电商广告合规预检｜AI-HIVE

• Outcome: Review
• Latest audit: Aug 25, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it presents itself as an ad-compliance precheck while also providing broad AI media generation, upload, API-key storage, and potentially billable external API workflows.

Install only if you intend to use AI-HIVE for external image/video generation as well as compliance-oriented workflow drafting. Do not provide confidential creatives, regulated product claims, or API keys unless you accept that prompts and selected media may be sent to AI-HIVE/object storage and that generation may incur costs. Treat outputs as drafts requiring separate legal/platform review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents code paths that use environment variables, local file reads/writes, shell execution, and network access, yet it declares no permissions or capability boundaries. This creates a transparency and control gap: users or hosting platforms may invoke a skill believing it is low-risk while it can perform sensitive actions such as storing secrets, running ffmpeg, and making external API calls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is ad-compliance precheck, but the documented behavior expands into generic content generation, media upload/download, local API-key setup, config storage, and ffmpeg editing. This mismatch is dangerous because it can cause a reviewer or orchestrator to route sensitive requests to a skill that performs materially broader actions than advertised, increasing the chance of unreviewed data transfer, unintended execution, or policy bypass.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: A skill framed as a compliance precheck tool also instructs users to generate commercial images and videos through an external service. This broadens the trust boundary from analysis into content production, which can lead users to submit proprietary media, product claims, or regulated content to third-party generation APIs under the assumption they are only receiving a compliance audit.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The use cases extend beyond compliance checking into rewriting and production support across broad marketing and media scenarios. That scope creep increases the chance of misuse for content laundering, policy-evasion assistance, or accidental handling of copyrighted/regulated material under the cover of a benign compliance tool.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is marketed as an e-commerce ad-compliance precheck tool, but the implemented entrypoint only exposes image generation, task polling, upload, and API-key initialization. This mismatch can mislead users into believing content received compliance screening when it was actually sent to a remote image-generation service, creating safety, legal, and workflow risks.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The fixed skill configuration and CLI description present the tool as '电商广告合规预检', but the generate path forwards prompts directly to cmd_image with a hardcoded image model. In a compliance context, this deceptive framing is dangerous because users may rely on nonexistent checks and unknowingly publish noncompliant or risky advertising content.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file’s implementation materially diverges from the advertised purpose: instead of performing ecommerce ad-compliance prechecks, it exposes a general-purpose AI Hive client with media upload, raw chat, image generation, video generation, and task polling. This capability mismatch is dangerous because users or upstream agents may grant the skill broader trust, permissions, or routing than they would a media-generation tool, enabling policy bypass and misuse under a misleading label.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The embedded metadata presents the skill as a compliance-precheck tool, but the parser and command flow implement a dedicated video-generation interface (`generate`, `upload`, `task`) and dispatch directly into video synthesis models. This creates deceptive behavior and breaks security assumptions around least functionality, making it easier to smuggle content-generation abilities into environments that intended only review or audit tooling.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Direct video generation is outside the narrow purpose of compliance precheck and platform-rule review, and the code forwards user prompts and media directly to generation backends. In this skill context, that increases the chance of unauthorized content creation, policy evasion, or generation of marketing assets under the guise of compliance tooling.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger phrase includes an overly broad term related to platform rules, which can cause the skill to activate for many general discussions unrelated to targeted compliance precheck. Overbroad triggering is dangerous because it routes more user content into a higher-capability skill than necessary, increasing exposure to external APIs and unintended side effects.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The usage condition covers vague requests about stable delivery across many marketing scenarios, making invocation criteria too ambiguous. This can cause the skill to be selected for ordinary creative or strategy tasks, exposing users to broader generation, upload, and editing behaviors than expected from a compliance-checking skill.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The default prompt is framed broadly enough that the skill can be implicitly invoked for a wide range of requests and immediately steers execution into a production-ready workflow and runnable commands. In a safety-sensitive domain involving compliance and external API actions, weak trigger constraints increase the chance of accidental activation, scope overreach, and user requests being transformed into operational steps without sufficient confirmation or policy checks.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: Forcing Chinese output without user opt-in can degrade transparency and user comprehension, especially if the user operates in another language or needs to validate compliance details precisely. In a legal/compliance review context, language mismatch can cause misunderstanding of risks, rules, or generated commands, indirectly increasing the chance of unsafe or incorrect downstream use.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: User-supplied files are uploaded to a remote object store and prompts are sent to a third-party API, but the command flow does not prominently warn users about external data disclosure before transmission. In this skill's context, users may upload ad creatives, product assets, or regulated marketing copy that could contain sensitive business information.

Static analysis

No suspicious patterns detected.