Security audit

广告疲劳检测与AI焕新｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE ad-creative refresh workflow; it uses external generation, uploads, local media files, and an API key in ways that fit its stated purpose.

Install only if you intend to use AI-HIVE for ad creative refresh work. Review prompts, routing mode, uploaded media, and costs before running generation commands; upload only assets you are authorized to use, and protect the AI-HIVE API key stored in your environment or ~/.ai-hive/config.json.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises and demonstrates code paths that use environment variables, filesystem access, shell execution, and network calls, yet no explicit permission model is declared. That creates an unclear trust boundary: an invoking agent or reviewer may treat the skill as low-risk content analysis while it can actually upload files, call external APIs, and run local tooling like ffmpeg. In this context, the danger is amplified because the workflow includes handling user-supplied media and API keys, which are sensitive assets.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The documented purpose is a narrow ad-fatigue diagnosis and refresh workflow, but the embedded examples and described capabilities extend into general-purpose text/image generation, broader video manipulation, and static project scaffolding. This mismatch can mislead orchestrators and users about the true behavior surface, causing the skill to be selected in contexts where broader external API use, file transformation, or content generation is not expected or authorized. Because it interfaces with third-party generation services and media tooling, the hidden breadth materially increases abuse and data-handling risk.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file implements a broad AI Hive client with chat, image generation, model listing, user-info, and media upload functions that materially exceed the declared ad-fatigue refresh video workflow. This capability expansion increases attack surface and enables unintended data access or off-purpose use, especially in agent environments that trust the skill’s declared scope.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill-specific generate path accepts arbitrary prompts and simply routes them into generic video generation without implementing the promised fatigue analysis, variable-preservation logic, or refresh-diagnosis controls from the manifest. This is dangerous because consumers and agent orchestrators may grant the skill permissions based on a narrow business purpose while the code actually functions as an unrestricted generation tool.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The client exposes a user-info endpoint that can retrieve account and wallet information unrelated to ad-fatigue refresh generation. In a skill ecosystem, unnecessary access to account metadata violates least privilege and can leak sensitive billing or identity information if the tool is invoked unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code includes a generic text chat API wrapper that is unrelated to the skill’s declared ad-fatigue refresh video purpose. Extra general-purpose generation features can be abused to bypass policy routing, perform off-scope tasks, or exfiltrate user-provided content to models beyond what the user expected from this specialized skill.

Context-Inappropriate Capability

Low

Confidence: 79% confidence
Finding: Standalone model enumeration and arbitrary media upload are broader than the stated business purpose and can facilitate off-scope exploration or content transfer. While not inherently harmful alone, these utilities increase the chance of misuse and expand the available attack surface inside an agent-integrated skill.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger conditions include broad marketing-language scenarios, making the skill eligible for many generic requests beyond fatigue analysis. Over-broad invocation increases the chance that the skill will be auto-selected for unrelated tasks, exposing users to unnecessary external API calls, media processing, or broader content-generation behaviors not needed for the request. In this skill, that matters because the downstream workflow can involve uploads, asynchronous jobs, and potentially billable generation steps.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The manifest enables implicit invocation without any visible guardrails in this file that narrowly restrict when the skill should activate. Because this skill can generate production-ready workflows and runnable AI-HIVE commands for ad-creative generation, accidental or overly broad activation could cause the agent to steer unrelated conversations into ad-ops actions, data handling, or external API usage without clear user intent.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The default prompt hardcodes Chinese output and a specific skill invocation path without indicating that this is based on user preference. This can override user expectations, reduce transparency, and make the agent apply a specialized ad-refresh workflow even when the user did not request Chinese output or this exact operational framing.

Static analysis

No suspicious patterns detected.