原创IP全案设计（潮玩视觉语言）｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 5, 2026 · 3:56 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for AI-HIVE advertising generation, but its helper can send API credentials to an environment-selected MCP URL, which deserves review before use.

Review before installing if you will use API keys. Prefer OAuth or a client-managed secret, do not set AI_HIVE_MCP_URL unless you intend to send credentials to that exact endpoint, and confirm model, price, upload, generation, batch, send, and publishing actions before execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:1
• Finding: Skill Instruction Hijacking via Fixed Advertising/Link Template in SKILL.md## Vulnerability Details **File Location**: SKILL.md (entire file, notably the ending section) **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Technical Analysis The SKILL.md file contains an appended fixed advertising and link template at the end of the skill description. This pattern is indicative of content injection that can alter the output of language models, especially those that consume skill or instruction metadata to modify runtime behavior. By including advertising content or external links, the skill can unintentionally divert user traffic, bias responses, or alter the intended functionality and safety boundaries of the agent session. ### Attack Path 1. SKILL.md is loaded by the agent or LLM-based system as skill metadata or system prompt. 2. The injected advertising/link template is appended to the model's context. 3. The language model may generate outputs containing the injected content, promote external resources, or deviate from intended task boundaries. 4. This can be abused to hijack user attention, promote unauthorized resources, or interfere with task integrity. ### Impact Assessment The injected advertising or link template can alter the agent’s session instructions, causing skill output to be biased, promotional, or outside the scope of the legitimate user task. This undermines the trustworthiness and neutrality of the agent, and may indirectly expose users to phishing or traffic-diversion attacks.
• Remediation: ## Remediation Suggestions - Remove all fixed advertising, external link templates, or promotional content from SKILL.md and any other instruction text that is imported into the agent's execution context. - Audit all agent-facing instruction or metadata files for similar patterns and enforce a strict policy prohibiting output injection or traffic-diversion content. - Implement automated scanning for advertising or link patterns in future skill submissions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 84% confidence
• Finding: The script sends authentication material from environment variables to a network endpoint whose URL is taken from AI_HIVE_MCP_URL without any allowlist or origin validation. If an attacker can influence the environment or execution context, they can redirect requests to an arbitrary server and exfiltrate the API key or bearer token via the request headers.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the user to use local scripts, environment variables, file I/O, and network access (for example, exporting API keys and calling remote MCP endpoints), but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a host or reviewer cannot accurately assess what the skill may access, and users may expose secrets or permit broader execution than expected.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation without any visible trigger constraints, so the platform may activate it in contexts broader than the user explicitly intended. Because this skill connects to an external MCP service capable of generating marketing, image, and video outputs, unintended invocation could cause unreviewed third-party data sharing or steer users into external tool usage without clear consent.

Static analysis

No suspicious patterns detected.