ClawHub
Back to skill

Security audit

【一镜到底】广告短片｜AI-HIVE原创工作流

Security checks for vulnerabilities and agentic risk

Overview

This AI-HIVE advertising workflow is mostly coherent, but its helper script can send user API credentials to an environment-selected MCP URL and can invoke broadly named remote tools, so it should be reviewed before installation.

Review this skill before installing. Prefer the documented OAuth connection to the official AI-HIVE MCP endpoint. If using an API key, keep AI_HIVE_MCP_URL unset or verify it is exactly the official AI-HIVE URL, do not provide OAuth tokens on the command line, and confirm costs, uploads, generation, batch actions, and publishing separately.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:
Confidence
88% confidence
Finding
The script sends authentication headers derived from environment secrets to MCP_URL, which is overrideable via AI_HIVE_MCP_URL. If an attacker can influence that environment variable, the client will post API keys or bearer tokens to an arbitrary endpoint, causing credential exfiltration and unauthorized use of the user's AI-HIVE account.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill exposes operational capabilities that include environment-variable access, local file read/write, and network access, but does not declare permissions or clearly constrain those capabilities in the manifest. In this context, the markdown explicitly instructs use of API keys, local script execution, and remote MCP access, so a user or host may be unaware of the real trust boundary and grant broader execution than expected.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill is presented as a narrowly scoped advertising workflow, but the referenced behavior includes generic MCP connectivity checks, use of API keys or tokens from the environment, and the ability to invoke arbitrary remote tools through a general JSON-RPC interface. That mismatch is dangerous because users may authorize it expecting a constrained ad-creation assistant, while it can instead act as a broader remote-capable client with access to secrets and local file outputs.

Static analysis

No suspicious patterns detected.