Security audit

AI商品图工作室｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE product-image workflow with user-directed API use, local output files, and no artifact-backed evidence of hidden or destructive behavior.

Before installing, understand that this skill can upload user-selected media to AI-HIVE, use an AI-HIVE API key, create billable generation tasks after confirmation, store a local API key if you run init, and save generated files locally. Use only authorized product assets and avoid placing secrets in prompts, logs, or shared files.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documents executable workflows that use environment variables, local file paths, shell commands, filesystem writes, and outbound network access, yet no permissions are declared. This creates a transparency and least-privilege problem: a caller or host may not realize the skill can access secrets, local files, or external endpoints, increasing the risk of unintended data exposure or unsafe execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented purpose is a constrained product-image workflow, but the skill appears to support broader capabilities including generic chat, multimodal input, video generation, account/balance retrieval, model enumeration, and blueprint file creation. This mismatch is dangerous because it widens the effective attack surface beyond what reviewers and users expect, enabling data access, billing-impacting actions, or content generation flows that may bypass the skill’s stated business and safety boundaries.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file is packaged as a product-photo skill, but its top-level implementation and documentation describe a broader general-purpose AI API client. This mismatch can mislead reviewers and operators about the true capability surface, increasing the risk that unrelated features are exposed through repackaging, extension, or accidental invocation.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code includes a text chat endpoint and command handler even though the stated skill purpose is product-photo generation. Extra capabilities expand the attack and abuse surface, and in agent settings may permit prompt-based use outside the approved business purpose if the wrong entrypoint is exposed.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The script exposes video-generation functionality beyond the stated product-photo-only scope. In a skill ecosystem, latent video features can be enabled unintentionally or through alternate invocation paths, creating an unauthorized capability expansion that policy reviewers may not expect.

Static analysis

No suspicious patterns detected.