ClawHub
Back to skill

Security audit

万物皆战场｜AI-HIVE原创工作流

Security checks for vulnerabilities and agentic risk

Overview

The AI-HIVE workflow is mostly disclosed, but the bundled helper can send user credentials to an environment-selected MCP URL and the skill has a broad activation/tool surface.

Install only if you intend to connect your agent to AI-HIVE for this workflow. Use OAuth or an API key stored in a client secret store, verify the MCP endpoint is https://ai-hive.iclip.cn/api/mcp, avoid setting AI_HIVE_MCP_URL unless you fully trust the destination, and require explicit confirmation before any paid generation, uploads, bulk operations, sending, or publication.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:
Confidence
85% confidence
Finding
The script allows AI_HIVE_MCP_URL from the environment to control the destination of authenticated POST requests, and auth_headers() will attach either a bearer token or API key to that request. If an attacker can influence the environment or execution context, they can redirect requests to an attacker-controlled server and capture credentials or tool-call payloads.

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill instructs use of external MCP/network access, local scripts, environment variables, and local file output, but does not declare permissions or capability boundaries. This creates a trust and review gap: an agent or user may invoke network, env, and file operations without an explicit least-privilege contract, increasing the chance of unintended data exposure, secret handling mistakes, or unsafe tool use.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill is framed as an animation/original-IP workflow, but its only declared dependency is described as also supporting e-commerce, marketing, and advertising generation. That broader capability surface creates unnecessary privilege and increases the chance the agent can be steered into unrelated commercial content generation or externalized actions beyond the user’s expected scope.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The trigger conditions include broad generic terms such as AI images, AI video, short-video production, and anime/game searches, which can cause the skill to activate for unrelated user requests. Overbroad activation increases the chance that the agent steers users into this workflow unnecessarily, leading to unintended network/tool use, confusion, or accidental progression toward billable operations.

Static analysis

No suspicious patterns detected.