用AI模拟李宏毅｜AI-HIVE

• Outcome: Review
• Latest audit: Sep 3, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for AI-HIVE content generation, but it grants broad authenticated remote MCP access with weak scoping and implicit invocation enabled.

Install only if you intentionally want an AI-HIVE remote MCP integration. Keep API keys in a secret store or environment variable, do not set AI_HIVE_MCP_URL or AI_HIVE_BASE_URL to an untrusted host, avoid uploading private or unauthorized materials, and confirm model, price, quantity, and budget before any media-generation call.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'req' from os.environ.get (line 24, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url += "?" + urllib.parse.urlencode({"modelType": args.type})
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.load(resp)
    except Exception as exc:
        raise SystemExit(f"模型查询失败：{exc}") from exc

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def fetch_json(url: str) -> dict:
    request = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.loads(response.read().decode("utf-8"))

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 90% confidence
• Finding: The script sends authentication material from environment variables to a remote endpoint selected via AI_HIVE_MCP_URL without validating the destination. If an attacker can influence the environment or deployment config, they can redirect the client to an arbitrary server and capture the API key or bearer token.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The advertised purpose is analysis and content generation around public materials, but the included instructions expose a general remote MCP integration flow with OAuth/API-key authentication and the ability to list or call MCP tools. This materially expands the trust boundary: a user expecting a narrow content-analysis skill could be induced to connect credentials and grant broader remote tool access, enabling unintended data access, paid task creation, or misuse of the MCP client functionality.

Ae1

High

• Category: analysis-evasion

Content

更完整的客户端配置、重新授权、解绑和错误说明见 [MCP 登录与绑定指南](references/mcp-binding.md)。可复制的无密钥配置见 [OAuth 示例](references/mcp-config.example.json) 与 [API Key 示例](references/mcp-config-

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes a domain-specific skill for researching public Li Hongyi-related materials, extracting methodology patterns, organizing user-provided materials into a traceable knowledge base, and generating original scripts and content plans. This code instead implements generic MCP endpoint diagnostics, authentication via environment credentials, tool listing, and arbitrary remote tool invocation, with no Li Hongyi-specific processing or knowledge-base/content-generation logic present.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documents code paths that use environment variables, local file access, and network connectivity, but it does not declare an explicit tool/permission scope. That creates a least-privilege gap: a host or reviewer cannot easily constrain what the skill is expected to access, and users may invoke it without understanding that it can read secrets, touch files, and reach remote services.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest sets `language: zh-CN`, and the skill content is written entirely in Chinese without indicating that users may choose another language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The user-facing display name, description, and default prompt are all written in Chinese, and the prompt instructs use in that language without any opt-in or alternative locale path. This creates a natural-language policy concern because the skill appears to enforce a specific language by default rather than offering user choice.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation for a capability that can trigger an external MCP service, but it defines no trigger constraints, exclusions, or confirmation boundaries. This increases the chance the agent will auto-route loosely related user requests to the skill and its third-party tool, causing unintended data disclosure, unwanted external calls, or actions taken without sufficiently explicit user intent.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file includes multiple natural-language error/help strings in Chinese only, such as the runtime error at L040 and CLI/help or exit messages through L165. The policy scope includes code string literals, and the script does not offer the user a language/locale choice or document a justified locale restriction.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script exposes generic remote MCP tool invocation with user-supplied tool names and arguments, which is broader than the stated skill purpose and can trigger unreviewed remote actions. Even with a paid-operation confirmation gate, this creates a capability expansion that could be abused to invoke sensitive or unexpected tools on the remote service.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:214