Security audit

直播带货脚本工作台｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AI-HIVE live-commerce content workflow that uses user-provided credentials and media for requested generation or editing tasks.

Install only if you intend to use AI-HIVE for live-commerce or related ecommerce media work. Expect to provide an AI-HIVE API key, upload only media you are authorized to use, review prompts and routing before any billable generation, and avoid storing credentials in shared environments.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill embeds executable workflows that use environment variables, filesystem access, shell commands, and network calls, yet it declares no permissions or capability boundaries. This is dangerous because users or host systems may invoke code with broader access than expected, increasing the risk of secret exposure, unintended file modification, or unreviewed outbound requests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented purpose is a livestream commerce scripting tool, but the described code paths include broader capabilities like generic chat/model querying, wallet/user info retrieval, standalone media upload, and general ffmpeg processing unrelated to the stated business function. This mismatch is dangerous because it can conceal higher-risk operations behind a benign description, undermining user consent, review accuracy, and least-privilege enforcement.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file presents itself as a general AI capability client with chat, image, video, model enumeration, upload, and task polling, while the declared skill is narrowly framed as a live-commerce script/image studio. This capability mismatch expands the attack surface and can let callers invoke unintended functions outside the skill's advertised scope, undermining least privilege and policy enforcement.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The client includes a user-info endpoint that can retrieve account and wallet information, which is not necessary for an image-generation/live-commerce scripting skill. Unnecessary access to billing or identity data increases data exposure risk and may allow reconnaissance about the operator's account state.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The bundled generic text chat capability allows arbitrary model interaction unrelated to the stated skill wrapper. In context, this means the skill can be repurposed as a broader AI proxy than advertised, bypassing intended task scoping and enabling unreviewed prompt flows.

Intent-Code Divergence

Low

Confidence: 85% confidence
Finding: The skill-specific wrapper claims an image-only role, but the bundled documentation and code describe a general-purpose AI tool. This inconsistency is dangerous because reviewers and users may trust the narrower description while hidden or adjacent capabilities remain available elsewhere in the file.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file presents itself as a live-commerce script studio but actually exposes a broad AI-Hive client with generic chat, account info, model discovery, media upload, and arbitrary image/video generation. This capability mismatch increases the attack surface and can mislead users or orchestrators into granting permissions and invoking functions beyond the declared business purpose.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: Retrieving user account information and wallet balance is unrelated to generating live-commerce scripts or marketing videos. Even if authenticated access is expected, exposing this function in an unrelated skill can leak sensitive account metadata and violates least-privilege design.

Context-Inappropriate Capability

Low

Confidence: 78% confidence
Finding: Enumerating all available AI models is a generic platform-management feature not needed for the stated live-commerce script studio function. This can disclose internal platform capabilities and facilitate misuse of unintended models through a skill that appears narrowly scoped.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module docstring explicitly describes a general-purpose AI capability caller, which contradicts the skill identity and reinforces that the implementation is broader than advertised. This kind of scope deception is dangerous because users and agents may trust the skill with permissions or inputs they would not grant to a generic media client.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The activation rules are broad enough to trigger on generic marketing or content-production requests, which can cause the skill to engage outside its narrowly intended use case. Overbroad invocation increases the chance that powerful network, file, and media-processing features are used in contexts the user did not intend, creating unnecessary exposure and confusing trust boundaries.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The default prompt hard-codes 'production-ready Chinese workflow' output, which overrides user language preference unless they explicitly correct it. This is not a classic security flaw, but it is a real prompt-safety and UX issue because it can cause unintended behavior, reduce user control, and potentially mis-handle safety-critical requests if language mismatch obscures warnings or requirements.

Static analysis

No suspicious patterns detected.