Security audit

淘宝天猫主图工作室｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI-HIVE e-commerce image workflow that uses user-provided credentials and media uploads, with some broader helper code worth noting but no artifact-backed malicious behavior.

Use this skill only if you are comfortable sending selected product/reference media and prompts to AI-HIVE and using an AI-HIVE API key that may be stored locally by the init command. Review prompts, routing, model choice, batch size, and pricing before running generation, and avoid uploading files that contain secrets or unlicensed content.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises runnable scripts and operational behaviors that use environment variables, filesystem access, shell execution, and network calls, yet no explicit permissions are declared. This creates a capability-transparency gap: a user or orchestrator may invoke the skill without understanding that it can access local files, execute commands, or send data externally, increasing the risk of secret exposure, unintended side effects, and unsafe execution context expansion.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is a narrowly scoped e-commerce image studio, but the described/code-detected behaviors include generic text chat, video generation, account and wallet retrieval, and broad model enumeration across modalities. This mismatch weakens trust boundaries and can cause the skill to access billing/account metadata or perform broader external actions than a user would reasonably expect from its name and description.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The file implements a broad general-purpose AI client with chat, model enumeration, user info lookup, video generation, and arbitrary media upload, while the declared skill is narrowly scoped to Taobao/Tmall main-image generation. In an agent-skill setting, this scope expansion increases the attack surface and enables capability abuse outside the user’s expected workflow, including account probing and use of non-image endpoints.

Description-Behavior Mismatch

Low

Confidence: 80% confidence
Finding: The exposed skill entrypoints still permit task inspection and raw file upload operations that go beyond the manifest’s deliverable-focused image-studio behavior. Although less severe than full chat/video exposure, these extra primitives can be chained to stage arbitrary content in the vendor backend or inspect task metadata unrelated to the intended image-generation flow.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill enables implicit invocation without any visible trigger constraints, which increases the chance the agent will auto-select this skill in contexts the user did not clearly intend. Because this skill can transform requests into executable AI-HIVE commands and production workflows, over-broad activation could lead to unintended external API usage, unsafe content generation, or policy-sensitive e-commerce outputs without explicit user confirmation.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The default prompt hard-codes Chinese output and does not preserve user language preference or ask for opt-in. This is primarily a safety and usability issue rather than a direct exploit path, but it can reduce transparency, cause the model to mis-handle user instructions, and make review of generated commerce or compliance-sensitive content harder when the user expected another language.

Static analysis

No suspicious patterns detected.