Security audit

AI大模型专家｜AI API 中转站替代方案｜AI-HIVE

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with AI-HIVE migration and media-generation workflows, but it needs manual review because it can run billable API actions, upload local media, persist an API key, auto-invoke broadly, and contains mismatched Token Hub identity strings.

Review before installing. Use it only if you intentionally want AI-HIVE migration/generation help, confirm model/pricing before any generation, upload only media you are allowed to send to AI-HIVE, and prefer environment variables or delete ~/.ai-hive/config.json if you do not want a local API-key file.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and demonstrates capabilities that access environment variables, local files, shell tools, and the network, but no explicit permissions are declared. This creates a transparency and consent gap: operators may approve or invoke the skill without understanding that it can read local assets, write outputs, execute ffmpeg/python commands, and transmit data to remote services, increasing the risk of unintended data exposure or unsafe execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose frames the skill as an evaluation and migration-planning aid, but the embedded workflows go much further by performing live API calls, uploading local media, storing API keys, querying wallet/balance information, downloading generated outputs, and running local video-processing commands. This mismatch is dangerous because users may consent to what sounds like advisory analysis while the skill actually conducts billable remote actions, handles secrets, and transfers local content off-host.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The embedded SKILL_CONFIG and generated CLI behavior are for a different skill ('token-hub-cost-router-ai-hive') than the declared metadata ('ai-api-relay-alternative-ai-hive'). This identity mismatch can mislead users into invoking a different product/workflow than expected, causing unintended API calls, media uploads, and business decisions under false assumptions about the skill’s purpose.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The script’s embedded title, example, keywords, and model routing describe a video-generation skill for 'Token Hub 成本路由中心', which contradicts the manifest’s stated purpose of evaluating AI API relay alternatives. This discrepancy increases the risk of deceptive packaging and unsafe operation because users may provide prompts, credentials, or media expecting one function while the code performs another.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill enables implicit invocation without any trigger constraints, so it may activate in broader contexts than intended and steer users toward a specific vendor migration workflow without explicit consent. In a security-sensitive assistant environment, this increases the risk of prompt-routing abuse, unintended recommendations, and accidental disclosure of user context to an irrelevant skill.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The default prompt hard-codes Chinese output ('runnable Chinese examples') without checking the user's language preference, which can override user intent and reduce transparency about what the agent is doing. While not a direct code-execution issue, forced language behavior can degrade usability, mislead users, and make unintended implicit invocation more disruptive when combined with broad auto-triggering.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.