次元破壁互动玩法｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 5, 2026 · 4:41 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with its AI-HIVE animation workflow, but it includes under-disclosed credential and routing behavior that should be reviewed before installation.

Install only if you intend to use AI-HIVE for this workflow and are comfortable with an external MCP service receiving your prompts, task details, and authorized tool calls. Prefer OAuth through the official AI-HIVE endpoint, do not set AI_HIVE_MCP_URL unless you fully control and trust the endpoint, keep API keys out of prompts and logs, and require explicit confirmation before any paid, bulk, upload, send, or publish action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 88% confidence
• Finding: The script posts authentication material from environment variables to MCP_URL, and MCP_URL can be overridden via AI_HIVE_MCP_URL. If an attacker can influence the environment or how the skill is launched, API keys or bearer tokens could be sent to an arbitrary remote endpoint, causing credential exfiltration and unauthorized remote tool access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill instructs users to use local scripts, environment variables, file I/O, and remote MCP/network access, but no explicit permissions are declared. This creates a mismatch between advertised behavior and actual capabilities, which can weaken sandboxing or informed-consent controls and increase the chance of unintended data access or outbound requests.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The helper exposes generic tools/list and tools/call operations for whatever the remote MCP server offers, which is broader than the declared animation/content-production workflow. In a skill context, that increases the chance of capability creep, accidental invocation of unrelated or sensitive tools, and misuse if the remote server presents unexpected functionality.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Allowing the MCP endpoint to be replaced via environment variable lets the script authenticate to and interact with arbitrary remote services outside the stated AI-HIVE purpose. Combined with API key or bearer-token support, this can redirect secrets and tool traffic to attacker-controlled infrastructure.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description includes broad trigger phrases such as general animation, AI image, AI video, and short-video terms, so the skill may be auto-invoked for many unrelated requests. That increases the risk of inappropriate activation of a networked, file-capable workflow in contexts where the user did not intend to use this external-tool-integrated skill.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The search tags contain multiple generic discovery terms like image generation, video generation, content marketing, and short video, which can cause the skill to match broad user queries far outside its intended scope. In this skill's context, overbroad routing is more dangerous because the workflow includes external network endpoints, credential handling guidance, and local script/file usage.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation for a workflow that can reach an external MCP service capable of image/video generation and related content operations. Even though the description says paid generation, bulk actions, sending, and publishing require separate confirmation, the trigger conditions are not constrained in policy, so the agent may invoke this skill in broader contexts than intended and expose users to unintended external data sharing or workflow initiation.

Static analysis

No suspicious patterns detected.