电商内容智能路由｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 2:24 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI-HIVE e-commerce content workflow tool that can upload user-selected media and run paid generation only after user confirmation.

Before installing, confirm you are comfortable using AI-HIVE, sending selected reference media to its API, storing an API key locally if you run init, and reviewing final parameters before any paid generation task is submitted.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill includes executable examples and operational guidance that use environment variables, local file paths, shell commands, and outbound network access, but it declares no permissions. This creates a transparency and consent problem: a caller may invoke a skill that can read/write local state and contact external services without an explicit permission model, increasing the risk of unintended data exposure or unauthorized side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose frames the skill as an e-commerce content router, but the actual behavior reportedly extends to account queries, generic model chat, model enumeration, and interactive API-key setup that opens a browser and writes credentials to ~/.ai-hive/config.json. This mismatch is dangerous because users may grant trust or invoke the skill expecting narrow routing behavior, while it can access billing/account context and persist sensitive credentials outside the declared scope.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The advertised skill is for ecommerce content routing and multi-model dispatch, but the implemented skill-specific entrypoints actually expose direct image generation, upload, task polling, and file download primitives. This capability mismatch is dangerous because users or higher-level agents may grant or invoke the skill under a narrower trust assumption than what the code really does, enabling broader media creation and external data transfer than justified by the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill-specific wrapper permits arbitrary local image upload, arbitrary remote result download, and model-driven image generation even though the stated business purpose is routing ecommerce content requests. That expands the attack surface to exfiltration of local files to a third-party API and retrieval of untrusted remote content, which is more privilege than a routing skill should need.

Description-Behavior Mismatch

High

• Confidence: 84% confidence
• Finding: The wrapper exposed to the agent is a video-generation/upload/download tool, not a constrained ecommerce router. In an agent setting, this broadens capability beyond the declared purpose, enabling media upload, external API calls, and file download under misleading packaging, which can bypass least-privilege expectations and policy review.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: Exposing user-info and wallet-balance retrieval is unrelated to the claimed ecommerce routing purpose and grants access to account metadata that may be sensitive. In an agent workflow, unnecessary account introspection increases the risk of privacy leakage or unauthorized financial/account reconnaissance.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger phrases are broad enough to match ordinary e-commerce or marketing discussions, which can cause the skill to activate in contexts where the user did not intend external routing or generation workflows. In a skill that can lead to network calls and potentially billable content generation, overbroad activation raises the chance of unintended tool use, data sharing, or workflow hijacking.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The activation condition for turning a reference case into 'original content' is ambiguous and sits close to copyright-sensitive transformation requests. Because the skill also supports uploading reference media and generating derivative assets, ambiguous activation can increase the risk of the system facilitating unauthorized imitation or mishandling protected materials without first validating rights and user intent.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The condition covering general cross-platform content delivery is so broad that it may capture many ordinary marketing-assistance requests unrelated to AI-HIVE orchestration. In context, that broad capture is more dangerous because this skill can transition from planning into external generation, uploads, polling, and downloads, creating unnecessary exposure of user content and spend when a simpler non-tool response would suffice.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The default prompt hard-codes Chinese output ('production-ready Chinese workflow') regardless of the user's language preference. This can override user intent, cause confusion, and create unsafe mismatches if users cannot accurately review generated workflows or commands, especially in operational or API-driving contexts.

Static analysis

No suspicious patterns detected.