Security audit

GPT Image 2 种草图片

Security checks across malware telemetry and agentic risk

Overview

This skill is an AI Hive image-generation helper with disclosed credential setup, uploads, and downloads; broad unused helper code is present but not exposed by the skill entrypoint.

Before installing, expect this skill to use an AI Hive API key, upload any reference images you provide, send prompts to AI Hive, and save generated files locally. Avoid passing private images or sensitive files as references, and remove ~/.ai-hive/config.json if you no longer want the stored API key on this machine. The package would be cleaner if unused chat/video/account helper code were removed, but I did not find artifact-backed evidence of hidden exfiltration, destructive behavior, or automatic unrelated actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documentation invokes shell commands that install packages and run a Python helper with filesystem, environment, and network access, yet no explicit permissions are declared. That creates a trust gap: users may believe this is a simple image-generation skill while it can read local inputs, write outputs, access env vars, and communicate externally through the helper tooling.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The stated purpose is narrowly about generating seeding-style product images, but the referenced tooling appears capable of much broader actions including credential setup, account queries, model enumeration, chat/video APIs, uploads, and standalone task download/polling. This mismatch is dangerous because it obscures the actual attack surface and can lead users to authorize a skill with broader data access and side effects than they reasonably expect.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file is packaged as a narrow GPT Image 2 seeding-image skill, but its implementation is a broad AI Hive client exposing unrelated account inspection, model enumeration, chat, video, and upload primitives. In an agent-skill setting this breaks least-privilege expectations: a caller selecting an image skill may unknowingly grant access to capabilities that can inspect account metadata or invoke unintended APIs.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: A seeding-image skill includes a generic text chat endpoint, which is outside the advertised function of generating product images. In a tool-execution environment, this expands the skill from deterministic image generation to arbitrary prompt forwarding, increasing opportunities for policy bypass, sensitive-data transmission, or unreviewed API usage.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The presence of video-generation functionality materially exceeds the scope of a GPT Image 2 seeding-image skill. This unnecessary capability expansion weakens trust boundaries and may allow a user or downstream wrapper to invoke more expensive or less-reviewed media workflows than the skill description suggests.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module docstring explicitly describes a generic AI capability tool, contradicting the narrow seeding-image metadata. In security terms, this mismatch is dangerous because reviewers and orchestrators may approve the skill based on its stated purpose while the code is designed as a reusable multi-capability API client.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.