Security audit

AI商品图自动质检｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE workflow helper that can upload user-selected media and run potentially paid generation tasks, but its behavior is purpose-aligned and user-directed.

Install only if you intend to use AI-HIVE for product-image review and generation workflows. Before running commands, confirm what files will be uploaded, whether a generation task may incur charges, where results will be downloaded, and how the API key is stored.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises runnable scripts and operational capabilities that imply access to environment variables, filesystem, network, and shell, yet it declares no permissions. This creates a transparency and governance gap: users or orchestration systems may invoke a skill with broader effective capabilities than expected, increasing the chance of unsafe execution, secret exposure, or unauthorized external calls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a material description-behavior mismatch: the skill claims to perform product-image quality inspection, but the described/code-supported behavior includes generic generation, uploads, polling, account/wallet queries, and media task handling without implementing the claimed QA checks. That mismatch is dangerous because users may trust the skill to validate accuracy/compliance while it actually performs unrelated networked actions, which can lead to unsafe automation, misleading outputs, unexpected charges, or exfiltration of user-provided assets to third-party services.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The packaged skill claims to perform product-image quality inspection, but its exposed behavior is a generic image generation wrapper that forwards arbitrary prompts to a remote model. This mismatch can mislead users and downstream agents into invoking content generation where a safety/review function was expected, undermining trust boundaries and policy controls.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The module docstring and parser descriptions present the file as a general AI capability tool rather than a narrowly scoped product-image quality-check skill. This discrepancy increases the chance that the skill will be granted permissions or used in workflows under false assumptions about its purpose and limitations.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill exposes task lookup and raw media upload commands that are broader than necessary for a product-image quality-check function. Extra capabilities enlarge the attack surface and allow the skill to be repurposed as a generic media transfer and generation helper, contrary to least-privilege design.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables implicit invocation with only broad natural-language cues in its metadata, which can cause the agent to trigger this skill without clear user intent or informed consent. In a workflow that can generate executable AI-HIVE commands and operational content, accidental routing increases the risk of unexpected external actions, policy bypass pressure, or user confusion about what system is acting on their request.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The default prompt hard-codes Chinese output and workflow formatting regardless of the user's language preference. While not a direct code-execution issue, this can override user intent, degrade transparency, and increase the chance that users approve or run generated commands they do not fully understand, especially in a skill that produces runnable operational steps.

Static analysis

No suspicious patterns detected.