多宫格生视频｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 5, 2026 · 3:13 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a disclosed AI-HIVE advertising workflow, but its helper script can send credentials to an environment-selected MCP URL and can invoke broad remote MCP tools, so it should be reviewed before installation.

Install only if you intend to connect this agent to AI-HIVE for advertising media generation. Prefer OAuth through the client UI, keep API keys in a secret store, do not set AI_HIVE_MCP_URL unless you fully trust the destination, and require explicit confirmation before uploads, paid generation, bulk actions, or publishing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:1
• Finding: Skill Instruction Hijacking via Prompt/Content Injection in SKILL.md## Vulnerability Details **File Location**: /tmp/clawhub-codex-scan-v57dmjtj67t6zjndxbqesw290h8dvntk-PdawIY/artifact/SKILL.md (entire file, lines 1-155) **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Technical Analysis The SKILL.md file contains extensive fixed branding, marketing, and workflow content that is automatically injected into the agent’s runtime prompt or context when the skill is loaded. This includes explicit commercial references, external links, and detailed workflow instructions. The use of persistent, non-task-specific advertising, and explicit branded call-to-actions, can override or bias the agent's goals, alter the intent of neutral user queries, and potentially divert traffic or session control to an external branded service. This content is automatically exposed to the agent prompt and may alter, hijack, or bias the agent's reasoning and task execution, especially if the agent relies on SKILL.md as a primary instruction source. ### Attack Path 1. The agent loads the skill, which includes all content from SKILL.md into its prompt/session context. 2. The injected content establishes explicit agent behaviors, external references, and persistent branded goals, potentially overriding default safety, neutrality, or user intent. 3. If a user asks an otherwise unrelated question, the agent may be led to promote, redirect, or prioritize the external branded service due to the injected instructions. ### Impact Assessment - May cause the agent to deviate from user intent, prioritize external services, or leak session context via generated outputs. - Could undermine agent neutrality, trust, or compliance with platform policies. - The issue is persistent and will affect all sessions using this skill unless removed.
• Remediation: ## Remediation Suggestions - Remove persistent advertising, external links, and non-task-specific branding from SKILL.md. - Limit SKILL.md content to only the minimum necessary workflow or instruction set for task execution. - Clearly separate functional task instructions from marketing or branding to prevent prompt/context pollution. - Implement a review process to detect and strip content-injection patterns before deployment.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 89% confidence
• Finding: The script allows the MCP endpoint URL to be overridden via the AI_HIVE_MCP_URL environment variable and then sends authentication headers containing either an API key or bearer token to that endpoint. If an attacker can influence the environment or wrapper configuration, they can redirect requests to an attacker-controlled server and capture credentials, making this a real SSRF/credential-exfiltration risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents capabilities that use environment variables, local file read/write, and network access, but it does not declare equivalent permissions or boundaries. This creates a transparency and policy-enforcement gap: a host or reviewer may treat the skill as lower risk than it is, while the skill can still access credentials, write artifacts locally, and communicate with a remote MCP endpoint.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a focused advertising workflow, but the documented behavior includes generic MCP connectivity checks, credential-based tool listing, arbitrary MCP tool invocation, and local file generation. That mismatch is dangerous because users may consent to a narrow content-creation task while the skill effectively gains broader operational reach, including remote actions and local side effects beyond the advertised scope.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill enables implicit invocation for a workflow that can connect to an external MCP service and drive advertising/image/video generation. Even though the prompt says not to auto-pay, batch, or publish, implicit triggering without tight scope increases the chance the skill is invoked in unrelated contexts, causing unintended data exposure to the remote service or undesired tool-assisted actions before the user clearly consents.

Static analysis

No suspicious patterns detected.