Security audit

一张商品图生成10条广告｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This AI-HIVE ad-generation skill is mostly coherent, but it needs Review because its scripts can send an API key to a configurable API endpoint without validating the destination.

Review before installing. Use this only with an AI-HIVE key you are comfortable using for paid generation, keep the default official API endpoint, and avoid setting AI_HIVE_BASE_URL, --base-url, or config base_url to any untrusted host. Confirm prompts, uploaded media, routing mode, and costs before running generation commands.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:92
Finding: Unvalidated API Base URL Can Disclose the Bearer Credential
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/videogen.py:92
Finding: Video Client Forwards the API Key to an Unvalidated Configurable Endpoint
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A skill that claims to do specialized ad-variation generation but also contains undeclared generic text, account, model, and image-generation functions creates a trust boundary failure. Users may expose proprietary campaign assets or approve paid actions under false assumptions about scope, while the implementation can access broader functions than the documentation suggests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A skill that claims to do specialized ad-variation generation but also contains undeclared generic text, account, model, and image-generation functions creates a trust boundary failure. Users may expose proprietary campaign assets or approve paid actions under false assumptions about scope, while the implementation can access broader functions than the documentation suggests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A skill that claims to do specialized ad-variation generation but also contains undeclared generic text, account, model, and image-generation functions creates a trust boundary failure. Users may expose proprietary campaign assets or approve paid actions under false assumptions about scope, while the implementation can access broader functions than the documentation suggests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A skill that claims to do specialized ad-variation generation but also contains undeclared generic text, account, model, and image-generation functions creates a trust boundary failure. Users may expose proprietary campaign assets or approve paid actions under false assumptions about scope, while the implementation can access broader functions than the documentation suggests.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
python3 scripts/imagegen.py init --skill-name one-product-image-ten-ads-ai-hive

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
python3 scripts/imagegen.py init --skill-name one-product-image-ten-ads-ai-hive

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises executable commands that use environment variables, local files, network access, and shell execution, but it does not declare any explicit tool scope or permissions boundary. This creates an authorization gap where an agent or reviewer cannot easily determine what capabilities are intended, increasing the risk of overbroad execution, unintended data access, or unsafe invocation of external services.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: An overly broad trigger phrase like '10条广告' can cause accidental activation for ordinary requests that are not intended for this skill. In a skill that may invoke file, network, and potentially billable generation workflows, misrouting increases the chance of unintended data handling, user confusion, or unnecessary paid operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrase '批量广告' is ambiguous and may match many unrelated user intents, making routing unreliable. Because this skill discusses external API usage, uploads, and asynchronous generation, false activations could expose users to unintended workflow steps, broader data collection, or possible charges.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language instruction explicitly requires a 'production-ready Chinese workflow', which imposes a language choice regardless of user preference. The file does not offer a language option or explain why Chinese is mandatory for a region-specific or compliance reason.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest allows implicit invocation with no documented trigger constraints, exclusions, or scope limits. In a skill that can transform user requests into runnable AI-HIVE commands and external API workflows, this increases the chance the skill is auto-selected in unintended contexts, causing unreviewed execution planning, external uploads, or content-generation guidance without clear user intent.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/edit_video.py (reported line 20)May include surrounding context.
python
def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring and subsequent CLI help/messages are written exclusively in Chinese, which imposes a specific language on users. The file does not offer any language/locale selection or explain that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes a specialized workflow that accepts one product image plus selling points, audience, platform, budget, and brand constraints, then delivers 10 non-duplicate ad angles, scripts, first frames, video tasks, dedupe reports, and test tables. In contrast, the skill wrapper here only hardcodes an image model and forwards a free-form prompt to generic image generation, with optional task lookup and upload; there is no code for collecting those structured inputs or producing the promised 10-ad planning artifacts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is implemented as a generic AI Hive client with chat, model listing, upload, image, video, task polling, and account-related capabilities, while the manifest advertises a narrowly scoped workflow for generating ads from one product image. This scope expansion increases the available attack surface and enables users or upstream agents to invoke unrelated capabilities not justified by the skill’s declared purpose, undermining least-privilege expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The CLI exposes unrelated operations such as user-info, models, chat, generic image generation, generic video generation, and arbitrary upload, which exceed the stated ad-generation purpose of the skill. In a skill ecosystem where users and orchestrators rely on manifest scope, these extra operations can be abused to access account metadata, perform unintended AI tasks, or bypass product-level restrictions through a more capable hidden interface.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language description and invocation examples are exclusively in Chinese and define usage via Chinese trigger phrases, with no indication that other languages are supported or that the Chinese-only scope is intentional. This can constitute a locale policy issue when a skill implicitly requires one language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The top-level docstring describes a universal CLI supporting text chat, image generation, video generation, model queries, media upload, and task polling via argparse subcommands. However, the active __main__ path calls skill_main() rather than main(), and build_skill_parser() only exposes generate, task, upload, and init, so the documented user-facing behavior of this file contradicts what actually runs.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring explicitly describes the file as a '通用 AI 能力调用工具' wrapping text chat, image generation, video generation, model queries, media upload, and polling. That directly conflicts with the surrounding skill’s intended narrow purpose of one-product-image ad/video generation, signaling intent-code divergence at the documentation level.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code file contains natural-language user-facing documentation entirely in Chinese, and the CLI help text throughout the file also assumes Chinese-language interaction. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy issue when no alternative or explicit language choice is offered.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.