Security audit

一人电商运营助手｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE ecommerce planning and media-generation helper, with purpose-aligned API use and user-selected uploads, but users should understand the API-key storage and possible generation costs.

Before installing, confirm you are comfortable using AI-HIVE for ecommerce media work, uploading only files you have rights to use, and storing an AI-HIVE API key locally if you run init. Review prompts, routing mode, batch size, and pricing before any generation task that may incur charges.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents executable commands that use environment variables, local files, shell execution, and network access, yet no explicit permissions are declared. This creates an authorization and transparency gap: a host or reviewer may treat the skill as lower risk than it really is, while users may be prompted into running code that accesses secrets or external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior goes beyond a narrowly scoped ecommerce planning assistant into generic model access, account/billing-related retrieval, media upload, and local API-key configuration. That scope expansion is dangerous because it increases the chance of secret handling, unintended data exfiltration, billing abuse, and user surprise, especially when the declared purpose suggests a more limited and safer workflow.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file presents itself as a narrowly scoped solo e-commerce/video skill, but the implementation is a broad AI Hive CLI that exposes chat, model enumeration, user-info, uploads, image generation, and arbitrary video operations. This scope mismatch is dangerous because callers may grant or trust the skill under a limited-use assumption while it actually provides materially broader account and content-generation capabilities.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Exposing `user-info` allows the skill to inspect account details and wallet/billing information unrelated to generating e-commerce media. In a delegated agent setting, unnecessary account introspection increases the blast radius if the skill is misused or invoked unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The generic text chat capability lets the skill send arbitrary prompts and media to the backend, which is broader than a focused video-generation assistant. That creates a covert general-purpose LLM interface that could be abused for unrelated operations under the guise of this skill.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The image generation path expands the skill beyond its declared video/e-commerce assistant role and enables broader synthetic media creation. In context, this undermines least privilege and can facilitate unauthorized or misleading content generation not anticipated by users or reviewers.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module docstring explicitly describes a generic AI capability tool, contradicting the embedded identity of a narrow solo e-commerce video skill. Misleading identity and packaging can cause operators to misjudge the code's authority, permissions, and risk surface.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill enables implicit invocation without any visible trigger constraints, so the agent may auto-activate this ecommerce workflow in contexts the user did not explicitly request. Because the skill can steer requests into runnable commands and external AI-HIVE workflows, unintended activation increases the risk of prompt-routing abuse, unexpected external actions, or user confusion about consent and scope.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The default prompt hard-codes Chinese output and does not indicate that this is based on user preference or opt-in. While not a direct code-execution issue, it can override user intent, reduce transparency, and make downstream instructions or generated commands harder for some users or reviewers to validate, which is a trust and safety concern in an automation-oriented skill.

Static analysis

No suspicious patterns detected.