Security audit

GPT Image 2 图片工作室｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AI-HIVE image workflow that uses user-provided API credentials and assets, with some broader helper code present but not exposed through the normal skill command path.

Before installing, confirm you are comfortable using AI-HIVE, potential generation charges, and uploading only assets you have rights to use. Prefer an environment variable for the API key if you do not want local credential persistence, or review ~/.ai-hive/config.json after running init.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents runnable commands and code capabilities that can read environment variables, access files, invoke shell commands, and make network requests, yet it declares no permissions. This creates a transparency and governance gap: a host or reviewer may treat the skill as lower-risk than it is, while the referenced scripts can still handle secrets, local files, and external API calls that may incur cost or expose data.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as an image studio workflow, but the documented behavior extends into text chat, video generation, account/wallet inspection, model enumeration, interactive API-key setup, and local config storage. This mismatch broadens the trust boundary and can lead users or platforms to authorize the skill for one purpose while it performs additional sensitive actions, including cost-bearing operations and local secret persistence.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file presents itself as a GPT Image 2 image-studio skill, but it embeds broader chat, model listing, upload, and video-generation functionality beyond that declared purpose. In a skill ecosystem, this scope mismatch increases attack surface and creates capability confusion, allowing callers or downstream agents to invoke functions that were not expected or approved for this skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: User-info and wallet-balance retrieval are unrelated to generating or editing images, so their inclusion violates least privilege for this skill. Even if not directly exfiltrated here, exposing account metadata broadens what the skill can access and may disclose sensitive billing or account information to callers that only expected image operations.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script includes full video-generation support despite the manifest describing an image-studio skill. This hidden or undeclared capability expands operational scope and can be abused to perform costlier or less-reviewed actions than users and reviewers would reasonably expect from the skill.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables implicit invocation with no visible trigger constraints, exclusions, or user-confirmation guardrails. Because this skill can transform user requests into runnable AI-HIVE commands and production workflows, it could be auto-invoked in situations the user did not clearly intend, increasing the risk of unintended external API usage, unwanted content-generation actions, or policy-sensitive image workflows.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The default prompt hard-codes a Chinese-language output style without indicating that this is optional or based on user preference. While not a direct code-execution issue, it can override user intent, create misleading task framing, and increase the chance that the agent invokes the skill inappropriately for users expecting another language or a neutral transformation of their request.

Static analysis

No suspicious patterns detected.