T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:91- Finding
API Credential Disclosure Through an Unrestricted Custom Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
AI漫剧全流程制作｜AI-HIVE
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent AI-HIVE comic-drama workflow, but it needs review because its API clients can expose the API key to custom endpoints and can write downloaded results using untrusted task metadata.
Review before installing. Use a dedicated low-limit AI-HIVE API key, avoid --base-url or AI_HIVE_BASE_URL unless you fully control the endpoint, run the scripts in an isolated environment, choose a safe output directory, and avoid using the init command on shared machines unless persistent credential storage is acceptable.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:312- Finding
Untrusted Task Metadata Can Escape the Download Directory
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:63- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A skill that advertises a narrow comic-drama workflow but actually includes generic text/image generation, wallet/account access, and interactive API-key setup creates a materially broader trust boundary than users expect. In this context, hidden or underdeclared account-linked and potentially billable operations are dangerous because they can expose account information, encourage unsafe secret handling, or trigger actions outside the user’s informed consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill that advertises a narrow comic-drama workflow but actually includes generic text/image generation, wallet/account access, and interactive API-key setup creates a materially broader trust boundary than users expect. In this context, hidden or underdeclared account-linked and potentially billable operations are dangerous because they can expose account information, encourage unsafe secret handling, or trigger actions outside the user’s informed consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A skill that advertises a narrow comic-drama workflow but actually includes generic text/image generation, wallet/account access, and interactive API-key setup creates a materially broader trust boundary than users expect. In this context, hidden or underdeclared account-linked and potentially billable operations are dangerous because they can expose account information, encourage unsafe secret handling, or trigger actions outside the user’s informed consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
A skill that advertises a narrow comic-drama workflow but actually includes generic text/image generation, wallet/account access, and interactive API-key setup creates a materially broader trust boundary than users expect. In this context, hidden or underdeclared account-linked and potentially billable operations are dangerous because they can expose account information, encourage unsafe secret handling, or trigger actions outside the user’s informed consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents executable examples and implies access to environment variables, filesystem, network, and shell operations, but it does not declare any explicit tool scope or permission boundaries. This creates an overbroad and ambiguous execution surface where a host agent may grant more capability than users or reviewers expect, increasing the risk of unintended file access, network calls, or secret handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The default prompt explicitly instructs the skill to produce a "production-ready Chinese workflow," which imposes a specific language choice in natural language. The file does not indicate that the user can choose another language or opt into Chinese output, so this appears to violate the language/locale policy criterion.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest describes an AI comic/drama production workflow centered on asset planning and AI-HIVE OpenAPI operations such as configuration lookup, uploads, polling, and downloads. This file instead provides a generic local video-editing CLI that invokes external binaries via subprocess, which is a materially different capability and not explicitly declared in the stated purpose.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring and user-facing instructions are written exclusively in Chinese, and the CLI prompts/messages throughout the skill assume Chinese output and interaction. For a general-purpose skill, this imposes a specific language/locale without offering the user a choice or documenting a justified region-specific constraint.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a skill for AI漫剧全流程制作 centered on image generation via AI-HIVE, including asset upload, pricing snapshots, routing, polling, and downloads. However, this file also exposes generic OpenAPI operations such as querying user wallet/account info, listing arbitrary models, and freeform text chat, which go beyond the claimed skill-specific workflow and make the implementation a general AI Hive client rather than a focused comic-drama production skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The built skill entrypoint and file name present this as an image-generation skill, and the embedded skill wrapper only exposes generate/task/upload for images. Yet the implementation contains full video-generation logic with video/audio uploads and video task submission, which is broader than the actual exposed skill role and the manifest's emphasis for this particular file context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file implements a broad AI Hive client with chat, image generation, model listing, upload, and account functions that significantly exceed the declared comic-drama video workflow. This increases the skill's effective privilege and capability surface, enabling operators or downstream agents to invoke unrelated API actions under the same trusted skill identity, which violates least-privilege expectations and can facilitate misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and all user-facing guidance are written in Chinese, and the skill does not indicate any option to select or opt into another language. For a general-purpose skill, this constitutes a natural-language locale constraint that is not documented as region-specific or optional.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill exposes a user-info command that retrieves user account information and wallet balance, which is unnecessary for generating comic-drama videos. Access to account metadata can leak sensitive operational or financial information and broadens the damage if the skill is invoked unexpectedly or by a compromised workflow.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The top-level docstring says this is a '通用 AI 能力调用工具' that wraps text chat, image generation, video generation, model query, media upload, and polling. But the actual executable path at the bottom invokes skill_main(), which exposes a narrowed skill-specific parser for generate/task/upload tied to a fixed model and title, so the documentation misstates the behavior users of this file actually get when running it.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Generic model enumeration is outside the narrowly described workflow and reveals platform capabilities that are not needed for the advertised task. While lower impact than account access, it still expands reconnaissance value and allows callers to discover alternate models and routes that could be used beyond the intended comic-drama production flow.
- Content
Static analysis
No suspicious patterns detected.