ClawHub
Back to skill

Security audit

电商产品视觉全案生成｜AI-HIVE原创工作流

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with AI-HIVE advertising generation, but it needs review because its helper can send credentials to an environment-selected MCP URL and its MCP/tool scope is broad.

Review the helper before installing. Use OAuth through a trusted MCP client when possible, do not set AI_HIVE_MCP_URL unless you fully trust the destination, avoid supplying AI_HIVE_ACCESS_TOKEN on the command line, and confirm model, cost, and destination before any upload, generation, bulk action, sending, or publishing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ai_hive_mcp.py:19
Finding

Unrestricted MCP Endpoint Override Can Expose Authentication Credentials

Content
View full analysis

Vulnerability Details

File Location: scripts/ai_hive_mcp.py, lines 19 and 47–71
Vulnerability Type: Credential disclosure through an unvalidated network destination
Risk Level: High

Vulnerable Code

python
MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")
python
def auth_headers() -> dict[str, str]:
    key = os.environ.get("AI_HIVE_API_KEY", "").strip()
    token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip()
    if token:
        return {"authorization": f"Bearer {token}"}
    if key:
        return {"x-ai-hive-api-key": key}
    raise SystemExit(
        "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 "
        "AI_HIVE_API_KEY，或仅运行 doctor。"
    )


def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]:
    headers = {
        "content-type": "application/json",
        "accept": "application/json, text/event-stream",
        **auth_headers(),
    }
    if session_id:
        headers["mcp-session-id"] = session_id
    request = urllib.request.Request(
        MCP_URL,
        data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
        headers=headers,
        method="POST",
    )

Technical Analysis

The MCP destination is taken directly from the AI_HIVE_MCP_URL environment variable without validating its scheme, hostname, port, or path. The post() function independently obtains an API key or OAuth access token and automatically places it in the request headers sent to that configurable destination.

Consequently, the code does not bind AI-HIVE credentials to the intended origin, https://ai-hive.iclip.cn. Any party capable of influencing the process environment or launch configuration can redirect authenticated MCP requests to another server. HTTPS alone does not prevent this issue because an attacker-controlled HTTPS server can possess its own valid certificate.

This flexibility exceeds the minimum privileges required by the declared fun ...[truncated 1374 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the AI_HIVE_MCP_URL override if custom endpoints are not essential:
python
MCP_URL = "https://ai-hive.iclip.cn/api/mcp"

  1. If configurability is required, parse and strictly validate the URL before constructing an authenticated request:

    • Require https.
    • Allowlist ai-hive.iclip.cn.
    • Reject embedded user information, unexpected ports, fragments, and malformed hosts.
    • Prefer an exact allowed origin and path.

  2. Bind credentials to an approved origin and refuse to add authentication headers for any other destination.

  3. Disable automatic cross-origin redirects for authenticated requests, or verify every redirect target before forwarding credentials.

  4. Require a separate, explicit opt-in for custom development endpoints. Do not reuse production credentials with them; require dedicated test credentials.

  5. Document that AI_HIVE_MCP_URL is security-sensitive and must not be accepted from untrusted project-level environment files, wrappers, or CI variables.

  6. Add automated tests confirming that:

    • HTTP endpoints are rejected.
    • Lookalike and subdomain-confusion hosts are rejected.
    • Alternate ports and user-info URLs are rejected.
    • Authentication headers are never sent after a cross-origin redirect.
    • The documented AI-HIVE HTTPS endpoint remains functional.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ai_hive_mcp.py (reported line 28)May include surrounding context.

python
def fetch_json(url: str) -> dict:
    request = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.loads(response.read().decode("utf-8"))

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The script allows AI_HIVE_MCP_URL from the environment to override the default server, then sends authentication material from AI_HIVE_API_KEY or AI_HIVE_ACCESS_TOKEN to that URL in post(). If an attacker can influence the environment or wrapper configuration, they can redirect requests to a malicious endpoint and exfiltrate credentials or induce calls to an untrusted remote service.

Content

Scanner excerpt · scripts/ai_hive_mcp.py (reported line 74)May include surrounding context.

python
method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose is a narrowly scoped e-commerce ad-generation workflow with confirmation gates, but the embedded operational content acts more like a generic MCP connection and tool invocation guide. That mismatch is dangerous because agents or users may trust the declared restrictions while the actual behavior enables broader remote tool access, and the promised safeguards for sending/publication are not concretely enforced.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-binding.md (reported line 63)May include surrounding context.

md
## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-binding.md (reported line 102)May include surrounding context.

md
## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill exposes operational guidance and runnable examples that use environment variables, local file IO, and network access to an external MCP endpoint, but it does not declare any explicit tool scope or allowed-tools boundary. In practice this weakens least-privilege controls and makes it easier for a host agent to invoke broader capabilities than users would expect from an advertising workflow, especially when the skill also includes generic tool-calling instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest sets language: zh-CN, and the skill content is written entirely in Chinese, but there is no indication that users may choose another language or that the skill is restricted to a China-specific compliance or regulatory context. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enables implicit invocation for a workflow that can access a remote MCP service and perform advertising-related content generation, while the trigger description is broad and lacks exclusion conditions. This increases the chance the agent auto-invokes the skill in loosely related contexts, causing unintended third-party data disclosure to the MCP or nudging users into content-generation flows they did not explicitly request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document presents all operational instructions in a single language and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This code file contains multiple user-facing error and help messages in Chinese, beginning here, but provides no user opt-in or configurable locale selection. That creates a natural-language policy concern because the skill effectively enforces a specific language for interaction regardless of user preference.

Content

No source excerpt is available for this finding.