Security audit

爆款广告A/B创意矩阵｜AI-HIVE

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI-HIVE advertising creative workflow that uses an API key, remote media generation, and local file processing, with no artifact-backed hidden exfiltration or destructive behavior found.

Install only if you intend to use AI-HIVE for ad creative generation and are comfortable providing an AI-HIVE API key and sending selected images, videos, or audio to the service. Review prompts, routing, and batch size before running billable generation, and use only assets you are authorized to upload.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documents executable workflows that use environment variables, local file I/O, network access, and shell-invoked tools like ffmpeg, but it does not declare permissions accordingly. This creates a transparency and sandboxing problem: a caller or platform may underestimate what the skill can access or execute, increasing the chance of unintended data exposure, unsafe file operations, or external requests with sensitive inputs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill is presented as an A/B creative-matrix and asset-generation workflow, but the referenced behaviors extend into broader API access, wallet/user-info querying, generic uploads, and multiple standalone ffmpeg media manipulations. That mismatch is dangerous because users and orchestrators may invoke the skill expecting limited, task-specific behavior while it can perform additional operations that touch billing, metadata, local media, and external services.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file is presented as a narrow ad-creative image skill, but actually bundles a much broader generic AI platform client with chat, video generation, model enumeration, uploads, and API-key setup. This scope mismatch is dangerous because users or orchestrators may grant trust and permissions based on the manifested purpose while the code can perform materially broader actions than expected.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: Exposing `user-info` and `models` adds account-inspection and platform-enumeration behavior unrelated to the advertised creative-matrix image workflow. While not directly destructive, these extra capabilities increase attack surface and may reveal account metadata, balance, or service configuration beyond what users expect this skill to access.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill includes a general text-chat endpoint even though the manifest describes an image/material generation skill for A/B ad creatives. This hidden general-purpose capability broadens what remote prompts and uploaded media can be sent to the service, making the skill more powerful than users or calling agents would reasonably expect.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Full video-generation support is included despite the skill being framed as an image-focused creative-matrix tool. This unnecessary capability expansion increases remote processing, upload, and download surface, and could be abused to perform operations outside the user-approved scope.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file is presented as a specialized ad creative matrix/video skill, but the implementation and module docstring clearly expose a much broader generic AI client. In an agent-skill setting, capability overreach is dangerous because it expands what downstream callers can do beyond user expectations and manifest-declared scope, undermining least privilege and increasing the chance of misuse.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill exposes a user-info endpoint that returns account information and wallet balance, which is unrelated to generating ad-creative videos. In a delegated-agent context this creates unnecessary access to sensitive billing/account metadata and broadens the blast radius if the skill is invoked unexpectedly or by an untrusted workflow.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The unrestricted text-chat capability is outside the stated purpose of an ad creative matrix video-generation skill and effectively turns the skill into a general-purpose LLM client. That mismatch matters because agent platforms may grant or route this skill based on its declared narrow purpose, while the code silently enables broader interactions and prompt/data handling than expected.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The module docstring explicitly describes a generic AI capability tool, contradicting the manifest's specialized ad-creative intent. This inconsistency is a meaningful security signal because it suggests the packaged skill may be reusing a broader utility without properly constraining exposed operations, which can mislead reviewers, routing systems, and users about its real permissions.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill enables implicit invocation while providing only broad descriptive metadata and no narrow activation guardrails. This can cause the agent to auto-apply the skill in loosely related marketing or content-generation requests, unexpectedly steering users into external workflow generation and AI-HIVE command production without explicit consent.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The default prompt hard-codes Chinese output regardless of the user's language preference. While not a direct code-execution issue, it can override user intent, reduce transparency, and make safety-relevant instructions or generated commands harder for some users to review and validate before use.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The tool uploads user-supplied media to remote object storage and the AI-Hive service without a clear upfront warning about transmission, third-party storage, or retention. In a marketing/creative skill, users may provide proprietary ad assets, product photos, or customer-related media, so silent upload behavior creates real confidentiality and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.