ClawHub
Back to skill

Security audit

Seedream 5.0 Lite 商品详情页

Security checks across malware telemetry and agentic risk

Overview

This skill coherently generates product-detail-page images through AI Hive and discloses its API key, upload, task lookup, and download behavior.

Install only if you are comfortable giving AI Hive an API key, uploading the product/reference images you choose, and saving generated outputs locally. Avoid uploading confidential or unauthorized product/person images, and review generated PDP claims against approved source material before publishing.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill exposes effective capabilities for shell execution, local file access, environment access, and network use without declaring permissions or clearly constraining when they are used. This creates a trust and review gap: users may invoke a seemingly simple PDP-generation skill without realizing it can store keys locally, read/write files, and make outbound requests.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is narrowly framed as modular product detail page generation, but the described behavior includes broader operational functions such as API key initialization/storage, arbitrary task lookup, media upload, pricing/model queries, and local download of outputs. That mismatch undermines informed consent and can enable unexpected data handling or broader tool use than a user would reasonably expect from the skill description.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.