用AI模拟吴恩达｜AI-HIVE

• Outcome: Review
• Latest audit: Sep 2, 2026 · 5:57 PM UTC
• Version: 1.0.0

Overview

The skill discloses its AI-HIVE integration, but it enables a broad authenticated remote tool connection that can upload content and create paid media tasks, so it should be reviewed before use.

Install only if you intend to connect an AI-HIVE account and are comfortable with the agent seeing AI-HIVE tools that can upload materials and create paid image/video/advertising tasks. Prefer OAuth over API keys, avoid setting custom AI_HIVE_MCP_URL or AI_HIVE_BASE_URL values unless you trust the endpoint, confirm budget and model details before generation, and revoke the OAuth grant or API key when finished.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

Tainted flow: 'req' from os.environ.get (line 24, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url += "?" + urllib.parse.urlencode({"modelType": args.type})
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.load(resp)
    except Exception as exc:
        raise SystemExit(f"模型查询失败：{exc}") from exc

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def fetch_json(url: str) -> dict:
    request = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.loads(response.read().decode("utf-8"))

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 90% confidence
• Finding: The script sends authentication material from environment variables to a network endpoint controlled by `AI_HIVE_MCP_URL`, which is also environment-configurable. If an attacker can influence that variable or the execution environment, they can redirect requests and exfiltrate the API key or bearer token to an arbitrary server.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is presented as a methodology/content-analysis workflow around Andrew Ng public materials, but it also instructs the agent to authenticate to a remote MCP endpoint, use API keys or OAuth tokens, enumerate tools, and invoke remote generation functions with possible billing impact. This mismatch is dangerous because users may consent to a research/content skill without realizing it can access protected resources and trigger chargeable external actions.

Ae1

High

• Category: analysis-evasion

Content

更完整的客户端配置、重新授权、解绑和错误说明见 [MCP 登录与绑定指南](references/mcp-binding.md)。可复制的无密钥配置见 [OAuth 示例](references/mcp-config.example.json) 与 [API Key 示例](references/mcp-config-

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is described as supporting analysis and simulation of Andrew Ng’s public methodology, but this file exposes a broad AI-HIVE tool surface including generic image/video/ad-generation workflows. That capability expansion materially increases abuse potential because a user who binds the MCP gains access to monetizable media-generation actions unrelated to the declared educational/analysis purpose. In this context, the mismatch between declared scope and enabled tools is a real security/design issue because it can facilitate undisclosed account use, unexpected billing, and policy circumvention.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill describes capabilities that involve environment variables, local file access, and networked MCP/API interactions, but it does not declare an explicit tool scope or allowlist. That creates an authority boundary problem: an agent or user may not be able to tell what the skill is permitted to access, increasing the chance of unintended file reads, secret exposure, or remote actions beyond the expected content-analysis workflow.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The manifest explicitly sets `language: zh-CN`, and the surrounding document is entirely written as a fixed Chinese-language experience. Under the policy rules, forcing a specific language or locale without offering user choice can be a natural-language policy violation unless the constraint is clearly documented as necessary for a region-specific tool.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The display name, description, and default prompt are all written to operate in Chinese, and the prompt explicitly references a Chinese variant of the skill. There is no indication that the user can choose another language or that the locale restriction is justified as region-specific.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation without any documented trigger constraints, exclusions, or user-confirmation boundaries. That can cause the agent to auto-select this skill for broad Andrew Ng/AI-related queries and unexpectedly route user context to the external ai-hive MCP service, increasing the chance of over-collection, unintended tool use, or brand/identity-simulation workflows being invoked without clear consent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The document instructs users to connect their AI-HIVE account via OAuth or API key, giving the skill access to platform resources and tools. For a skill ostensibly about analyzing public content and building a methodology knowledge base, this account-binding guidance is broader than necessary and creates a real risk of over-privileged integration, user confusion about what is being authorized, and downstream misuse of linked accounts.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The module docstring is entirely in Chinese and serves as the CLI description via argparse, which makes the skill user-facing in a single language. There is no indication that users can choose their language or that the tool is intentionally limited to a China-specific audience for compliance reasons.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest describes a skill for building a public-source sample base, extracting themes and methods from Andrew Ng’s public materials, organizing user-provided materials into a knowledge base, and generating strategy-style content outputs. This file instead implements a generic remote MCP client that inspects OAuth metadata, lists available tools, and invokes arbitrary MCP tools via API key or token, which is infrastructure/transport functionality not reflected in the manifest’s user-facing purpose.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Multiple user-facing error and help strings are written in Chinese, including runtime failures and credential guidance, but the script does not provide any user opt-in or alternative locale. This is a natural-language policy concern because it imposes a specific language on all users regardless of their preferences.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script exposes a generic remote tool-calling primitive with only a minimal paid-call confirmation gate, enabling use of any server-advertised tool under the operator’s credentials. In a skill whose stated purpose is narrow content analysis/simulation, this broader capability increases the blast radius of configuration mistakes, malicious server behavior, or user misuse.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:214