T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:92- Finding
AI-HIVE bearer token can be transmitted to an arbitrary server
- Content
View full analysis
- Remediation
View remediation
Security audit
广告素材失败诊断｜AI-HIVE
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a disclosed AI-HIVE ad workflow, but it handles persistent API keys and can send the bearer token to an unvalidated custom API endpoint.
Install only if you trust this publisher with your AI-HIVE account and media assets. Avoid using --base-url, AI_HIVE_BASE_URL, or config-file base_url values unless they point to the legitimate AI-HIVE HTTPS API, and prefer a scoped or disposable API key because the skill stores and reuses it. Review commands before running them, especially uploads or generation tasks that may transmit local media or incur charges.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/videogen.py:17- Finding
Runtime dependency is installed without version or integrity pinning
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
scripts/videogen.py:420- Finding
Bundled API client exposes capabilities beyond the declared advertising-diagnosis workflow
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is framed as a specialized ad-diagnosis assistant, yet the behavior described includes account info retrieval, wallet/balance access, generic model/pricing queries, chat/image generation, and arbitrary media handling. That broader operational surface materially increases risk because a user may provide trust, data, or API access under false assumptions, enabling unnecessary collection of sensitive account metadata and execution of unrelated actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is framed as a specialized ad-diagnosis assistant, yet the behavior described includes account info retrieval, wallet/balance access, generic model/pricing queries, chat/image generation, and arbitrary media handling. That broader operational surface materially increases risk because a user may provide trust, data, or API access under false assumptions, enabling unnecessary collection of sensitive account metadata and execution of unrelated actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is framed as a specialized ad-diagnosis assistant, yet the behavior described includes account info retrieval, wallet/balance access, generic model/pricing queries, chat/image generation, and arbitrary media handling. That broader operational surface materially increases risk because a user may provide trust, data, or API access under false assumptions, enabling unnecessary collection of sensitive account metadata and execution of unrelated actions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is presented as an ad-creative failure diagnosis tool, but the implementation is a broad AI Hive media-generation, upload, account, and task CLI. This capability mismatch is dangerous because users and orchestrators may grant access expecting narrow diagnostic behavior while the code can upload arbitrary files and generate media, increasing the attack surface and enabling unintended or policy-violating actions under a misleading label.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises and demonstrates operations that imply access to environment variables, local files, network calls, and shell execution, but it does not declare any tool scope or permissions boundary. In an agent ecosystem, this creates a least-privilege failure: the skill may be granted broader capabilities than users or reviewers expect, increasing the chance of secret exposure, arbitrary file access, or unintended external requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger conditions are broad enough to match many generic marketing or content requests, which can cause the skill to activate outside its intended narrow context. Over-broad auto-invocation is dangerous in a skill with network, file, or billable-generation workflows because it increases the chance of inappropriate data handling, unnecessary external API calls, or user confusion about what actions the agent may take.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The default prompt instructs the system to use this skill for a broad class of requests and to produce production-ready workflows and runnable AI-HIVE commands, but it does not narrowly constrain when invocation is appropriate. In a system with implicit invocation enabled, this can cause over-triggering on loosely related user requests, increasing the chance of unintended API usage, unnecessary code generation, or action-oriented outputs without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The default prompt hard-codes Chinese output regardless of the user's language preference. This can degrade transparency and user comprehension, especially when the skill generates operational steps or runnable commands, increasing the risk that users execute instructions they do not fully understand or that the skill behaves contrary to user expectations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script generates artifacts such as '差异化复刻方案', '逐镜脚本', and '生成提示词', which move beyond failure diagnosis into operational production and replication planning. In this skill context, that expands the capability toward creating or reproducing ad creatives, increasing the chance of unauthorized imitation or policy-evasive content generation despite the manifest's stated restrictions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a skill for diagnosing failed ad creatives and, when generation is needed, using AI-HIVE OpenAPI workflows. This file instead executes local ffmpeg/ffprobe binaries via subprocess to manipulate media, which is a distinct system-level capability not justified by the stated diagnosis-focused purpose or the declared AI-HIVE generation flow.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest centers on accepting failed-ad evidence and producing diagnosis outputs such as problem localization, evidence gaps, platform mismatch analysis, repair priorities, and new creative tasks, with generation routed through AI-HIVE OpenAPI. This script instead implements trimming, aspect-ratio conversion, muting, loudness normalization, probing, and concatenation of local video files, which does not match the described diagnosis behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring explicitly describes a general-purpose AI capability tool, contradicting the specialized ad-diagnosis identity declared in skill metadata. This inconsistency is a security concern because it signals the code may be intentionally over-capable relative to its advertised purpose, undermining trust, review assumptions, and least-privilege deployment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing natural-language descriptions exclusively in Chinese, including the module docstring and later CLI help text. Under the policy rule, forcing a specific language without offering a choice or documenting a justified locale restriction is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The presence of account/model inspection functions is broader than what an ad-failure diagnosis skill needs. In context, these features can disclose account metadata, balances, and available models to a user or workflow that expected only analytical processing, creating unnecessary information exposure and privilege expansion.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The interactive initialization flow opens a browser and guides the user to obtain and paste an API key, which exceeds the stated business purpose of diagnosing ad failures. In a skill ecosystem, this can normalize credential collection behavior and increase phishing-like risk, especially because the skill is mislabeled as a narrowly scoped diagnosis tool.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description defines invocation examples entirely in Chinese and frames the skill's use around Chinese-language requests, while the file does not state that this is an optional locale-specific skill or offer user language choice. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This Python file contains user-facing natural-language strings for the skill name and argument parser description entirely in Chinese, with no indication that language is configurable or optional. Under the policy rule for language or locale constraints, this is a natural-language policy concern because the skill presents a fixed locale without offering a user choice or documenting a justified regional restriction.
- Content
Static analysis
No suspicious patterns detected.