主题变身特效短片｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 5, 2026 · 3:10 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent for AI-HIVE advertising production, but it enables broad/implicit remote MCP use and includes a helper that can send credentials to an environment-overridden endpoint.

Install only if you intentionally want AI-HIVE to handle advertising/image/video production. Use OAuth or a scoped API key, keep secrets in a proper secret store, do not set AI_HIVE_MCP_URL unless you trust the endpoint, and require explicit confirmation before any upload, paid generation, batch action, send, or publication.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:1
• Finding: Prompt Injection via Fixed Advertising/Link Template in SKILL.md## Vulnerability Details **File Location**: /tmp/clawhub-codex-scan-v5712g88emvrgyd6g29atrmp2s8dvkns-elqo65/artifact/SKILL.md (lines 1–152) **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Technical Analysis The SKILL.md file contains a fixed advertising and link template appended at the end of the skill documentation. This pattern constitutes prompt injection: when the skill is loaded, the appended template can alter the agent's instructions, objectives, or outputs by injecting advertising content or external links into the agent's session context. Such injected content can hijack the session's goals or safety boundaries and potentially divert agent responses for marketing or traffic redirection purposes, which is not necessary for the core advertised AI-HIVE workflow functionality. ### Attack Path 1. The agent loads SKILL.md on skill installation or initialization, importing the appended advertising and links into its context. 2. This injected content may influence agent outputs, causing them to include or recommend the advertised product/site, regardless of the user's intent. 3. In a multi-skill environment, this could override or conflict with legitimate session goals or user instructions. ### Impact Assessment - Alters the agent's session behavior, potentially overriding user intent. - Risks undesired commercial bias in outputs, undermining trust and neutrality. - Opens the door to further prompt injection attacks if the template is manipulated. - Impacts all users loading or referencing the skill, regardless of their actual workflow needs.
• Remediation: ## Remediation Suggestions - Remove fixed advertising and link templates from SKILL.md to prevent prompt injection. - Limit SKILL.md to only essential workflow instructions and clear usage boundaries. - If external links are required, place them only in dedicated documentation sections and never in a way that could be automatically appended to the agent's operational context. - Regularly audit skill text for unintentional content injection patterns.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 92% confidence
• Finding: The script sends authentication material from environment variables to an endpoint whose base URL is overridable via AI_HIVE_MCP_URL. An attacker who can influence that environment variable can redirect authenticated requests, causing API key or bearer token exposure to an arbitrary server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs use of network access, local file reads/writes, and environment-based credentials/API keys, but does not declare permissions or capability boundaries. This can cause users or hosting platforms to grant broader access implicitly, reducing auditability and increasing the risk of unintended data exposure, secret leakage, or unreviewed external actions.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The CLI permits invocation of any remote MCP tool name supplied by the user, while the advertised skill scope is limited to ad-production workflows. Even with a paid-confirmation guard, this broad tool proxy can expose capabilities outside the declared user expectation boundary if the backend offers additional sensitive or side-effecting tools.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger terms are broad enough to activate on generic AI image/video or short-video requests, even when the user did not ask for this specific advertising workflow. Overbroad routing can misapply the skill, leading to unnecessary collection of business materials, external tool usage, or actions in a higher-risk commercial-generation context than the user intended.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation with no trigger constraints, so the platform may auto-activate this advertising workflow in loosely related conversations. Because the skill is connected to an external MCP that can generate marketing assets and query live services, unintended invocation can expose user data or initiate downstream actions the user did not clearly request, even though the prompt says not to auto-pay, batch, or publish.

Static analysis

No suspicious patterns detected.