用AI模拟李沐｜AI-HIVE

• Outcome: Review
• Latest audit: Sep 2, 2026 · 5:53 PM UTC
• Version: 1.0.0

Overview

The skill is transparent about using AI-HIVE, but its implicit remote MCP access, credential use, configurable endpoints, and generic tool-calling helper need careful review before installation.

Install only if you intend to connect an AI-HIVE account and are comfortable with the agent using a remote MCP that can upload media and create billable generation tasks. Keep API keys in a secret store or environment variable, do not set AI_HIVE_BASE_URL or AI_HIVE_MCP_URL to untrusted hosts, and require explicit confirmation before uploads, paid tools, batch generation, or public posting.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'req' from os.environ.get (line 24, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url += "?" + urllib.parse.urlencode({"modelType": args.type})
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.load(resp)
    except Exception as exc:
        raise SystemExit(f"模型查询失败：{exc}") from exc

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def fetch_json(url: str) -> dict:
    request = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.loads(response.read().decode("utf-8"))

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 95% confidence
• Finding: The script sends authentication material from environment variables to a remote endpoint whose URL is configurable via AI_HIVE_MCP_URL. If that environment variable is altered to point to an attacker-controlled host, the helper will transmit the API key or bearer token to that host, causing credential exfiltration and enabling unauthorized MCP actions under the victim's account.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose is content research and style/methodology analysis, but the skill also instructs the agent to perform remote MCP discovery, OAuth/API-key authentication, tool enumeration, and arbitrary remote tool invocation. This mismatch is dangerous because users may invoke the skill expecting advisory behavior while it can actually reach external systems and operate authenticated tooling, expanding the attack surface to credential misuse, unintended billing, and data exfiltration.

Ae1

High

• Category: analysis-evasion

Content

更完整的客户端配置、重新授权、解绑和错误说明见 [MCP 登录与绑定指南](references/mcp-binding.md)。可复制的无密钥配置见 [OAuth 示例](references/mcp-config.example.json) 与 [API Key 示例](references/mcp-config-

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill describes capabilities that involve environment variables, local scripts, file access, and networked MCP interactions, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this can lead to overbroad access where the model may read secrets, touch files, or contact remote services beyond what users expect from a content-analysis skill.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation description is very broad, covering many related search phrases and user intents, which can cause the skill to trigger in situations where the user did not intend to authorize this workflow. In a skill with network, file, and credential-adjacent capabilities, overbroad activation increases the chance of accidental tool use, unintended data handling, or confusion about what actions the agent may take.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: L006 在元数据中将 language 固定为 zh-CN，文件整体也以中文提供，但未明确说明这是面向中文用户的可选默认值，或提供其他语言/locale 选择。按规则，强制特定语言而没有用户 opt-in 可能构成语言/地区政策问题。

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The display name, short description, and default prompt are all written in Chinese and instruct operation in that language, with no indication that users may choose another language or locale. This is a natural-language policy concern because the skill appears to impose a specific language experience without user opt-in or a documented regional justification.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file is a generic remote MCP client and diagnostic utility, which is materially broader than the declared skill purpose centered on Li Mu methodology analysis from verified public materials. This capability expansion increases attack surface by enabling remote service interaction and authenticated tool access unrelated to the manifest, undermining least privilege and making misuse or hidden behavior harder to assess.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The CLI allows arbitrary MCP tool invocation by name, with only a minimal paid-call confirmation gate and no allowlist tied to the skill's stated functions. If the remote MCP exposes sensitive, state-changing, or data-access tools, this helper can be used to invoke them outside the manifest's intended Li Mu content-analysis context, potentially leading to unauthorized actions, data exposure, or unexpected charges.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The top-level description is written only in Chinese and presents the skill as operating in that language, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: This code includes user-facing error text in Chinese, and the same pattern continues throughout the CLI messages. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale/language constraint that should be flagged.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:214