Security audit

电商选品决策助手｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill uses AI-HIVE to help plan ecommerce product-selection content and optionally generate/upload media, with no evidence of hidden destructive or exfiltration behavior.

Install only if you are comfortable providing an AI-HIVE API key, uploading selected product/media assets to AI-HIVE, and potentially incurring generation costs. Review commands before running them, avoid uploading unlicensed or private media, and prefer environment variables if you do not want the key persisted in ~/.ai-hive/config.json.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill exposes operational capabilities such as environment-variable use, filesystem access, shell commands, and outbound network calls without declaring an explicit permission model. This can mislead users and host systems about what the skill may do, reducing the ability to sandbox or obtain informed consent before handling local files, credentials, or billable API operations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is a constrained ecommerce product-selection assistant, but the referenced tooling appears to support broader account inspection, model enumeration, generic chat, upload, download, and credential setup workflows. That mismatch is dangerous because users may invoke the skill expecting narrow decision-support behavior while it can access account-related data, store credentials locally, and perform broader external actions with privacy, security, and billing implications.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest broadens the skill from analytical product-selection support into producing runnable workflows and executable AI-HIVE commands. That expansion increases the chance the skill will operationalize downstream actions the user did not explicitly authorize, which weakens scope control and can turn a decision-support tool into an action-enablement layer.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The file is packaged as a narrowly scoped ecommerce product-selection/image skill, but the implementation is a broad AI utility exposing chat, image, video, model listing, upload, and task polling. In an agent ecosystem, this scope mismatch is dangerous because it grants capabilities users and reviewers may not expect, increasing the chance of unauthorized data handling or misuse through a trusted-looking specialized skill.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: Although the wrapper brands itself as a product-selection image skill, it still exposes task querying and raw media upload operations that are not essential to that narrow function. Extra exposed operations enlarge the attack surface and can be abused to store or process arbitrary user content under the guise of a more limited business workflow.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code exposes a direct user-info endpoint that includes account and wallet data, which is unrelated to the stated ecommerce product-selection assistance purpose. In a skill context, unnecessary access to account metadata violates least privilege and can disclose sensitive billing or account information to workflows that do not need it.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The generic text chat function goes beyond the packaged skill's declared role as a product-selection decision/image assistant. This matters because unrestricted chat can be repurposed for arbitrary prompts, enabling off-scope content generation or processing through a skill that may be implicitly trusted for a much narrower business function.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Video generation is a materially broader capability than the file's stated image-oriented product-selection purpose. Because video workflows can process more inputs and create richer outputs, they introduce additional misuse potential and data exposure without clear business justification in this skill's declared scope.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The module docstring openly describes a general AI capability tool, conflicting with the product-selection packaging and reinforcing that the implementation is broader than declared. Misleading capability descriptions are dangerous in security-sensitive agent systems because operators may approve or invoke the skill under false assumptions about what it can access and do.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata claims an ecommerce product-selection assistant, but the implementation is a generic AI-Hive chat/image/video client. This capability mismatch is dangerous because it can grant a narrowly approved skill broad content-generation and account-query powers that users, reviewers, or policy controls would not expect.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill-specific wrapper is centered on commercial video generation, model routing, media upload, and task polling rather than ecommerce selection decisions. In the context of a product-selection skill, this is a deceptive scope expansion that could be abused to produce marketing assets or other content outside the approved business purpose.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code exposes broad auxiliary capabilities such as user-info lookup, model enumeration, text chat, image generation, and media upload that are not necessary for a dedicated product-selection assistant. Excess capability increases attack surface and enables misuse of the skill as a general AI operator rather than a constrained business tool.

Static analysis

No suspicious patterns detected.