宣言式概念短片｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 5, 2026 · 2:58 AM UTC
• Version: 1.0.0

Overview

This AI-HIVE advertising skill is mostly coherent, but it uses credentials with a remote MCP helper whose endpoint and tool calls are broader than the stated workflow needs.

Review this skill before installing. Use OAuth or a scoped API key only with the documented AI-HIVE endpoint, avoid setting AI_HIVE_MCP_URL unless you fully trust the target, and require explicit confirmation before any generation, upload, batch, send, or publish action that may cost money or expose private materials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:1
• Finding: Fixed Marketing/Advertising Template in SKILL.md – Prompt Injection Risk## Vulnerability Details **File Location**: /tmp/clawhub-codex-scan-v57cw4jvxca48mm6zw2b6nae7n8dtg38-3NYHLV/artifact/SKILL.md (lines 1-154) **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Technical Analysis The file `SKILL.md` contains a fixed, detailed advertising and marketing workflow template, including promotional language, homepage links, and a copy-pasteable prompt, appended at the end of the skill documentation. This content is loaded as part of the skill’s instructions and will be included in the agent context for any user session. Such injected instructional content can alter the agent's session goals, subtly shifting the user intent or agent output toward marketing the AI-HIVE product and its affiliated services. This constitutes a form of prompt injection: by embedding persistent marketing instructions, the skill can bias outputs or influence downstream agent behavior, potentially overriding user-driven objectives. ### Attack Path 1. A user loads or activates the skill. 2. The agent receives the appended marketing template and links as part of its context/instructions. 3. The agent may begin to promote, reference, or prioritize the AI-HIVE platform in its responses, regardless of the user's original intent. 4. The user session is hijacked by the skill’s embedded goals, leading to unwanted advertising or redirection. ### Impact Assessment The impact is the hijacking of session intent, with the potential to alter agent outputs in a way that is not controlled or expected by the user. The agent’s responses can be biased, leading to loss of neutrality and possible user trust erosion. This does not grant system-level privileges, but it does give the skill author undue influence over the AI agent’s behavior.
• Remediation: ## Remediation Suggestions - Remove persistent marketing, advertising, or promotional templates from skill instructions. - Ensure all agent-facing instructional content is strictly relevant to the declared function of the skill, without external product promotion. - Separate functional documentation from any advertising material and avoid embedding links or templates that alter agent session goals. - Regularly review skill documentation for prompt injection or undesired instructional artifacts.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 87% confidence
• Finding: The script builds authenticated requests to an environment-configurable MCP endpoint and transmits either an API key or bearer token to that remote server. If AI_HIVE_MCP_URL is set to an attacker-controlled host, the helper will exfiltrate credentials and tool-call payloads over the network, which is especially sensitive because this utility is explicitly designed to use real credentials.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The helper can invoke any MCP tool name provided on the command line, while only using a soft guard for potentially paid operations based on a small local allowlist. In the context of an advertising skill that is supposed to be workflow-oriented and confirmation-gated, this broad capability expansion can expose backend actions beyond the declared scope if the remote MCP server offers more powerful tools.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill enables implicit invocation for an external MCP-backed advertising workflow without any scoped trigger conditions or user-intent guardrails. Because the tool can query remote services and is designed to progress toward content generation workflows, broad automatic invocation increases the chance of unintended activation, unnecessary data exposure to the remote endpoint, and accidental progression into downstream paid or publishing-related actions despite the description saying those require separate confirmation.

Static analysis

No suspicious patterns detected.