GEO AEO 内容增长中心｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 7:41 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate AI-HIVE content workflow, but it can use an API key and upload/download media when the user runs its commands.

Install this only if you intend to use AI-HIVE for GEO/AEO content work. Treat generation commands as potentially billable, upload only files you are authorized to use, keep the API key private, and do not change --base-url away from the official AI-HIVE endpoint unless you trust the destination.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises executable workflows that use environment variables, shell commands, local file I/O, and network access, but no explicit permission model is declared. That creates a transparency and governance gap: users or orchestrators may invoke code-capable behavior without clear consent boundaries, increasing the risk of unintended data exposure, local file modification, or external API use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The described purpose focuses on content planning and evidence structuring, but the skill behavior extends into account inspection, model enumeration, arbitrary media upload/download, general chat, video generation, browser opening, and local credential storage. This mismatch is dangerous because it hides materially broader capabilities than users would reasonably expect, enabling credential handling, billing-related actions, and data exfiltration paths under the cover of a content-assistant skill.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file presents itself as a skill-specific GEO/AEO image tool, but actually contains a broader generic client with chat, video, model enumeration, uploads, and account-related operations. This capability mismatch weakens least-privilege expectations and can mislead reviewers or orchestrators into granting or invoking functionality beyond the declared purpose.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The module docstring explicitly advertises a generic multi-capability tool, contradicting the skill-specific GEO/AEO image identity. That discrepancy creates a trust and review gap: operators may approve a narrowly scoped skill while the code signals and retains broader operational use.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Video-generation support is materially broader than the manifest's image-oriented GEO/AEO content-growth purpose. In a skill ecosystem, this kind of hidden extra capability increases the chance of policy bypass, misuse, or accidental invocation of unreviewed functionality.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Activating on bare mentions of generic acronyms like 'GEO' or 'AEO' is overly broad and can cause the skill to trigger in unrelated contexts. Over-triggering is security-relevant because it increases the chance that code-capable or networked behaviors are invoked when the user did not intend to use this skill, leading to accidental data handling or external service use.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger for turning a 'reference case' into original content is imprecise and broad, which can sweep in requests involving copyrighted or unauthorized source material. In this skill's context, that ambiguity is more dangerous because the workflow includes generation and media-handling features that could operationalize infringing or otherwise unapproved transformations at scale.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The default prompt uses very broad wording ('turn my request') tied to a wide range of GEO/AEO-related tasks, which can cause the skill to activate for loosely related requests without clear user intent. This increases the chance of unintended routing, context capture, or generation of workflow/code outputs the user did not explicitly ask for.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Enabling implicit invocation without tight trigger constraints allows the system to call this skill automatically based on vague matches, even though the skill can produce workflow instructions and AI-HIVE commands. This creates a risk of over-broad delegation, unintended tool usage preparation, and user confusion about why the skill was invoked.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The default prompt forces output into Chinese ('production-ready Chinese workflow') regardless of the user's language preference or the surrounding conversation context. Forced language switching can override user intent, reduce transparency, and in security-sensitive or operational contexts lead to misunderstandings, unsafe execution, or hidden instructions that reviewers may not easily verify.

Static analysis

No suspicious patterns detected.