Security audit

餐饮菜品动效广告｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE workflow for creating food-ad videos, with external API use, media upload, and local video edits that fit its stated purpose.

Install only if you intend to use AI-HIVE for food or restaurant advertising workflows. Expect to provide an AI-HIVE API key, upload user-selected media, possibly incur generation charges after confirmation, and store the key locally if you run init. Use only authorized food, brand, and reference assets, and do not pass a custom --base-url unless you trust that endpoint.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill exposes operational capabilities including environment access, file read/write, network, and shell execution without declaring permissions or clearly constraining their use. This weakens user and platform trust boundaries because a seemingly narrow advertising skill could invoke broad local and external actions, increasing the chance of secret exposure, unwanted file modification, or unreviewed outbound requests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is narrowly framed as a restaurant dish-motion ad skill, but the described/code-indicated behavior includes generic text/image/video model access, account and wallet queries, arbitrary media upload, and general ffmpeg processing. This mismatch is dangerous because users and reviewers may authorize the skill for a limited marketing use case while it can perform much broader actions, enabling misuse, data exfiltration, unauthorized content generation, or financial/account reconnaissance.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file is presented as a narrowly scoped food dish motion ad skill, but it actually bundles broad-purpose API capabilities including chat, image generation, model enumeration, uploads, and account inspection. This scope mismatch increases attack surface and violates least-privilege expectations: a caller or orchestrator that trusts the skill description may grant it broader access than intended.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The skill includes a user-info endpoint that can retrieve account information and wallet balance, which is unnecessary for creating dish-motion advertisements. Even if not directly harmful by itself, it exposes sensitive account metadata and expands the skill's data-access surface beyond its stated purpose.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module docstring explicitly describes a general AI capability tool, contradicting the specialized food-advertising skill metadata. This inconsistency is a supply-chain trust problem: reviewers and agents may believe they are invoking a narrowly scoped media skill while actually executing a general-purpose API client with broader functions.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: Using the broad trigger phrase '本地生活' can cause this skill to activate for many loosely related local-services requests outside its intended food-advertising scope. Overbroad activation increases the chance that users are routed into a skill with code/network capabilities unnecessarily, expanding exposure to unintended operations or data handling.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: Listing '本地生活' as a standalone activation condition makes invocation criteria too broad for a skill that also exposes external API, media upload, and file-processing workflows. In context, the skill is less dangerous than an overtly malicious tool because it includes authenticity and authorization guidance, but the broad trigger still widens the attack surface and risks accidental misuse.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The default prompt hard-codes Chinese output regardless of the user's language preference, which can override user intent and create confusing or unusable responses for non-Chinese speakers. In a production agent, this is a policy/UX weakness because the skill may be implicitly invoked and steer output format without explicit consent.

Static analysis

No suspicious patterns detected.