Security audit

一张商品图生成10条广告｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE ad-generation workflow that uses expected API keys, uploads, generation tasks, and local output files, with some scope and documentation gaps users should review.

Before installing, confirm you are comfortable providing an AI-HIVE API key, uploading product images or other referenced media to AI-HIVE/object storage, and potentially incurring generation costs. Treat the ten-ad, deduplication, and test-table outputs as workflow instructions that require review rather than hard guarantees enforced by the scripts.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill documents executable commands that use environment variables, local file paths, shell execution, network access, and local file modification, but it declares no permissions. This creates a trust and review gap: operators may invoke capabilities with security impact without explicit consent boundaries, making accidental secret exposure, unsafe file handling, or unintended outbound requests more likely.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill claims a narrow ad-generation workflow, but the described/code-backed behavior includes broader generic chat, model enumeration, account/wallet lookup, media upload, and standalone generation/editing utilities. This mismatch weakens user expectations and policy enforcement because a caller may authorize a narrowly scoped marketing task while the skill can access unrelated account data or perform broader operations than advertised.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill advertises a tightly scoped workflow for turning one product image into ten ad variants, but the exposed CLI also permits generic task inspection and arbitrary media upload. This expands capability beyond the declared purpose, increasing the chance of misuse, hidden data movement, or users invoking functions they did not consent to under the skill’s stated contract.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The implementation does not actually enforce the promised ten-ad workflow, single-variable creative control, deduplication reporting, or test-table generation. This mismatch is dangerous because users may rely on business, compliance, or platform-safety guarantees that are not implemented, resulting in misleading outputs and uncontrolled content generation.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The file is packaged as a narrowly scoped 'one product image to ten ads' skill, but the module-level design and documentation clearly implement a generic AI-Hive client with broad chat, image, video, upload, polling, and model-query capabilities. This creates a scope mismatch that can let downstream agents or users invoke capabilities outside the advertised workflow, weakening least-privilege and increasing misuse risk.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The exposed skill CLI offers generic generate/task/upload operations rather than enforcing the manifest's claimed structured ten-ad deliverable process. In a skill ecosystem, this discrepancy matters because wrappers are often trusted by higher-level agents; broad commands can be abused to submit arbitrary remote jobs and move media outside the intended use case.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The documentation describes a generic all-purpose AI tool while the package metadata markets a specialized ad-generation skill. Misleading packaging increases the chance that agents grant broader trust or permissions than intended, especially in ecosystems where skill descriptions are used for policy and routing decisions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The manifest enables implicit invocation but does not define narrow activation constraints in the file itself. Because this skill can trigger on broad commerce and advertising requests, it may be invoked without clear user intent, causing unintended data handling, unexpected workflow execution, or generation of ad-related outputs the user did not explicitly request.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The default prompt hard-codes Chinese output and does not indicate that language selection follows user preference. This can override user expectations, reduce transparency, and in multilingual contexts cause incorrect or confusing outputs that affect downstream execution or review of generated marketing workflows.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script uploads user-supplied media to a remote service and object storage with no explicit consent prompt, privacy notice, or transfer warning at the point of use. In this skill context, inputs are product images and potentially sensitive marketing assets, so silent remote transfer materially increases privacy and compliance risk.

Static analysis

No suspicious patterns detected.