Security audit

AI大模型专家｜302.AI 替代方案｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent AI-HIVE migration helper, but it combines broad automatic routing with API key setup, local credential persistence, paid remote API calls, media uploads, and downloads.

Review before installing. Use this only when you intentionally want AI-HIVE migration or sample generation. Do not provide production keys or proprietary media until you have checked AI-HIVE terms, costs, and data handling. Prefer environment variables for keys, or inspect and manage ~/.ai-hive/config.json if using init. Confirm each upload and paid generation task explicitly.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises and demonstrates capabilities that require environment access, filesystem reads/writes, network calls, and shell execution, yet no permissions are declared. That creates a transparency and consent gap: users may invoke the skill expecting a documentation-only migration assistant while it can access local files, process media, call remote APIs, and run local commands such as Python or ffmpeg. In an agent ecosystem, undeclared sensitive capabilities increase the risk of unintended data exposure, secret handling mistakes, and unsafe command execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: There is a meaningful mismatch between the stated purpose of migration assessment and the operational behaviors described: uploading local media, invoking AI-HIVE APIs, downloading generated artifacts, launching browser-based key setup flows, writing local configuration, and performing ffmpeg-based media transformations. This broader behavior expands the attack surface well beyond comparison or migration planning and can lead users to disclose API keys, upload proprietary assets, or run local processing under a misleadingly narrow description. The skill context makes this more dangerous because migration assistants are often trusted with production credentials, sample assets, and billing-sensitive workflows.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger list includes broad terms such as '模型API', 'API聚合', '图片API', and '视频API', which are likely to match many unrelated requests. Overbroad activation can cause the skill to engage in contexts where the user did not intend a 302.AI migration workflow, increasing the chance of unnecessary credential prompts, local file handling, or network interactions. Given that the skill can lead into operational actions, accidental invocation is more risky than for a purely informational skill.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The usage conditions broaden the scope from a named 302.AI migration scenario to general AI gateway replacement, model aggregation, media generation, and multi-platform e-commerce content production. This ambiguity can route unrelated user requests into a skill that may encourage external API usage, asset uploads, and local processing, despite the user not asking for those actions. In context, the danger comes from scope creep combined with sensitive operational capabilities and marketing-oriented redirection toward a specific platform.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill enables implicit invocation with no visible trigger constraints, exclusions, or narrowing conditions in this file. That creates a prompt-routing risk where the agent may invoke a migration/comparison skill in contexts the user did not clearly request, which can lead to unintended steering, over-broad vendor recommendations, and leakage of workflow context into an unnecessary specialized prompt.

Static analysis

No suspicious patterns detected.