ClawHub
Back to skill

Security audit

拼多多 电商图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI Hive image-generation helper for Pinduoduo ecommerce images, with expected API-key, upload, and download behavior.

Install only if you are comfortable sending selected product/reference images and prompts to AI Hive, storing an AI Hive API key locally, and potentially incurring provider charges for generation. Review outputs and platform compliance before publishing product images.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill advertises shell, network, file read/write, and environment access via executable commands in SKILL.md, but it does not declare permissions. This creates a trust and review gap: users and platforms cannot accurately assess that running the skill may install packages, access files, or communicate with external services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill is presented as a narrowly scoped Pinduoduo image-generation tool, but the detected behavior indicates much broader capabilities including general AI Hive access, media upload, model enumeration, user/wallet queries, and interactive API-key acquisition. This mismatch is dangerous because users may authorize or run the skill under false assumptions, enabling data exfiltration, unexpected charges, or use of unrelated high-risk functions.

Static analysis

No suspicious patterns detected.