用AI模拟王木头学科学｜AI-HIVE

• Outcome: Review
• Latest audit: Sep 2, 2026 · 5:54 PM UTC
• Version: 1.0.0

Overview

The skill is largely disclosed as an AI-HIVE content workflow, but it includes credentialed remote tool access that is broader and more configurable than a user may expect.

Review before installing. Use it only if you intend to connect AI-HIVE, keep API keys in a client secret store or local environment, do not set custom AI_HIVE_MCP_URL or AI_HIVE_BASE_URL unless you fully trust the endpoint, and require explicit confirmation before uploads or paid generation tasks.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'req' from os.environ.get (line 24, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url += "?" + urllib.parse.urlencode({"modelType": args.type})
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.load(resp)
    except Exception as exc:
        raise SystemExit(f"模型查询失败：{exc}") from exc

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

def fetch_json(url: str) -> dict:
    request = urllib.request.Request(url, headers={"accept": "application/json"})
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.loads(response.read().decode("utf-8"))

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'request' from os.environ.get (line 67, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=60) as response:
            result = parse_payload(response.read(), response.headers.get("content-type", ""))
            return result, response.headers.get("mcp-session-id") or session_id
    except urllib.error.HTTPError as error:

• Confidence: 93% confidence
• Finding: The script allows the destination MCP_URL to be overridden via the AI_HIVE_MCP_URL environment variable, then sends authentication material from AI_HIVE_API_KEY or AI_HIVE_ACCESS_TOKEN to that URL. If an attacker can influence the environment or packaging/runtime context, they can redirect requests to an arbitrary server and exfiltrate credentials while also enabling arbitrary remote MCP interaction.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is presented primarily as a methodology-research and content-generation assistant, but it also instructs the agent to perform remote MCP connectivity, OAuth/API-key authentication, tool enumeration, and arbitrary remote tool invocation. This mismatch is dangerous because users may provide trust and permissions appropriate for content analysis while the skill actually enables broader remote actions and credential use, increasing the risk of unintended data exposure, unauthorized service calls, or paid task execution.

Ae1

High

• Category: analysis-evasion

Content

更完整的客户端配置、重新授权、解绑和错误说明见 [MCP 登录与绑定指南](references/mcp-binding.md)。可复制的无密钥配置见 [OAuth 示例](references/mcp-config.example.json) 与 [API Key 示例](references/mcp-config-

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Codex、Claude 与 ChatGPT

优先使用各客户端的远程 MCP/连接器界面；若支持 JSON 配置，使用 OAuth 最小配置。客户端必须支持 Streamable HTTP、OAuth 2.1、PKCE 和动态客户端注册。若出现 `unauthorized_client`，保留脱敏错误和客户端版本，通过 AI-HIVE 登录后的客服渠道反馈，不要把 access token 粘贴到聊天中。

## Gemini 与支持 Header 的客户端

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a generic remote MCP client and tool invoker, which is materially unrelated to the declared skill purpose of analyzing and simulating a public content methodology. This scope mismatch increases supply-chain risk because the skill grants hidden networked capabilities that a user would not reasonably expect from the manifest, including authenticated remote access and tool execution.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code exposes broad remote tool invocation via tools/call with user-specified tool names and arguments, constrained only by a small read-only allowlist and an optional billing confirmation flag. In the context of a content-simulation skill, this creates unnecessary capability to trigger external actions, process sensitive data remotely, or incur costs through tools that are outside the user's expected scope.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents code paths and commands that use environment variables, local files, and networked MCP access, but it does not declare an explicit tool scope or permission boundary. That creates an authorization and transparency gap: a user may invoke a content-analysis skill without realizing it can access credentials, read/write files, and contact remote services.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The manifest sets `language: zh-CN`, and the document content is entirely written in Chinese, but the skill also describes broad applicability to general users rather than clearly limiting itself to a China-specific or Chinese-only compliance context. Under the policy rule, forcing a specific language or locale without explicit user choice can be a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The display name, description, and default prompt are all written in Chinese, which signals a fixed language experience. There is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language or region-specific context.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation without any trigger constraints, so the platform may auto-select and run it in contexts the user did not clearly intend. Because this skill can call an external MCP service, unintended invocation can cause unsolicited third-party data exposure, unexpected content generation, or user confusion about consent and provenance.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The module docstring is entirely in Chinese and is used as the CLI description via argparse, which makes the user-facing interface language-specific by default. There is no indication that users can choose another language or that the tool is intentionally limited to a Chinese-only compliance or regional context.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The module docstring frames the script as a diagnostics and API-key helper, but the implementation also supports authenticated arbitrary remote tool execution. This misleading description can cause reviewers or users to underestimate the capability and risk surface, weakening informed consent and security review for a skill that already appears off-manifest.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Multiple user-facing strings in exceptions, CLI descriptions, and status output are written only in Chinese, including error/help text at L040, L054-L055, L081-L082, L130, L137, L143, L148-L156, and L165. For a general-purpose CLI helper, this imposes a specific language on users without opt-in or justification, matching the locale policy violation criteria.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The config points to an `.cn` endpoint, which implies a locale or regional service selection, but the file provides no natural-language justification or indication that users can choose an alternative region. Under the policy rule, forcing a specific locale/region without opt-in or documented justification can be a natural-language policy concern even in config values.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:214