Security audit

产品图生成

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed AI product-image generator that uses an AI Hive API key, uploads user-selected reference images, and downloads results without hidden or destructive behavior.

Install only if you are comfortable sending prompts and chosen reference images to AI Hive and storing an AI Hive API key locally. Review any --param values before running generation, since the script forwards them directly to the provider API.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell commands, reads environment variables via the Python helper, performs network access to an external API, and may read/write local files, yet it declares no permissions. That mismatch weakens the trust boundary for anyone reviewing or sandboxing the skill, because the actual capabilities are broader than the metadata suggests.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The code accepts arbitrary `--param key=value` inputs and forwards them directly to the backend model API, undermining the claim that this skill is a fixed, constrained product-image generator. This creates a scope-expansion issue: users can influence backend behavior in undocumented ways, potentially bypassing intended safety or cost controls if the upstream API honors sensitive parameters.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.