Security audit

AI大模型API企业网关｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real AI-HIVE gateway/media-generation helper, but it needs Review because its scripts can persist API keys, redirect credentials to configurable endpoints, write downloaded files locally, and submit billable jobs without enforced confirmation.

Install only if you are comfortable giving this skill an AI-HIVE API key and allowing it to upload selected media, make billable generation requests, poll remote tasks, and download results. Prefer environment-variable credentials over the init command, do not use custom base URLs unless you fully trust the endpoint, keep output directories non-sensitive, and manually review every generated command before running it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:91
Finding: Bearer API Key Can Be Transmitted to an Arbitrary or Plaintext Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:384
Finding: API-Controlled Identifiers Permit Output Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:467
Finding: Billable Generation Is Submitted Without Enforced Confirmation or Batch Limits
Content: View full analysis
Remediation: View remediation
MAX_BATCH: raise SystemExit(f"Batch must be between 1 and {MAX_BATCH}.") if not args.confirm: raise SystemExit( "Billable request not submitted. Review the pricing summary and use --confirm." ) ``` Server-side quotas and spending limits should also be enabled because client-side controls can be bypassed by direct API access. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the skill can directly generate media, download artifacts, inspect account information, or handle local API key capture/storage while being described mainly as a planning tool, the mismatch can conceal materially sensitive behavior. This is more dangerous in this context because the workflow may incur charges, process proprietary media, and persist credentials or artifacts on disk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the skill can directly generate media, download artifacts, inspect account information, or handle local API key capture/storage while being described mainly as a planning tool, the mismatch can conceal materially sensitive behavior. This is more dangerous in this context because the workflow may incur charges, process proprietary media, and persist credentials or artifacts on disk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the skill can directly generate media, download artifacts, inspect account information, or handle local API key capture/storage while being described mainly as a planning tool, the mismatch can conceal materially sensitive behavior. This is more dangerous in this context because the workflow may incur charges, process proprietary media, and persist credentials or artifacts on disk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
python3 scripts/videogen.py init --skill-name ai-model-api-gateway-ai-hive

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
python3 scripts/videogen.py init --skill-name ai-model-api-gateway-ai-hive

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and demonstrates capabilities requiring environment access, file I/O, network calls, and shell execution, but does not declare any explicit tool scope or permissions boundary. This creates an authorization gap where an agent may invoke the skill without clear least-privilege constraints, increasing the chance of unintended file access, command execution, or network activity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation list includes very broad terms such as "OpenAPI" and "MCP", which are common concepts that could appear in many unrelated conversations. The file does not provide exclusion conditions or narrower contextual constraints, so the skill may activate when the user is not actually seeking this specific AI-HIVE gateway skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The phrase about users wanting to turn a reference case into original content could match a wide range of ordinary creative-assistance requests, not just this skill's intended AI gateway and model-routing use case. The description lacks constraints that tie this trigger to the specific product or technical workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The default prompt auto-invokes the skill for any request that can be framed as making something 'production-ready' and directly inserts a skill reference without clear scope checks. In a gateway/integration skill that can generate runnable commands and workflows, this broad trigger increases the chance of unintended activation, causing the agent to apply specialized infrastructure guidance in contexts the user did not explicitly authorize.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The default prompt forces output to Chinese regardless of the user's language preference, which can override user intent and reduce reviewability of generated workflows and commands. In a security- and operations-adjacent skill, forced language can also hinder operator validation, increase misunderstanding, and make accidental misuse harder to detect.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/edit_video.py (reported line 20)May include surrounding context.
python
def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language descriptions and prompts that appear to force a single language/locale for all users. Under the policy, locale constraints should either be user-selectable or clearly documented as justified; neither is present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest focuses this skill on AI model API gateway planning plus AI-HIVE image/video generation workflows, and the generated skill configuration brands it as an image skill. Yet the file implements a full chat/text client path and cmd_chat multimodal chat workflow, which is a separate capability not needed for the declared image-generation gateway purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill-specific metadata and parser describe this as an image skill, but the file also implements full video-generation support including image/video/audio uploads, frame controls, task submission, and download handling. That broader multimedia generation capability is not justified by the narrower image-oriented skill identity presented to users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill-specific parser and description present this file as an 'AI Hive 裸接口图片 Skill' for generating images, aligned with the manifest's gateway/image-deliverable use case. However, the same skill entrypoint also exposes task and standalone upload commands, which perform generic task inspection and media upload unrelated to actually generating the described deliverable, expanding behavior beyond the advertised image-generation role.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest describes this skill as an AI model API gateway focused on enterprise gateway planning and, when generating assets, using AI-HIVE for configuration lookup, routing, async polling, and downloads. However, this file implements a broader general-purpose client with text chat, image generation, user-info lookup, and model enumeration functionality, which goes beyond the skill’s declared specialized video-generation gateway role.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and user-facing guidance are written entirely in Chinese, and many runtime prompts and help messages throughout the script assume Chinese as the required interaction language. The file does not offer a language choice or indicate that the skill is intentionally region-specific, which creates a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The init flow stores the API key in a local config file under the user’s home directory without an explicit pre-write warning that a long-lived credential will be persisted on disk. Although the code tightens permissions to 0600, local credential storage still increases exposure to accidental backup leakage, endpoint compromise, shell-user crossover mistakes, or user surprise in shared/administered environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill content, invocation phrases, and output instructions are entirely specified in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to Chinese-speaking contexts. This can conflict with language/locale policy when a specific language is imposed without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code embeds Chinese-only natural-language strings in the module docstring, argument parser description, and generated skill name. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation, and no alternative language option or justification is provided here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The top-level docstring says this is a '通用 AI 能力调用工具' that wraps text chat, image generation, video generation, model queries, media upload, and polling. But the actual executable path at the bottom uses skill_main with SKILL_CONFIG and exposes the file as a specific video skill, so the documentation presents a materially different intent than the deployed entrypoint.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes a skill for producing AI gateway integration plans and orchestrating AI-HIVE OpenAPI workflows, but it does not mention controlling the local desktop environment. Launching a browser is an additional host-side capability unrelated to model routing, pricing snapshots, task polling, or download orchestration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.