Security audit

商品真实性守门员｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI-HIVE product-review and media workflow helper, with user-directed uploads, generation, local edits, and API-key setup rather than hidden or automatic unsafe behavior.

Install only if you intend to use AI-HIVE for Chinese e-commerce/product-content review or generation. Treat generated media as externally processed, use only files you are authorized to upload, keep API keys out of logs and repositories, review parameters before billable tasks, and do not rely on this skill as a hard compliance or legal-authenticity enforcement system.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes meaningful execution capabilities via shell, filesystem, environment access, and network calls, yet declares no permissions or capability boundaries. This creates a trust and review gap: operators may approve or invoke the skill as if it were low-risk documentation, while it can actually run code paths that access secrets, local files, and external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a narrow authenticity-auditing tool, but the described behavior includes broad generic AI chat, media generation, upload/download workflows, and local ffmpeg-based file manipulation. This mismatch is dangerous because users or automated policy systems may grant it access under a safer business justification while it can perform substantially broader actions, including exfiltration or unsafe content generation through general-purpose APIs and media pipelines.

Description-Behavior Mismatch

High

Confidence: 91% confidence
Finding: The file implements a generic ffmpeg-based video editing utility even though the skill is described as a product-authenticity guard focused on detecting mismatches and preserving factual integrity. This capability gap is dangerous because it gives the skill direct media-manipulation primitives that could be repurposed to alter promotional assets, mute audio, crop evidence, or concatenate deceptive clips under the cover of an auditing workflow.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The exposed trim, aspect, mute, loudness-normalization, and concat operations provide broad media-editing functionality unrelated to verifying whether a product depiction matches a reference item. In the context of an authenticity-guard skill, such unjustified editing capability increases the risk of misuse to create or polish misleading marketing content rather than detect deception, making the mismatch more concerning than it would be in a dedicated video-editing tool.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is presented as a product-authenticity guard, but the exposed interface implements generic image generation, editing, upload, and task polling rather than constrained authenticity verification. In this context, that mismatch is dangerous because users or downstream agents may trust the skill for compliance-oriented review while it can instead be used to create or modify commercial imagery, undermining the stated anti-fraud purpose.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The generate command forwards arbitrary user prompts and optional reference images directly into a commercial image-generation endpoint, which is not justified by an authenticity-guard use case. Because the skill is meant for product truthfulness and consistency checks, this capability can be repurposed to fabricate polished product creatives or altered depictions that aid misleading listings.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file is presented as a product-authenticity guard, but the implementation is a broad AI Hive client exposing generic chat, image, video, upload, and model-management workflows. This mismatch is dangerous because operators may trust the skill for anti-deception enforcement while it actually enables unrestricted content generation that could be used to fabricate marketing assets or bypass the claimed review purpose.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill-level wrapper only selects models and validates media-shape inputs; it does not enforce the stated anti-deception rules such as treating product references as immutable anchors or detecting false function claims. Because the branding promises a guardrail function, the absence of those controls can mislead downstream users into relying on nonexistent safety checks.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The generic text chat endpoint materially expands the skill beyond product-authenticity review into open-ended LLM use. In the context of a trust-branded guard skill, that capability can be abused to generate persuasive deceptive copy, claims, or review-avoidance instructions while appearing to come from a safety-oriented tool.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The activation criteria are broad enough to capture ordinary content-creation requests, not just authenticity review. In context, that increases the chance this more capable skill is invoked in situations where users did not intend to authorize networked generation, local media processing, or broader project orchestration, expanding the attack surface and increasing accidental misuse.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The default prompt directs the model to invoke this skill for broadly phrased requests and to produce a full workflow, runnable commands, and deliverables without explicit user confirmation or tighter scoping. In a sensitive domain like product authenticity and marketing compliance, over-broad triggering can cause the skill to activate on adjacent requests and generate operational guidance that may facilitate misleading product claims or policy-evasion workflows.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The default prompt hard-codes Chinese output regardless of the user's preferred language. While not a direct code-execution issue, forcing a specific language can reduce user comprehension of safety caveats, review criteria, or refusal messages, increasing the chance that risky instructions are misunderstood or used without informed oversight.

Static analysis

No suspicious patterns detected.