Security audit

AI发型发色预览图｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AI-HIVE hairstyle preview workflow that uses an API key to upload selected media and run generation tasks, with no hidden destructive behavior found.

Install only if you are comfortable using AI-HIVE, storing or providing an AI-HIVE API key, and uploading authorized portrait or reference images to that service. Review the prompt, routing mode, batch size, output path, and potential cost before running generation, and do not use a custom base URL or upload local files unless you trust the destination.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill exposes operational capabilities including environment-variable access, file read/write, shell, and networked code execution patterns without declaring permissions or constraining them in the manifest. That creates a privilege-transparency gap: a caller may invoke a seemingly simple hairstyle-preview skill that can also access local data, execute commands, and transmit data externally, increasing the risk of secret leakage, unintended file modification, or abuse of host resources.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is a narrow hairstyle/color preview workflow, but the described behavior includes broader text chat, video generation, model enumeration, wallet/account access, and generic media upload. This mismatch is dangerous because users and calling systems may grant trust or route data based on the narrow description while the implementation can perform materially broader actions, including account reconnaissance and off-scope content generation.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The specialized skill wrapper claims to be for hairstyle/color preview, but the exposed `generate` path forwards arbitrary prompts, arbitrary `--param` values, and a generic image model without enforcing domain-specific constraints. This enables use far outside the declared purpose, weakening policy boundaries and making it easy to repurpose the skill for prohibited or misleading image generation under a benign-looking skill name.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The module presents itself as a general-purpose AI capability tool while the skill metadata advertises a narrowly scoped hairstyle-preview function. That mismatch increases the chance that operators, reviewers, or downstream agents trust the skill for a constrained purpose when the code actually supports broader generation behavior, creating a policy and abuse-enablement risk.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The trigger list includes broad phrases such as general beauty/hair-content terms, which can cause the skill to activate for loosely related requests. Over-broad invocation increases the chance of accidental execution of a skill with networked and code-capable workflows, potentially exposing user data or causing unintended billable operations in contexts where the user did not intend to use this tool.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The default prompt hard-codes Chinese output ('production-ready Chinese workflow') regardless of the user's language preference. This can override user intent, reduce transparency, and create prompt-steering behavior that is especially problematic in multilingual or compliance-sensitive contexts, even though it is not a direct code-execution issue.

Static analysis

No suspicious patterns detected.