Security audit

AI生成内容披露检查｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill discloses that it can use AI-HIVE to upload media, generate images or videos, edit local video files, and save outputs, and I did not find hidden or destructive behavior.

Install only if you are comfortable using AI-HIVE for remote media upload and potentially billable generation. Review prompts, files, routing mode, and output paths before running commands, avoid sensitive or unlicensed reference media, and prefer environment variables over persisted API keys if you do not want ~/.ai-hive/config.json created.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents executable workflows that use environment variables, local file access, shell commands, network calls, and file writes, yet it declares no permissions. This creates a transparency and governance gap: users and platforms cannot accurately assess what the skill can access or do before invocation, increasing the chance of over-privileged or unexpected execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a narrow disclosure/compliance checker, but the documented behavior includes generic chat, account and wallet access, model enumeration, media upload, broad image/video generation, and ffmpeg editing. This mismatch is dangerous because users may authorize or trust the skill for compliance review while it can perform materially broader operations, including billable actions and data transfers unrelated to the stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: Within a compliance-oriented skill, the workflow exposes broad content generation and production features that can be repurposed beyond disclosure checking. In context, this weakens safety boundaries and makes it easier for a user or downstream agent to pivot from audit/compliance assistance into generic media creation using the same trusted entry point.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The documentation promises scripts, prompts, shot lists, and code commands for general content production despite positioning the skill as a disclosure-checking tool. This expands the operational scope in a way that can mislead users about the trust model and encourage use of a compliance-branded skill for unrelated generation tasks.

Description-Behavior Mismatch

High

Confidence: 90% confidence
Finding: The file provides broad local media-editing capabilities (trim, aspect conversion, mute, loudness normalization, concat) that are not aligned with the skill's declared purpose of AI-content disclosure/compliance checking. In a disclosure-check skill, this expands the attack surface and creates an undeclared capability that could be abused to manipulate assets, remove contextual cues, or process arbitrary local media under the guise of compliance work.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Allowing local subprocess-based ffmpeg execution gives the skill a powerful host-level capability that is unnecessary for a disclosure-analysis workflow. Even without obvious shell injection, this can enable arbitrary processing of local files, create denial-of-service conditions through expensive media jobs, and increase the risk from ffmpeg parser bugs or unsafe file handling in an otherwise compliance-focused skill.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file is a general-purpose AI Hive client for chat, image, video, upload, polling, and credential setup, while the skill is advertised as a specialized AI-content disclosure checker. This mismatch is dangerous because it grants broader operational capabilities than users and reviewers would reasonably expect, increasing the chance of misuse, over-permissioning, and deceptive deployment under a narrower trust label.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The exposed chat and video-generation commands materially exceed the stated disclosure-check function and create latent capability for unrelated content generation. In this context, hidden or unjustified capabilities are risky because they can be invoked by an agent or operator expecting compliance tooling, not a broad media-generation client.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module docstring explicitly describes a general AI capability invocation tool, contradicting the advertised specialized disclosure-check intent. This inconsistency is a supply-chain and trust problem: reviewers may approve a compliance-oriented skill while actually shipping a multi-capability client with broader operational reach.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file is presented as an AI content disclosure/compliance checker, but the implementation is a general AI Hive client that supports chat, image generation, video generation, uploads, downloads, and API-key setup. This mismatch can mislead users and higher-level agents into invoking powerful content-generation capabilities under a compliance-oriented label, increasing the risk of unauthorized generation, policy bypass, or unsafe delegation.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The embedded metadata explicitly brands the skill as 'AI生成内容披露检查', but the generated parser and execution path route directly into video generation using fixed AI Hive model IDs. Embedding deceptive metadata into the skill package makes misuse more likely because orchestration layers may select this skill for compliance review while actually triggering content creation and external media transfer.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill uploads user-supplied media to remote object storage and downloads generated results to local disk without an explicit privacy, retention, or data-handling notice. In a skill advertised for compliance/disclosure workflows, users may provide sensitive marketing assets, drafts, or personal media and not realize those files are being transferred to third-party infrastructure and stored locally.

Static analysis

No suspicious patterns detected.