Security audit

包装Logo与文字准确性检查｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly dangerous, but it packages broad AI-Hive media generation, upload, billing, and credential setup behind a packaging-checking identity.

Install only if you intentionally want an AI-Hive media-generation and packaging-workflow helper, not just a passive checker. Expect it to use an AI-Hive API key, upload selected media to remote services, create potentially billable generation tasks, store a local config file if initialized, and write outputs under the chosen output directory.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents executable workflows that use environment variables, local file read/write, shell commands, and network access, yet no permissions are declared. This creates a transparency and governance gap: a caller or review system may treat the skill as low-privilege while it can actually access API keys, local media, and external endpoints and invoke tools like ffmpeg.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as a packaging/logo/text inspection tool, but its documented behavior includes generic chat, image/video generation, media upload/download, local ffmpeg editing, and API-key setup. That mismatch materially increases abuse potential because users, hosts, or automated policy systems may grant trust appropriate for QA work while the skill can be used as a broader content-generation and file-processing wrapper with networked exfiltration and billable actions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file header and overall implementation describe and expose a generic AI Hive client for chat, image, video, upload, and task polling, which does not match the advertised purpose of packaging/logo/text accuracy checking. In this skill context, that mismatch is dangerous because users may trust the skill to perform compliance-oriented review while it actually enables broad content generation capabilities that can be repurposed for misleading packaging or other unauthorized content.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The generated skill entrypoint validates only image-count rules, then forwards the user prompt and optional images directly into cmd_image using a fixed image-generation model. That means the skill performs image generation/editing rather than packaging/logo/text accuracy checks, creating a deceptive capability gap that can facilitate unauthorized replication or misleading visual content under the guise of QA review.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The packaged skill is presented as a packaging/logo/text accuracy checker, but the implemented entrypoint exposes generic AI-Hive video generation, media upload, task polling, and model routing. This capability mismatch can mislead operators and reviewers, enabling use of the skill for unrelated content generation workflows that bypass expected governance, approval, or policy controls tied to the declared packaging-check purpose.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The client exposes unrestricted chat, image generation, and video generation primitives without guardrails enforcing the advertised packaging-check use case. In a skill ecosystem, this broadens abuse potential because a seemingly narrow review tool can actually generate arbitrary media or text, undermining trust boundaries and policy segmentation.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The module docstring openly describes the file as a general-purpose AI capability tool, which contradicts the skill's declared identity as a packaging-check assistant. This inconsistency is dangerous because it signals that documentation, metadata, and actual functionality are out of sync, increasing the chance of mis-scoping reviews and accidental deployment of broader capabilities than intended.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation conditions include broad business-content triggers such as ads, marketing, influencer content, short drama, and converting reference cases into 'original' content with scripts/prompts/code/task lists. This widens activation beyond packaging QA and can route unrelated content-production requests into a skill that also exposes generic generation and editing capabilities, increasing the chance of policy bypass, misuse, or unauthorized derivative-content creation.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The default prompt hard-codes 'production-ready Chinese workflow' even though the skill may be invoked implicitly, which can override or bias the assistant's response language without explicit user consent. While this is not a direct code-execution or data-exfiltration flaw, it can mislead users, reduce transparency, and cause unintended behavior in downstream workflows that assume the user's preferred language will be respected.

Static analysis

No suspicious patterns detected.