T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:91- Finding
Bearer credential exposure through unrestricted API endpoint override
- Content
View full analysis
- Remediation
View remediation
Security audit
广告创意评分与改稿｜AI-HIVE
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it should be reviewed carefully because it can use stored API credentials, upload media, and submit billable AI-HIVE video-generation jobs without code-enforced confirmation.
Install only if you are comfortable giving the skill an AI-HIVE API key and letting it upload selected media to AI-HIVE for generation. Keep the default AI-HIVE endpoint, avoid AI_HIVE_BASE_URL or --base-url unless the host is trusted and HTTPS, manually confirm model/routing/cost before running generate, and rotate the API key if it was ever used with an unknown endpoint.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:814- Finding
Billable video-generation tasks can be submitted without enforced user approval
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This mismatch is more severe because it suggests undeclared generic capabilities such as chat, media upload, model listing, or generation beyond the narrowly advertised ad-review function. Undeclared general-purpose capabilities can be abused to exfiltrate sensitive ad assets, make unapproved third-party requests, or perform actions outside the user's intended business workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This mismatch is more severe because it suggests undeclared generic capabilities such as chat, media upload, model listing, or generation beyond the narrowly advertised ad-review function. Undeclared general-purpose capabilities can be abused to exfiltrate sensitive ad assets, make unapproved third-party requests, or perform actions outside the user's intended business workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch is more severe because it suggests undeclared generic capabilities such as chat, media upload, model listing, or generation beyond the narrowly advertised ad-review function. Undeclared general-purpose capabilities can be abused to exfiltrate sensitive ad assets, make unapproved third-party requests, or perform actions outside the user's intended business workflow.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file header and implementation expose a generic AI-Hive media generation/upload tool, while the declared skill is supposed to perform ad creative scoring and rewrite. This mismatch is dangerous because it can cause the agent to invoke powerful media generation, upload, and remote API capabilities under a misleading safety/business label, bypassing user and platform expectations about what the skill is allowed to do.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The fixed configuration brands the tool as an ad-creative scoring/rewrite skill, but internally maps directly to raw video-generation model IDs and dispatches to generation code. This deceptive wrapping increases risk because policy engines, reviewers, or users may approve the skill based on its stated purpose while the code actually enables different higher-risk actions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill-specific entrypoint exposes generate, task, upload, and init commands instead of ad-creative scoring or rewrite operations. In context, this means the operational surface available to the agent is materially broader than advertised, enabling file uploads, remote content generation, and API credential setup under a misleading skill identity.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents commands that rely on sensitive capabilities such as environment variables, file access, shell execution, and network calls, but it does not declare any explicit tool scope or permissions boundary. This makes the operational trust model unclear and increases the chance that an agent runtime grants broader access than users or reviewers expect, enabling unintended data exposure or unreviewed external calls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description and invocation examples are entirely specified in Chinese terms such as 广告评分, 创意诊断, and 广告改稿, which effectively constrains activation and use to a single language. The file does not state that the skill is intentionally China-market-only or offer multilingual/user-selectable language behavior, so this is a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The default prompt hard-codes Chinese output ('production-ready Chinese workflow') regardless of the user's language preference. This is a prompt-quality and user-consent issue rather than a classic security flaw, but it can mislead downstream automation, reduce usability, and cause unintended behavior when users expect another language.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generated blueprint explicitly includes '差异化复刻方案' as an artifact, which can steer downstream users toward producing imitation-based ad creatives. In the context of a skill that already warns against unauthorized replication, embedding replication-oriented output into the default blueprint creates a policy contradiction and increases the chance of misuse or unauthorized copying.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill for ad creative scoring, diagnosis, rewrite, and AI-HIVE-backed material generation via API workflows. This file instead implements local video probing and deterministic editing operations such as trim, aspect conversion, mute, loudness normalization, and concatenation by invoking ffmpeg binaries, which is a separate media-processing capability not described as part of the skill's scope.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and user-facing help/instructions are written entirely in Chinese, indicating a fixed language/locale for interaction. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless a locale restriction is explicitly documented and justified, which is not present here.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The top-level docstring says the file creates a production brief, while the manifest describes the skill primarily as ad creative scoring, diagnosis, rewrite, and precheck, with generation only as a secondary AI-HIVE workflow. This documentation points to a production-planning intent that diverges from the stated analyzer-centered purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file hardcodes Chinese-language natural-language strings in the module docstring, CLI description, and output metadata. Because no user opt-in or locale selection is provided, this can violate language/locale policy if the environment expects neutral or user-selectable language behavior.
- Content
Static analysis
No suspicious patterns detected.