ClawHub
Back to skill

Security audit

90s魔法少女动画｜AI-HIVE原创工作流

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its AI-HIVE animation purpose, but its helper script can send credentials to an environment-selected MCP endpoint and its automatic activation scope is broad.

Install only if you intend to use AI-HIVE for this animation workflow. Prefer OAuth through a trusted MCP client or a scoped API key, verify the MCP URL is exactly the AI-HIVE endpoint before running the helper, do not set AI_HIVE_MCP_URL unless you fully trust the destination, and require explicit confirmation before uploads, paid generation, batch work, sending, or public posting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:
Confidence
90% confidence
Finding
The script builds authenticated HTTP requests to an MCP endpoint whose URL is taken from the AI_HIVE_MCP_URL environment variable. A malicious or compromised environment can redirect requests, causing API keys or bearer tokens from environment variables to be sent to an attacker-controlled server and enabling arbitrary remote tool invocation under those credentials.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs use of networked MCP endpoints, local scripts, environment variables, and file read/write workflows, but the skill metadata declares no permissions. This creates a transparency and policy-enforcement gap: an agent or runtime may execute capabilities the user or platform has not explicitly approved, increasing risk of unintended network access, local file modification, or secret handling.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The helper exposes a generic tools/call path for any MCP tool name, while only gating non-read-only tools behind a broad --confirm-paid flag. That does not enforce the skill's stated workflow constraints around sending, publication, batching, or other side effects, so users or downstream agents can invoke sensitive remote capabilities outside the intended safety policy.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger description includes broad terms such as AI images, AI video, short-video production, and anime/game content, which can cause the skill to activate for loosely related requests. Over-broad activation is risky because this skill contains operational instructions for external tools and file/network workflows, so accidental invocation could expose users to unnecessary capability use or inappropriate routing.

Vague Triggers

Low
Confidence
78% confidence
Finding
The search tags contain generic discovery terms like graphic design, Vlog, image generation, video generation, and AIGC without strong boundary language. This increases the chance of mis-triggering the skill in contexts broader than its intended use, which is less severe than code execution issues but still weakens safe scoping.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill enables implicit invocation, but the trigger scope is broad and described only by high-level user intents like making 90s magical-girl animation or related AI media tasks. This can cause the skill to auto-activate in loosely related conversations and route user requests to an external MCP service without sufficiently precise boundaries, increasing the chance of unintended tool use or data exposure.

Static analysis

No suspicious patterns detected.