8bit 像素复古街机导演｜AI-HIVE原创工作流

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed AI-HIVE creative workflow, but it should be reviewed because its helper script can send credentials to an environment-controlled MCP endpoint.

Review before installing. Use OAuth through the official client flow when possible, avoid setting AI_HIVE_MCP_URL, revoke any AI-HIVE key or token that may have been used with an untrusted endpoint, and require explicit confirmation before any paid generation, upload, batch action, sending, or publication.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ai_hive_mcp.py:19

Finding

Credential Exfiltration Through an Unvalidated MCP Endpoint Override

Content

View full analysis

Vulnerability Details

File Location: scripts/ai_hive_mcp.py, lines 19 and 47–74
Vulnerability Type: Unvalidated destination for authenticated network requests
Risk Level: High

Vulnerable Code

python

MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")

python

def auth_headers() -> dict[str, str]:
    key = os.environ.get("AI_HIVE_API_KEY", "").strip()
    token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip()
    if token:
        return {"authorization": f"Bearer {token}"}
    if key:
        return {"x-ai-hive-api-key": key}
    raise SystemExit(
        "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 "
        "AI_HIVE_API_KEY，或仅运行 doctor。"
    )


def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]:
    headers = {
        "content-type": "application/json",
        "accept": "application/json, text/event-stream",
        **auth_headers(),
    }
    if session_id:
        headers["mcp-session-id"] = session_id
    request = urllib.request.Request(
        MCP_URL,
        data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
        headers=headers,
        method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:

Technical Analysis

The authenticated MCP destination is taken directly from the AI_HIVE_MCP_URL environment variable without validating its scheme, hostname, port, path, or origin. The post() function then unconditionally attaches either the AI_HIVE_ACCESS_TOKEN bearer token or the AI_HIVE_API_KEY header to requests sent to that destination.

Consequently, anyone able to influence the process environment can redirect authenticated requests away from the declared AI-HIVE service. The implementation does not require HTTPS, enforce an allowlist, or explicitly prevent credentials from being forwarded across redirects.

Although network access is necessary for the Skill's declared remote gener ...[truncated 1868 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin authenticated requests to the declared endpoint:

   python

   MCP_URL = "https://ai-hive.iclip.cn/api/mcp"
   

2. If endpoint overrides are operationally required, make them an explicit development-only option and validate the parsed URL:

   • Require https.
   • Require the exact allowlisted hostname.
   • Reject embedded user information.
   • Restrict ports and paths.
   • Reject malformed or non-network URL schemes.

3. Disable automatic redirects for authenticated requests or validate every redirect target before following it. Never forward credentials when the destination origin changes.

4. Separate destination validation from request construction and fail closed before calling auth_headers().

5. Add regression tests confirming rejection of:

   • Plain HTTP endpoints.
   • Foreign hostnames.
   • Look-alike and suffix-confusion domains.
   • URLs containing user information.
   • Unexpected ports or paths.
   • Cross-origin redirects.

6. Document that production users must not override the MCP endpoint and should revoke credentials immediately if an untrusted endpoint may have received them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ai_hive_mcp.py (reported line 28)May include surrounding context.

python

def fetch_json(url: str) -> dict:
    request = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.loads(response.read().decode("utf-8"))

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The script allows AI_HIVE_MCP_URL from the environment to control the destination of authenticated POST requests, and auth_headers attaches either an API key or bearer token. In a compromised or untrusted runtime, an attacker could point MCP_URL to an arbitrary server and cause credential disclosure or unintended outbound requests, making this an SSRF-style credential exfiltration risk.

Content

Scanner excerpt · scripts/ai_hive_mcp.py (reported line 74)May include surrounding context.

python

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to be a narrowly scoped '8bit retro arcade director' workflow, but the content exposes generic MCP diagnostic and call patterns that can be repurposed to invoke arbitrary tools beyond that declared use case. This mismatch is dangerous because users and orchestrators may trust the description and grant access under false assumptions, while the actual behavior is materially more general and lacks the promised controls around batch actions, sending, publishing, and bounded creative workflow steps.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-binding.md (reported line 63)May include surrounding context.

md

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-binding.md (reported line 102)May include surrounding context.

md

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises executable scripts, environment-variable use, local file writes, and remote MCP/network access, but it does not declare any explicit tool scope such as allowed tools or permissions. That makes the effective capability boundary ambiguous and increases the chance that an agent or runtime grants broader access than users expect, especially given the included generic MCP call examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description says the skill should be used when users search terms like “动漫游戏、AI图片、AI视频、短视频制作”, which are broad, high-frequency topics rather than narrowly identifying this specific workflow. Although the description also names a specific skill, these generic search terms create ambiguity about when the skill should activate versus when other creative/media skills would be more appropriate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables implicit invocation while exposing a broad creative workflow backed by an external MCP service, but it does not provide a narrowly scoped activation condition beyond general creative intents. This can cause the agent to auto-route user requests to the skill in situations the user did not clearly intend, increasing the chance of unintended third-party data sharing or progression into generation workflows that may later involve paid actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code includes user-facing error text in Chinese, and similar Chinese-only messages appear throughout the script. Because the skill does not offer language selection or explain that it is intentionally region-specific, it violates the language/locale policy criterion for forced language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The display name, description, and default prompt are all written to direct the interaction in Chinese, with no indication that users may choose another language or locale. This can violate language/locale policy when no user opt-in or documented locale restriction is provided.

Content

No source excerpt is available for this finding.