Security audit

电商详情页工作室｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for ecommerce content production, but users should understand it can use AI-HIVE credentials, upload chosen media, store a local API key, and submit potentially billable generation jobs.

Install only if you are comfortable connecting to AI-HIVE for ecommerce image/video work. Use only authorized product media, review parameters before any generation call, avoid storing shared or production API keys unless appropriate, and monitor costs for batch jobs.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill includes executable examples and operational guidance that require environment access, local file reads/writes, network calls, and shell execution, but it does not declare those capabilities. This creates a transparency and least-privilege problem: users or hosting systems may treat the skill as low-risk while it can trigger external API calls, write artifacts locally, and use secrets from the environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is a narrowly scoped ecommerce detail-page assistant, but the described behavior extends into generic AI-HIVE chat/text access, wallet/account retrieval, broad model discovery, generic media upload, video generation, and browser-based API-key initialization with local credential storage. This mismatch is dangerous because it expands the operational and data-exposure surface beyond user expectations, enabling credential handling, account metadata access, and generic remote actions under the cover of a domain-specific content skill.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file presents itself as an ecommerce detail-page skill, but the implementation is a broad AI media client with chat, upload, model discovery, and video generation features. This capability mismatch violates least privilege and can cause callers to grant trust, data, or permissions based on a misleading description, enabling unintended API use and data handling beyond the declared purpose.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill-specific section hard-codes video-generation models and a parser for generating videos, which is materially inconsistent with a skill advertised for ecommerce detail-page planning and copy/visual task orchestration. This increases the risk of covert or undeclared content-generation behavior under an innocuous label, making operator review and permission decisions unreliable.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Exposing user-info and wallet/balance inspection is unnecessary for an ecommerce detail-page studio skill and expands access to account metadata. Even if intended for diagnostics, it allows disclosure of sensitive billing/account information to users or workflows that only expected design assistance.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The generic chat endpoint allows arbitrary text interactions unrelated to the stated purpose of the skill, turning a narrowly branded ecommerce tool into a general-purpose AI client. This broadens possible misuse, increases exposure of user prompts and attached media, and bypasses expectation-based controls tied to the skill’s declared function.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill enables implicit invocation with no visible trigger scope, approval gate, or contextual constraints, which can cause the agent to activate this workflow in situations the user did not clearly intend. Because the skill is designed to generate production-ready workflows and runnable AI-HIVE commands, unintended activation could steer conversations into external-tool-oriented ecommerce content generation without explicit user consent.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The default prompt hard-codes Chinese output and frames the task as producing a production-ready workflow, runnable commands, and checklists, regardless of the user's language preference. This can override user intent, reduce transparency, and increase the chance that users approve or execute generated instructions they do not fully understand.

Static analysis

No suspicious patterns detected.