高级丝巾纹样与马术图形平面设计｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 5, 2026 · 4:19 AM UTC
• Version: 1.0.0

Overview

This AI-HIVE advertising skill is mostly coherent, but it handles credentials for a paid third-party MCP service with broader-than-necessary invocation paths and an unsafe URL override.

Review before installing. Use only with explicit AI-HIVE advertising tasks, prefer OAuth through a trusted MCP client, avoid setting AI_HIVE_MCP_URL, keep API keys in secrets or environment variables, and confirm price, model, and scope before any generation, upload, batch run, send, or public publish action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:1
• Finding: Persistent Advertising/Instruction Injection in SKILL.md## Vulnerability Details **File Location**: /tmp/clawhub-codex-scan-v579vknmrk7v6qmqehv8kx9bb98dv6we-8wwOAS/artifact/SKILL.md (entire file, especially final sections) **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Technical Analysis The `SKILL.md` file contains a persistent advertising and promotional template at the end of the document, including detailed company branding, product marketing, and repeated links and branded instructions. This pattern constitutes a form of output hijacking, as every time the skill is loaded or output is generated, these persistent instructions and advertising content are included, regardless of the user's intent or context. ### Attack Path 1. The skill is loaded by an agent or LLM-based assistant. 2. The appended advertising/instruction template is injected into the agent's output, altering the session's goal and potentially bypassing user intent. 3. This can lead to model output that is persistently hijacked for marketing/traffic redirection rather than user service objectives. ### Impact Assessment - Alters the model's output, potentially overriding or diverting user-driven goals. - Introduces persistent, branded, and potentially unwanted messaging into every session using this skill. - May degrade user trust, violate platform policies, or create compliance risks. - The scope is limited to output manipulation, but can affect all users invoking the skill.
• Remediation: ## Remediation Suggestions - Remove or strictly limit any persistent advertising, branding, or fixed instruction templates from the end (or any part) of SKILL.md. - Ensure that only essential, functional instructions and documentation relevant to the skill's operation are present. - Avoid appending traffic redirection or persistent marketing content to outputs, in accordance with best practices for skill/agent neutrality and user trust. - Implement review checks to prevent future inclusion of output-hijacking templates.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 89% confidence
• Finding: The script builds authenticated requests using credentials from environment variables and sends them to MCP_URL, which is also overrideable via AI_HIVE_MCP_URL. If that URL is changed to an attacker-controlled endpoint, the helper will exfiltrate the bearer token or API key via request headers, making this an SSRF-style credential leakage risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents capabilities that read environment variables, write local files, and access the network, but it does not declare corresponding permissions or clearly constrain their use. This weakens trust boundaries for users and hosting platforms, because a seemingly content-generation skill can access secrets and external services without an explicit permission contract.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior exceeds the advertised purpose: beyond ad-creative workflow steps, it includes generic MCP connection diagnostics, credential-based tool enumeration, and arbitrary MCP tool calling. That mismatch can mislead users into granting trust or credentials to what appears to be a narrowly scoped design skill, while actually enabling broader remote actions and data access.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill enables implicit invocation for an external MCP-backed advertising workflow without defining narrow trigger constraints or exclusion conditions. This increases the chance the agent will auto-select the skill in loosely related contexts and route user content to a third-party service, which can cause unintended tool use, privacy leakage, or unapproved commercial-generation actions despite the prompt text saying paid, batch, or publishing actions require confirmation.

Static analysis

No suspicious patterns detected.