ClawHub
Back to skill

Security audit

商品宣传短片｜AI-HIVE原创工作流

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent AI-HIVE advertising workflow, but its helper script can send user credentials to an environment-selected MCP URL that is not clearly scoped or documented.

Review before installing. Use the official AI-HIVE MCP endpoint, prefer OAuth through a trusted client, do not set AI_HIVE_MCP_URL unless you fully trust the destination, keep API keys out of prompts/logs/repos, and require explicit confirmation before any paid generation, upload, batch action, sending, or public posting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:
Confidence
84% confidence
Finding
The script allows AI_HIVE_MCP_URL to override the default MCP endpoint, then sends authentication headers derived from AI_HIVE_API_KEY or AI_HIVE_ACCESS_TOKEN to that URL. If an attacker can influence the environment, credentials may be exfiltrated to an arbitrary server and tool calls could be redirected to an untrusted endpoint.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs the user to run local scripts, set environment variables, write JSON work orders, and connect to a remote MCP endpoint, which implies environment, file, and network capabilities despite no declared permissions. This is dangerous because users or hosting platforms may not realize the skill can drive code execution and outbound connections, reducing reviewability and increasing the chance of unintended data exposure, unsafe local file writes, or misuse of API credentials.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill enables implicit invocation without defining narrow trigger conditions or exclusions, which can cause it to activate on loosely related user requests. Because this skill connects to an external MCP service capable of marketing, image, and video generation, unintended invocation could expose user prompts to a third party or steer users into advertising workflows they did not explicitly request.

Static analysis

No suspicious patterns detected.