用AI模拟同济子豪兄｜AI-HIVE

• Outcome: Review
• Latest audit: Sep 3, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese AI-HIVE workflow for studying public content methods and creating user-owned content, with network/API-key use and possible paid media generation clearly tied to that purpose.

Install only if you intend to connect to AI-HIVE for this Chinese-language content workflow. Prefer OAuth or a client secret store, do not paste real API keys into prompts or files, do not override AI_HIVE_MCP_URL or AI_HIVE_BASE_URL unless you control the endpoint, and confirm budget, model, quantity, rights to uploaded material, and no-impersonation checks before any paid or public output.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tainted flow: 'req' from os.environ.get (line 24, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url += "?" + urllib.parse.urlencode({"modelType": args.type})
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.load(resp)
    except Exception as exc:
        raise SystemExit(f"模型查询失败：{exc}") from exc

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def fetch_json(url: str) -> dict:
    request = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.loads(response.read().decode("utf-8"))

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 90% confidence
• Finding: The script posts credentials from environment variables to MCP_URL, which is also environment-configurable. If a user runs the helper with AI_HIVE_API_KEY or AI_HIVE_ACCESS_TOKEN set and MCP_URL overridden to an attacker-controlled endpoint, the script will transmit those secrets to that remote server, causing credential exfiltration or SSRF-like outbound access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose focuses on content-methodology analysis, but the embedded instructions also enable remote MCP connection, OAuth/API-key handling, tool enumeration, and arbitrary tool invocation. This mismatch is dangerous because users may approve a seemingly harmless research/content skill without expecting credential use, remote actions, or potentially billable operations, creating a pathway for secret misuse, unauthorized network activity, or unexpected charges.

Ae1

High

• Category: analysis-evasion

Content

更完整的客户端配置、重新授权、解绑和错误说明见 [MCP 登录与绑定指南](references/mcp-binding.md)。可复制的无密钥配置见 [OAuth 示例](references/mcp-config.example.json) 与 [API Key 示例](references/mcp-config-

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documents executable behaviors involving environment variables, local files, and networked MCP/API interactions, but it does not declare an explicit tool/permission scope. That creates a least-privilege gap: users and hosting agents may not realize the skill can access credentials, read/write files, or reach remote services, increasing the chance of overbroad execution or unintended secret exposure.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The manifest sets `language: zh-CN`, and the skill content is written entirely in Chinese without offering an alternative language or making clear that the locale is optional. Under the policy rule, forcing a specific language/locale without user opt-in can be a natural-language policy violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The display name, description, and default prompt are all written to operate in Chinese, and the file provides no indication that users may choose another language or opt in to this locale. That can violate language/locale policy when a skill imposes a specific language without explicit user choice.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default prompt automatically invokes the skill with a broad phrase and no explicit scope limits, exclusions, or user-consent guardrails. Because this skill concerns simulating a named public figure’s style and building derivative content pipelines, a permissive trigger increases the chance of unintended activation for adjacent queries, which can lead to impersonation-adjacent, copyright-sensitive, or policy-sensitive outputs without sufficient narrowing.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code includes user-facing error text in Chinese, and the CLI description/help text elsewhere is also Chinese-only. For a general-purpose diagnostic/client script, forcing one language without opt-in is a natural-language locale policy issue under the stated rule.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: This JSON manifest defines an MCP server endpoint but provides no contextual description of when or how it should be invoked. For manifest files, missing specificity around trigger scope or constraints can lead to ambiguous integration behavior because no limiting context or exclusions are documented here.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:214