AI-HIVE 多模态创意工具箱

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:18 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for AI-HIVE media generation, but it stores API credentials and can send them to arbitrary configured API endpoints, so it needs review before use.

Review before installing if you will use a real AI-HIVE API key. Use only the default official AI-HIVE HTTPS endpoint unless you fully trust a custom endpoint, avoid setting AI_HIVE_BASE_URL from untrusted instructions, and consider using a limited or low-balance API key because generation may be billable and uploaded media is sent to the service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/imagegen.py:93

Finding

Arbitrary API Base URL Can Exfiltrate the AI-HIVE Bearer Token in imagegen.py

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:93

Finding

Arbitrary API Base URL Can Exfiltrate the AI-HIVE Bearer Token in videogen.py

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This variant of the mismatch finding includes undeclared behaviors such as opening a browser, storing credentials locally in ~/.ai-hive/config.json, and querying user account or wallet information. Undeclared credential storage and account-data access are security-relevant because users and orchestrators may not expect sensitive local state changes or exposure of billing-related information from a content-generation skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant of the mismatch finding includes undeclared behaviors such as opening a browser, storing credentials locally in ~/.ai-hive/config.json, and querying user account or wallet information. Undeclared credential storage and account-data access are security-relevant because users and orchestrators may not expect sensitive local state changes or exposure of billing-related information from a content-generation skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant of the mismatch finding includes undeclared behaviors such as opening a browser, storing credentials locally in ~/.ai-hive/config.json, and querying user account or wallet information. Undeclared credential storage and account-data access are security-relevant because users and orchestrators may not expect sensitive local state changes or exposure of billing-related information from a content-generation skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This variant of the mismatch finding includes undeclared behaviors such as opening a browser, storing credentials locally in ~/.ai-hive/config.json, and querying user account or wallet information. Undeclared credential storage and account-data access are security-relevant because users and orchestrators may not expect sensitive local state changes or exposure of billing-related information from a content-generation skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises and demonstrates capabilities that involve environment variables, filesystem access, network requests, and shell execution, but it does not declare any tool scope or permission boundaries. In an agent setting, missing explicit constraints can lead to overbroad tool access, making it easier for downstream automation to invoke sensitive operations without clear review or least-privilege controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description defines invocation in Chinese terms such as “AI-HIVE、多模态AI、图片生成、视频生成、电商AIGC” and frames the skill entirely around Chinese-language usage. Because there is no stated opt-in or alternative language handling, this can create a language/locale policy issue for users operating in other languages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The “什么时候使用” section gives all invocation guidance in Chinese and does not indicate whether the skill is restricted to Chinese-language workflows or whether other languages are supported. Under the policy, forcing a specific language without opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The default prompt explicitly requires a production-ready Chinese workflow, which imposes a language choice on the user. The file does not offer opt-in language selection or explain why Chinese is required for this skill, creating a potential language-policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest enables implicit invocation (allow_implicit_invocation: true) without any visible trigger scoping, approval gating, or narrow activation criteria. For a skill that can produce executable workflows and AI-HIVE commands, broad auto-invocation increases the chance the agent routes user requests into this capability unexpectedly, which can cause overbroad actions, undesired content generation, or policy bypass through unintended tool selection.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/edit_video.py (reported line 20)May include surrounding context.

python

def run(args: list[str]) -> None:
    print(" ".join(args))
    subprocess.run(args, check=True)


def main() -> None:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest centers this skill on a multimodal creative toolkit for routing, image/video generation, uploads, polling, and delivery. However, the file also implements generic text chat, user-info retrieval, and model inventory functions, which go beyond the image-focused skill wrapper and broaden the operational scope beyond the stated creative-generation purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing CLI guidance are written in Chinese, presenting the tool as a general-purpose skill without documenting a locale restriction or providing an opt-in language choice. For a broadly scoped skill, this is a natural-language locale policy concern because it effectively forces one language for setup and operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file embeds Chinese-language skill naming and user-facing defaults such as 'AI-HIVE 多模态创意工具箱' and '待确认' in the CLI description and generated output. Because the skill presents a fixed locale/language with no opt-in or alternative, it may conflict with language/locale policy requirements.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes a creative production skill that receives inputs and uses the AI-HIVE API for configuration lookup, upload, routing, polling, and download. Launching a local browser is an auxiliary user-environment control action rather than a direct content-generation capability, and the manifest does not mention controlling local applications for setup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and subsequent user-facing CLI text are written entirely in Chinese, establishing a fixed language for interaction. The policy requires avoiding forced language or locale constraints unless the skill offers user choice or clearly documents a justified regional constraint, which this file does not.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.