ClawHub
Back to skill

Security audit

火柴人破字闯关｜AI-HIVE原创工作流

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a disclosed AI-HIVE animation workflow, but it needs review because broad auto-activation and a helper script could send AI-HIVE credentials to an environment-selected server.

Install only if you intend to use AI-HIVE for this specific workflow. Prefer OAuth, keep API keys in a client secret store, do not set AI_HIVE_MCP_URL unless you fully trust the destination, and separately confirm uploads, paid generation, batching, sending, or publishing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:
Confidence
84% confidence
Finding
The script builds outbound requests to an environment-configurable MCP_URL and attaches either an API key or bearer token from environment variables. If AI_HIVE_MCP_URL is overridden to a malicious endpoint, the helper will transmit those credentials to that host, turning a diagnostic client into a credential exfiltration vector.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs users to use local scripts, environment variables, file I/O, and network access to connect to a remote MCP endpoint, but it declares no corresponding permissions. This mismatch can bypass user or platform expectations about what the skill is capable of, increasing the risk of unintended network calls, local file writes, or secret handling during execution.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger description includes broad intents such as AI images, AI video, short-video production, and anime/game searches, which reach far beyond the narrowly described stick-figure workflow. Overbroad activation can cause the skill to be invoked in unrelated contexts, unexpectedly steering users into external tool usage, networked workflows, or paid-generation paths they did not intend.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The search tags contain many generic discovery terms such as video editing, image generation, short video, AIGC, and AI workflow, making accidental invocation likely outside the intended niche use case. In this skill, that is more dangerous because activation can lead users toward connecting an external MCP service and handling API credentials, amplifying the consequence of a mistaken trigger.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The default prompt hard-codes a broad invocation phrase that can match a wide range of user intents around animation, images, videos, and short-form content creation. In combination with an external MCP tool, this increases the chance of the skill being triggered in contexts the user did not clearly intend, causing unreviewed tool access or unexpected content-generation workflows.

Vague Triggers

Medium
Confidence
92% confidence
Finding
Enabling implicit invocation without precise trigger boundaries allows the platform to auto-select this skill for loosely related requests. Because the skill depends on a remote MCP service for content generation, implicit activation can lead to unintended external requests, confusing user experiences, or accidental progression toward paid or publishing actions despite the description saying those require separate confirmation.

Static analysis

No suspicious patterns detected.