Security audit

爆款封面图片生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI image-generation helper that sends prompts and user-selected images to a fixed external service and saves generated covers locally.

Before installing, understand that prompts and any reference images you provide will be sent to AI Hive, generated images will be downloaded locally, and the init flow can store an API key in your home directory. Use only images you are allowed to upload and keep the API key private.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes code-execution capabilities through documented shell commands, file access, environment use, and outbound network access, but does not declare permissions. This creates a transparency and policy-enforcement gap: a caller may invoke a seemingly simple cover-image skill without realizing it can read/write local files and contact a remote API.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The description contains many broad trigger terms across multiple platforms and use cases, which can cause the agent to invoke this skill in contexts the user did not specifically request. Unintended invocation matters more here because the skill can perform networked image-generation actions and file operations rather than only returning passive text.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.