Security audit

GPT Image 2 商品详情页

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent AI image-generation helper, but users should understand it uploads chosen reference images and can store an AI Hive API key locally.

Install only if you are comfortable sending selected product/reference images and prompts to AI Hive and, if using init, storing an API key in your home directory. Prefer the documented generate/task/init flow, avoid uploading sensitive local files, and consider passing the API key by environment variable or command line if you do not want a saved config file.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares itself as a narrowly scoped image-generation workflow, but the documented execution path installs dependencies and invokes a local Python script that appears to have shell, filesystem, environment, and network capabilities without any explicit permission declaration. That mismatch increases the chance of overprivileged execution, hidden side effects such as config writes or data exfiltration, and unsafe use by operators who expect a simple prompt template rather than executable automation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill's stated purpose is limited to GPT Image 2 product-detail page generation, yet the analyzed behavior includes unrelated capabilities such as text chat, video generation, account and wallet queries, model enumeration, uploads, browser-opening API-key setup, and local config storage. This description-behavior gap is dangerous because users may invoke the skill under false assumptions while it performs broader actions that expose credentials, account metadata, or unintended external communications.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The file is presented as a narrow GPT Image 2 product-detail-page skill, but actually embeds a broad multi-capability API client for chat, image, video, uploads, model enumeration, and account queries. This scope mismatch increases the attack surface and enables capabilities a caller or reviewer would not reasonably expect from the manifest, undermining least privilege and trust boundaries.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The exposed text-chat capability is unrelated to the advertised product-detail-page image workflow and allows arbitrary text interactions against the provider API. In a skill ecosystem, hidden extra functionality can be abused for unreviewed data handling, prompt exfiltration, or unexpected billing actions beyond the user's intended image-generation task.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The video-generation capability materially exceeds the stated purpose of a GPT Image 2 product-detail-page image skill and introduces a separate high-cost media pipeline. This broadens abuse potential, increases billing and data-exfiltration surface through extra media uploads, and defeats reviewers' expectation that the skill is image-only.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Querying user account information and wallet balance is unrelated to generating product detail page images and exposes unnecessary access to sensitive account metadata. Even if read-only, it violates least privilege and can leak billing or identity information in contexts where the user expects only media generation.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The module docstring explicitly markets the file as a general-purpose AI capability tool, contradicting the manifest's narrow image-skill framing. This inconsistency is dangerous because it obscures true behavior from reviewers and users, making the overbroad capabilities harder to detect and easier to smuggle into a trusted skill context.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.