Security audit

小红书种草图片工作室｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AI-HIVE image workflow that uses explicit API calls, user-selected uploads, downloads, and local API-key setup for its stated purpose.

Install only if you intend to use AI-HIVE for this image workflow. Treat generation as potentially billable, review prompts and routing before submission, upload only media you have rights to use, and keep the AI-HIVE API key out of logs or shared files.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill exposes effective capabilities for environment access, file read/write, network access, and shell execution without declaring permissions or narrowly constraining their use. That creates a transparency and policy-enforcement gap: reviewers and runtime controls may underestimate what the skill can do, increasing the chance of unexpected credential access, local file modification, or external data exfiltration if companion scripts are invoked.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose presents a narrowly scoped Xiaohongshu image-production workflow, but the skill evidently includes materially broader functionality such as generic chat, video generation, account/balance retrieval, model enumeration, arbitrary media upload, and local credential setup/storage. This mismatch is dangerous because users and reviewers may trust the skill in a limited marketing-image context while it can access account metadata, store credentials locally, and perform broader API operations that increase abuse and data-handling risk.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file is presented as a specialized Xiaohongshu image-studio skill, but the implementation is a broad AI Hive client exposing unrelated capabilities such as chat, model enumeration, account inspection, media upload, and video generation. This scope mismatch violates least privilege and increases the attack surface, making it easier for downstream agents or users to invoke unintended high-impact operations under the guise of a narrow-purpose skill.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The module and parser descriptions explicitly advertise a generic AI capability tool, contradicting the declared narrow skill purpose. In an agent ecosystem, misleading packaging can cause other components to trust and invoke functionality they did not intend to permit, enabling covert capability expansion.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code includes full video-generation support even though the skill is supposed to handle Xiaohongshu image production. Unnecessary media-generation capability broadens misuse potential, can incur unexpected cost, and may allow policy evasion by using the skill for unreviewed output types.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The generic text chat interface is unrelated to the stated image-studio workflow and allows arbitrary prompting against any text model. That gives the skill a hidden general-purpose LLM channel, which can be abused for off-scope actions, data handling, or policy circumvention beyond approved image generation.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: Account information and model-inspection endpoints are beyond the skill's stated purpose and reveal additional operational metadata such as wallet balance or available models. While not as severe as direct code execution, they increase reconnaissance value and expand the set of actions available to an attacker or misconfigured agent.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The default prompt hard-codes Chinese output ('production-ready Chinese workflow') without checking the user's language preference or requiring opt-in. This can override user intent, reduce transparency, and increase the chance of miscommunication or unintended downstream actions, especially in a workflow that generates runnable commands and deliverables.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Enabling implicit invocation with no visible trigger constraints allows the skill to activate too broadly, including on loosely related requests. In a skill that produces executable AI-HIVE commands and workflow steps, over-broad activation can cause unintended tool use, unexpected content generation, or steering users into a specialized workflow they did not clearly request.

Static analysis

No suspicious patterns detected.