温暖农场生活像素游戏短片｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:32 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed AI-HIVE video-generation workflow, but its helper can send credentials to an arbitrary endpoint if an environment override is set.

Review before installing. Use the documented AI-HIVE endpoint only, avoid setting AI_HIVE_MCP_URL, store API keys in a proper secret store, and confirm model choice, price, generation count, uploads, publishing, and any non-read-only tool call before proceeding.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ai_hive_mcp.py:19

Finding

Unvalidated MCP endpoint override can disclose credentials and task data

Content

View full analysis

Vulnerability Details

File Location: scripts/ai_hive_mcp.py:19, 47-72
Vulnerability Type: Unvalidated security-sensitive endpoint configuration
Risk Level: Medium

Vulnerable Code

python

MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")

python

def auth_headers() -> dict[str, str]:
    key = os.environ.get("AI_HIVE_API_KEY", "").strip()
    token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip()
    if token:
        return {"authorization": f"Bearer {token}"}
    if key:
        return {"x-ai-hive-api-key": key}
    raise SystemExit(
        "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 "
        "AI_HIVE_API_KEY，或仅运行 doctor。"
    )


def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]:
    headers = {
        "content-type": "application/json",
        "accept": "application/json, text/event-stream",
        **auth_headers(),
    }
    if session_id:
        headers["mcp-session-id"] = session_id
    request = urllib.request.Request(
        MCP_URL,
        data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
        headers=headers,
        method="POST",
    )

Technical Analysis

The MCP destination is taken directly from the AI_HIVE_MCP_URL environment variable. The value is not validated against the Skill's declared endpoint, https://ai-hive.iclip.cn/api/mcp, and there is no requirement that it use HTTPS.

The post() function unconditionally adds either the bearer access token or AI-HIVE API key to requests sent to that configured destination. It also sends MCP initialization data and subsequent tool-call arguments to the same destination. Consequently, an attacker who can influence the process environment can redirect security-sensitive requests to an arbitrary server.

This behavior exceeds the minimum privilege required by the declared functionality. The Skil ...[truncated 1739 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the AI_HIVE_MCP_URL override if custom endpoints are not an explicit requirement:

   python

   MCP_URL = "https://ai-hive.iclip.cn/api/mcp"
   

2. If endpoint configurability is required, validate the parsed URL before attaching credentials:

   • Require the https scheme.
   • Require the exact approved hostname ai-hive.iclip.cn.
   • Require the expected /api/mcp path.
   • Reject embedded user information, unexpected ports, fragments, and ambiguous hostnames.

3. Separate endpoint selection from credential forwarding. Authentication headers should only be added after the destination has passed the allowlist check.

4. Disable automatic redirects or validate every redirect destination before forwarding credentials. Reject cross-origin redirects.

5. Emit a clear error when the endpoint does not match the approved service rather than silently accepting an override.

6. Add tests covering plain HTTP, lookalike domains, alternate ports, user-information syntax, malformed URLs, and cross-origin redirects.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ai_hive_mcp.py (reported line 28)May include surrounding context.

python

def fetch_json(url: str) -> dict:
    request = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.loads(response.read().decode("utf-8"))

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The script allows the MCP endpoint URL to be overridden via the AI_HIVE_MCP_URL environment variable, then sends authentication headers containing either an API key or bearer token to that URL. If an attacker can influence the environment or execution context, they can redirect requests to an attacker-controlled server and exfiltrate credentials or induce authenticated requests to an unintended destination.

Content

Scanner excerpt · scripts/ai_hive_mcp.py (reported line 74)May include surrounding context.

python

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a narrow, domain-specific creative workflow, but the referenced behavior is a generic MCP client/diagnostics capability that can inspect connectivity and call arbitrary MCP tools. That mismatch is dangerous because users may authorize or invoke the skill believing it is limited to storyboard/video assistance, when in practice it may enable much broader remote operations than disclosed.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-binding.md (reported line 63)May include surrounding context.

md

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-binding.md (reported line 102)May include surrounding context.

md

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares no explicit tool scope while instructing use of scripts and an MCP endpoint with capabilities consistent with environment access, local file read/write, and network operations. In an agent ecosystem, missing least-privilege boundaries can let the skill exercise broader capabilities than users would expect, increasing the chance of data exposure, unintended file modification, or unauthorized remote actions if the surrounding runtime grants those powers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description says the skill should be used when users search for broad terms such as “动漫游戏”, “AI图片”, “AI视频”, and “短视频制作”. These phrases are much broader than the skill’s narrowly defined purpose and could cause the skill to activate for many unrelated animation, image, or video requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The metadata sets language: zh-CN, and the document presents the skill entirely in Simplified Chinese without indicating that users may choose another language. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enables implicit invocation while exposing a broad creative workflow backed by an external MCP service, but its activation scope is not tightly constrained in the policy itself. This can cause the agent to auto-select the skill for loosely related user requests, increasing the chance of unintended third-party tool access, data disclosure in prompts, or unreviewed progression into generation workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may choose another language. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code file contains multiple hard-coded Chinese user-facing strings, starting here, for errors and CLI help. Because the script does not offer a language/locale choice or explain that it is intentionally limited to Chinese users, it violates the natural-language locale policy described in SQP-3.

Content

No source excerpt is available for this finding.