Security audit

AI眼镜试戴效果图｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE eyewear try-on workflow that uses user-provided media and an API key to generate images, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable using AI-HIVE as a third-party generation service. Use authorized portraits and product images only, review parameters before any paid generation, and keep the API key out of shared logs or repositories; if you run init, it stores the key locally at ~/.ai-hive/config.json.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable workflows that use environment variables, filesystem access, shell commands, and outbound network calls, but it does not declare permissions or capability boundaries. This creates a confused-deputy risk where a caller or hosting platform may not realize the skill can access local files, invoke commands, or transmit data externally, increasing the chance of unintended secret exposure or unsafe execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is a narrowly scoped eyewear try-on workflow, but the skill behavior appears to support broader actions such as account inspection, generic chat, arbitrary media upload, video generation, and local credential setup/storage. That mismatch is dangerous because users may grant trust and provide sensitive assets under a limited-use expectation while the implementation can perform materially broader, privacy-impacting, or billable operations.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file is presented as an eyewear try-on preview skill, but it embeds a general-purpose AI Hive client with unrelated chat, video, model enumeration, upload, and account functions. This scope expansion violates least privilege and creates unnecessary attack surface, making the skill capable of actions beyond what users and reviewers would reasonably expect from its declared purpose.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill includes a user-info capability that retrieves account and wallet balance data, which is unrelated to generating eyewear try-on preview images. Access to account metadata increases privacy exposure and can aid reconnaissance about the user's subscription, balance, or account state without a valid business need.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The text chat endpoint allows arbitrary prompt submission to a general text model, which is outside the stated purpose of eyewear try-on image preview generation. This broadens the skill into a general AI agent interface and can be abused for unintended data handling, prompt injection experiments, or policy bypass through an unrelated capability.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Video generation support materially exceeds the declared purpose of producing try-on preview images and introduces additional media ingestion and output pathways. More input types and result handling mean more opportunity for misuse, accidental data exposure, and hidden capability creep beyond what the skill advertises.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The default prompt hard-codes 'production-ready Chinese workflow' output, which can override or bias the user's language preference without explicit consent. This is not a code-execution issue, but it can cause unwanted behavior, reduce usability, and create prompt-level policy conflicts when users expect another language.

Static analysis

No suspicious patterns detected.