ClawHub
Back to skill

Security audit

字体动效广告｜AI-HIVE原创工作流

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed AI-HIVE advertising workflow, but it needs review because its helper can send credentials to an environment-selected MCP endpoint and its auto-trigger scope is broad.

Review before installing. Use only the official AI-HIVE endpoint, avoid setting AI_HIVE_MCP_URL unless you fully trust the destination, store API keys in a secret manager or controlled environment, and require explicit confirmation before uploads, paid generation, batch work, sending, or publication.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:
Confidence
86% confidence
Finding
The script posts authenticated requests to `MCP_URL`, which is overrideable via the `AI_HIVE_MCP_URL` environment variable. If that variable is maliciously changed, the script will send the API key or bearer token to an attacker-controlled endpoint, causing credential exfiltration and potentially unauthorized tool execution under the user's account.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documents capabilities to read environment variables, access the filesystem, and make network requests, yet it declares no explicit permissions boundary. That mismatch can hide sensitive operations such as reading API keys, writing local files, or contacting remote services, making it harder for users and platforms to reason about risk and consent.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a narrowly scoped advertising workflow, but the referenced behavior includes acting as a general MCP client that can enumerate remote tools and invoke arbitrary MCP tools, plus writing local planning files. That broader-than-advertised capability materially increases the attack surface because a user may consent to ad generation while the skill can interact with unrelated remote functionality or perform local side effects.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger text is broad enough to activate on generic intents like AI images, AI videos, short-video production, or commercial ads, which extends far beyond the narrowly named 'font motion advertising' use case. Overbroad triggering increases the chance the skill is invoked in inappropriate contexts, causing unnecessary access to networked tools, local files, or paid-generation workflows when a more limited skill should have handled the request.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill enables implicit invocation, but the metadata does not provide a narrowly scoped trigger beyond broad advertising-related requests. Because this skill is connected to an external MCP that can generate marketing content and potentially initiate paid or publication-adjacent workflows, broad auto-invocation increases the chance the agent calls the skill in situations the user did not specifically intend, leading to unnecessary external data sharing or workflow execution.

Static analysis

No suspicious patterns detected.