Security audit

广告首帧动态化｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE advertising video workflow helper; it uses local scripts, API credentials, uploads, downloads, and ffmpeg in ways that fit its stated purpose, with some over-broad activation and credential-handling details users should notice.

Install only if you intend to use AI-HIVE for ad or marketing video workflows. Review commands before running them, confirm paid generation parameters first, keep the API key out of logs and repositories, and upload only media you have rights to use.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill includes executable capabilities involving environment variables, filesystem access, shell commands, and network calls, but does not declare permissions or clearly constrain those powers. This creates a transparency and control gap: a host or reviewer may treat the skill as low-privilege while it can read secrets, manipulate local files, invoke external binaries like ffmpeg, and contact remote APIs, increasing the chance of secret exposure or unsafe command/file operations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is narrowly framed around ad first-frame animation, but the described code paths enable much broader functions such as general chat, generic image generation, arbitrary media upload, model/user-info querying, and local ffmpeg processing. That mismatch weakens trust boundaries and can lead to overbroad invocation, unexpected data handling, or use of the skill as a generic API/file-processing wrapper beyond what users and orchestrators expect.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases include broad, common terms like '图片转视频', '信息流广告', and '广告开场', which can cause the skill to activate in situations outside its intended narrow workflow. Over-triggering is risky here because the skill can reach external services and perform local processing, so accidental selection may expose user media, consume paid API calls, or route tasks to a tool with broader capabilities than necessary.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables implicit invocation with no trigger constraints, exclusions, or narrowing conditions, which increases the chance it will activate in unrelated conversations. Because this skill can transform requests into runnable AI-HIVE commands and operational workflows, accidental invocation could cause unintended generation of ad-production steps or external API-oriented actions without clear user intent.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The default prompt hard-codes Chinese output without indicating that this is optional or based on user preference. While not a direct security exploit, it can mis-handle user intent, reduce transparency, and increase the risk of confusing or misleading outputs when the user expects another language or when downstream instructions are language-sensitive.

Static analysis

No suspicious patterns detected.