抖音商品卡图片工作室｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 2:09 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI-HIVE product-card image workflow that uses user-provided API credentials, uploads selected media, and downloads generated outputs, with no evidence of hidden automatic execution or exfiltration.

Install only if you intend to use AI-HIVE for e-commerce image generation. Review prompts and routing before paid generation, provide only assets you are authorized to upload, and prefer an AI-HIVE API key scoped for this workflow.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes operational capabilities including environment variable access, filesystem read/write, network access, and shell execution, yet does not declare permissions or constrain their use. This creates a trust-boundary problem: users and reviewers cannot accurately understand what the skill may do, and downstream scripts could access secrets, local files, or external services without explicit authorization expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a narrowly scoped Douyin product-card image studio, but its described/code-detected behavior appears to support broader AI chat, multimodal processing, video generation, account and wallet retrieval, model enumeration, generic uploads, and local file creation. This mismatch is dangerous because it can mislead users and reviewers about the real attack surface, allowing collection of sensitive account data, unintended billable actions, broader data exfiltration paths, or use outside the advertised workflow.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file is a broad AI Hive client exposing chat, model enumeration, uploads, task polling, and video generation, while the declared skill is narrowly scoped to Douyin product-card image creation. This capability mismatch violates least privilege and increases the attack surface by letting a caller use unrelated functions through the same trusted skill package.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill can query user account information and wallet balance even though that is unrelated to generating product-card images. Exposing account metadata in a narrowly purposed skill creates unnecessary access to sensitive billing/profile data and can be abused for reconnaissance.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Text and multimodal chat are general-purpose capabilities not justified by the product-card image-studio role. In this context, they expand the skill from a constrained media generator into a broader AI interface, enabling unreviewed use cases and data flow beyond the manifest's purpose.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Video generation plus upload of video, audio, and frame assets materially exceeds an image-studio skill's declared scope. This is more dangerous than simple overbreadth because it enables richer media processing, larger data exfiltration surfaces, and potential misuse for unrelated content generation under the cover of a trusted image skill.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation explicitly markets the file as a general AI capability tool, contradicting the specialized product-card image-studio manifest. That mismatch is a strong indicator that the implementation was repurposed without adequately constraining capabilities, increasing the chance of hidden or unintended functionality.

Static analysis

No suspicious patterns detected.