开箱测评种草广告视频｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 5, 2026 · 4:04 AM UTC
• Version: 1.0.0

Overview

The skill is broadly coherent with an AI-HIVE advertising workflow, but it handles credentials for a remote MCP service in ways that are broader than the advertised task and not tightly constrained.

Review this before installing if you plan to use AI-HIVE credentials. Prefer OAuth through a trusted MCP client, avoid setting AI_HIVE_MCP_URL, keep API keys in a secret store, and require separate confirmation before any paid generation, upload, batch action, sending, or public publishing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:1
• Finding: Fixed Advertising/Footer Template in SKILL.md Enables Skill Instruction Hijacking## Vulnerability Details **File Location**: /tmp/clawhub-codex-scan-v577rdebprgyb1qh9tjne1kysn8dv7nj-59vOfg/artifact/SKILL.md (lines 1–153) **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Technical Analysis The SKILL.md file contains a large fixed advertising and traffic-diversion template appended at the end of the documentation. This includes direct promotional links, repetitive branding, and output templates that instruct the agent to include specific promotional content and links in its output. Such content can manipulate the agent's response to always promote a particular service—regardless of user intent—or inject unwanted links and tracking templates in generated outputs. This is a classic case of skill instruction hijacking, where the agent's default output is intentionally biased or redirected by static content in the skill description. ### Attack Path 1. The skill is loaded by an agent that consumes the SKILL.md as part of its prompt or context. 2. The appended advertising/footer template is included in the context for generating responses. 3. All or part of this promotional template is reflected in the agent's output to users, potentially bypassing user intent or safety controls. 4. Users are repeatedly shown injected links or advertisements, enabling traffic diversion or data collection. ### Impact Assessment The agent's session can be hijacked to serve persistent advertisements, divert user traffic, or alter expected output. This undermines the agent's neutrality, user trust, and can violate platform content guidelines. It also creates a channel for persistent content injection, which could be extended to more malicious payloads or tracking if the template is modified.
• Remediation: ## Remediation Suggestions - Remove all fixed advertising, promotional links, and output templates that are not directly necessary for the skill's technical function. - Ensure the SKILL.md only documents legitimate functionality and usage, without embedding persistent output templates or traffic-diversion content. - Add a review process to detect and reject skills with appended advertising, tracking, or similar instruction-hijacking content.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ai_hive_mcp.py:1
• Finding: Potential Exposure of Sensitive API Keys Over Network in ai_hive_mcp.py## Vulnerability Details **File Location**: /tmp/clawhub-codex-scan-v577rdebprgyb1qh9tjne1kysn8dv7nj-59vOfg/artifact/scripts/ai_hive_mcp.py (lines 1–176) **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Technical Analysis The script scripts/ai_hive_mcp.py is designed to interact with the AI-HIVE MCP remote API. It collects sensitive credentials (API keys or OAuth tokens) from environment variables (AI_HIVE_API_KEY, AI_HIVE_ACCESS_TOKEN) and sends them as HTTP headers (x-ai-hive-api-key or Authorization: Bearer …) in API requests. While this is a standard approach for authenticated API interactions, it constitutes a risk if the script is not secured: - If the environment variables are set in insecure contexts, or the script is invoked in a way that leaks environment variables (e.g., via logs, crash reports, or subprocesses), API keys may be exposed. - The script does not perform any additional validation or warning before sending potentially sensitive keys over the network, nor does it restrict endpoints or issue warnings in case of misconfiguration. - The SKILL.md documentation instructs users to never embed API keys directly, but the script’s design could lead to accidental exposure if misused or integrated into a broader workflow without appropriate controls. ### Attack Path 1. User sets AI_HIVE_API_KEY or AI_HIVE_ACCESS_TOKEN in the environment, as instructed. 2. The script is executed, reading these variables and transmitting them in HTTP headers to the remote MCP endpoint. 3. If the endpoint is compromised, misconfigured, or if MitM is possible (e.g., due to lack of TLS verification), API keys could be intercepted. 4. If logs or error messages capture the environment or command invocation, keys could be leaked unintentionally. ### Impact Assessment Exposure of API keys or tokens allows attackers to impersonate the user, perform actions (potentially billable), or access sensitive data via ...[truncated 140 chars]
• Remediation: ## Remediation Suggestions - Implement stricter controls and clear warnings in the script when handling sensitive credentials. - Ensure all network communications enforce TLS with certificate validation; reject connections to non-HTTPS endpoints. - Avoid logging, printing, or exposing environment variables or credential values in any output. - Consider using credential managers or prompting users for sensitive values at runtime (not via environment) where feasible. - Document best practices and potential risks in both code and supporting documentation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 89% confidence
• Finding: The script sends authentication material from environment variables to an endpoint whose base URL is controlled by AI_HIVE_MCP_URL. If an attacker can influence that environment variable, they can redirect requests and exfiltrate the API key or bearer token to an arbitrary server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises only a content-generation workflow, but the embedded operational guidance and code references imply broader capabilities: reading environment variables for credentials, local file I/O, and outbound network access to a remote MCP endpoint. When a skill exposes these capabilities without explicitly declaring permissions or tightly constraining usage, users and host systems may underestimate what the skill can access or transmit, increasing the risk of credential misuse, unintended data disclosure, or unauthorized remote actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a real description-behavior mismatch: the skill is presented as a narrowly scoped advertising workflow, yet its instructions expose a generic remote MCP client pattern capable of listing all tools, performing remote diagnostics, and invoking arbitrary AI-HIVE tools using API keys or access tokens from the environment. That broader operational surface makes the skill more dangerous because a user may grant trust and credentials expecting limited ad-generation behavior, while the skill can facilitate much more expansive remote interaction than disclosed.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill enables implicit invocation for a capability that can query external services and drive advertising-content generation workflows, but it defines no explicit trigger phrases, domain boundaries, or confirmation gates beyond a natural-language prompt. This increases the chance the agent will invoke the skill in loosely related conversations and route user context to the external MCP endpoint unexpectedly, creating risks of unintended data disclosure, unwanted tool use, and workflow escalation toward paid or publishing actions.

Static analysis

No suspicious patterns detected.