer media into ads, with expected network, media upload, API-key, and local video-processing behavior.

Install only if you are comfortable giving AI-HIVE authorized customer media and using an API key for potentially billable generation. Review prompts, routing, uploaded files, and output paths before running commands, and avoid using it for unlicensed media, fake claims, or undisclosed ads.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes operational capabilities such as environment-variable access, filesystem interaction, shell usage, and network calls without declaring permissions or constraining them in metadata. This creates a trust and review gap: users or platforms may invoke a skill that can read local data, write files, or make external requests beyond what the declaration suggests, increasing the chance of secret leakage or unintended side effects.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a narrowly scoped customer-post-to-ad workflow, but the detected behavior includes broad AI-HIVE capabilities such as generic text/image generation, account or wallet retrieval, model enumeration, media upload, credential setup, and general-purpose video generation. This mismatch is dangerous because it can smuggle in more powerful behaviors than users expect, enabling data exfiltration, unreviewed spending, or off-scope actions under the cover of a benign description.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The file presents itself as a specialized customer-post-to-ad skill, but actually ships a broad generic AI client with chat, image generation, model enumeration, upload, and account APIs. This capability mismatch weakens least-privilege expectations and can let an invoking agent use functions outside the reviewed business scope, increasing abuse potential and review blind spots.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: The skill includes a user-info endpoint that can reveal account and wallet details unrelated to the stated purpose of transforming authorized customer media into ads. While not code execution, it unnecessarily expands access to sensitive account metadata and may expose billing information to workflows that should not need it.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: Generic text chat is outside the advertised scope of this skill and creates an unnecessary prompt-forwarding channel to a third-party model. In a skill handling customer assets and product facts, this broad extra capability can be repurposed for unrelated data transmission or policy bypasses not covered by the skill's intended review.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: Standalone image generation exceeds the declared role of a customer-post-to-ad video workflow and broadens the skill into a general creative generation tool. This increases the chance of unauthorized or unreviewed content generation paths, especially in a context where the skill claims to work only from authorized customer materials.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The top-level documentation and CLI describe the tool as a generic AI capability caller, contradicting the embedded identity of a narrowly scoped specialized skill. This mismatch is dangerous because reviewers and orchestrators may trust the narrower description while the implementation exposes a much wider attack surface.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The manifest enables implicit invocation for a skill that can generate production-ready workflows and runnable AI-HIVE commands. Without clear trigger constraints or stronger gating, the agent may invoke this skill in situations the user did not explicitly intend, causing unintended execution planning, external API-oriented guidance, or mishandling of sensitive marketing/media tasks.

Static analysis

No suspicious patterns detected.