ClawHub
Back to skill

Security audit

新品视觉TVC广告宣传｜AI-HIVE原创工作流

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for AI-HIVE advertising generation, but its helper can send API credentials to an environment-overridden MCP URL, which needs review before installation.

Review before installing. Use OAuth through the MCP client when possible, keep API keys in a proper secret store, and do not run the helper with AI_HIVE_MCP_URL set unless you deliberately intend to trust that endpoint with your AI-HIVE credentials. Confirm model, cost, and publishing actions separately.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:
Confidence
96% confidence
Finding
`post()` sends authentication headers built from `AI_HIVE_API_KEY` or `AI_HIVE_ACCESS_TOKEN` to `MCP_URL`, which is overrideable via the `AI_HIVE_MCP_URL` environment variable. If an attacker can influence that environment variable or execution environment, they can redirect requests to an arbitrary server and capture the API key or bearer token, causing credential exfiltration and unauthorized API use.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs use of network access, environment-backed credentials, and local file read/write via scripts and MCP connection examples, but no explicit permissions are declared. This creates a capability/expectation mismatch: a host or reviewer may underestimate what the skill can cause a connected agent to do, including contacting external services and handling secrets or local files.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill enables implicit invocation while only describing broad, marketing-related usage in natural language, without any machine-enforced trigger constraints. This can cause the agent to auto-select the skill for loosely related prompts and reach an external MCP service unexpectedly, increasing the chance of unplanned data sharing or unintended ad-generation workflows.

Static analysis

No suspicious patterns detected.