Security audit

AI大模型专家｜广告公司AI图片视频营销

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI-HIVE marketing asset workflow with expected API, upload, download, and local editing helpers, though users should understand the API key and billing implications before use.

Install only if you intend to use AI-HIVE for advertising image/video/content production. Treat generation and uploads as potentially billable external API actions, upload only materials you have rights to use, and keep the AI-HIVE API key out of logs, screenshots, and shared files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill includes runnable shell commands and scripts that use environment variables, local file paths, networked API access, and file read/write behavior, yet it declares no permissions or capability boundaries. This creates a dangerous mismatch: an orchestrator or reviewer may treat the skill as low-risk while it can actually trigger external requests, process local files, and handle secrets such as API keys.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file advertises itself as a marketing image/video skill but also includes broader general-purpose API capabilities such as text chat, model enumeration, uploads, and user-info access. This is dangerous because it expands the effective privilege and behavior surface beyond the declared purpose, making review, consent, and policy enforcement harder and enabling misuse through capability confusion.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code can query user account information and wallet balance even though the skill is presented as a creative-generation tool. Exposing billing/account data without a clear need violates least privilege and could disclose sensitive usage or financial information if the skill is invoked in unintended contexts.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: The init flow appends a skill-identifying parameter to the browser URL for attribution. While not directly code-execution related, it causes unnecessary metadata disclosure about tool usage and can create tracking/privacy concerns unrelated to the core image-generation purpose.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The description lists a very broad set of marketing, image, video, and promotional keywords, making the skill likely to activate for many generic user requests outside its intended scope. Over-broad triggering can cause the wrong skill to engage, increasing the chance of unnecessary code execution, API usage, file handling, or exposure of sensitive business materials in unrelated conversations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The search/use scenarios remain ambiguous and expansive, including common industry and capability terms without strong gating criteria. In context, this is more dangerous because the skill also advertises executable generation workflows and handling of uploaded reference assets, so accidental invocation could lead to inappropriate processing of user content or unintended external operations.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The default prompt invokes the skill using a very broad description and lacks clear routing constraints, so the agent may trigger this skill for loosely related requests. In a marketing skill that can generate plans and AI-HIVE code, overbroad invocation increases the chance of unintended execution, mishandling of user intent, and unnecessary exposure to operational workflows such as model selection, asset handling, and task tracking.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The default prompt forces Chinese output regardless of the user's language preference, which can cause the system to disregard user intent and produce unusable or misleading responses. While this is not typically a direct security exploit, it can create reliability and policy-routing issues, especially if downstream workflows, approvals, or compliance checks assume the user's original locale.

Static analysis

No suspicious patterns detected.