GPT Image 2 角色一致性图片

• Outcome: Pass
• Latest audit: Aug 17, 2026 · 9:39 AM UTC
• Version: 1.0.0

Overview

This is a disclosed AI Hive image-generation skill, with some underdocumented but user-directed credential, upload, and download behavior.

Install only if you are comfortable using AI Hive: you will need an API key, selected reference images and prompts are uploaded to the service, and generated files are saved locally. Prefer using explicit --image paths and review ~/.ai-hive/config.json if you want to remove or rotate the stored API key later.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises shell, network, file read/write, and environment-variable dependent behavior but does not declare any permissions. This creates a transparency and sandboxing gap: a caller may invoke the skill expecting only prompt guidance, while the documented commands can install packages, access local files, and make outbound requests to external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond simple image generation guidance into interactive API-key setup, browser launching, task polling, and separate media uploads. That mismatch can surprise users and agents into exposing credentials, uploading unintended local files, or initiating external actions that were not clearly disclosed by the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The packaged skill is presented as a narrowly scoped GPT Image 2 character-consistency tool, but the implementation includes a much broader generic AI client with chat, video, model enumeration, account inspection, API-key onboarding, and arbitrary media upload. This scope mismatch is dangerous because it grants operators capabilities well beyond user expectations, increasing the chance of unauthorized data access, unintended network actions, and abuse of credentials within a supposedly limited image skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The user-info endpoint exposes account/profile and wallet-related data that is not necessary for a character-consistency image generator. In the context of a narrowly scoped skill, this creates unnecessary access to sensitive account metadata and violates least privilege, especially if the hosting agent can invoke hidden or undocumented commands.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Text-chat functionality is outside the declared purpose of this image-only skill and enables arbitrary prompt forwarding to a general model endpoint. That broadens the skill from a constrained media generator into a more general remote-execution-by-proxy interface, increasing risk of data exfiltration, misuse of API credits, and hidden capability expansion.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Video generation is a materially different and broader capability than the declared GPT Image 2 character-consistency image skill. Its inclusion increases attack surface by allowing additional media inputs/outputs, longer-running remote tasks, and potentially higher-cost operations that users and reviewers would not expect from this package.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The top-level documentation explicitly describes a generic AI capability caller, which contradicts the specific packaged identity of a GPT Image 2 character-consistency skill. This kind of misleading framing weakens reviewer and user understanding of the true capability set, making overbroad functions easier to smuggle into a narrowly trusted workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.