AI大模型专家｜抖音电商 电商视频生成与编辑

• Outcome: Review
• Latest audit: Aug 24, 2026 · 2:48 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a disclosed AI-Hive video workflow, but it allows implicit invocation of cost-incurring uploads and job submission without clear user confirmation boundaries.

Install only if you are comfortable with an agent invoking AI-Hive video jobs, uploading selected media, storing an AI-Hive API key locally, and downloading results. Before use, consider disabling implicit invocation or requiring explicit approval for uploads and job submissions, especially for paid or batch work.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill describes capabilities that read environment variables, read/write local files, invoke shell commands, and make network requests, but it does not declare permissions or clearly constrain those operations. In an agent ecosystem, this reduces transparency and weakens consent boundaries, increasing the risk that the skill accesses local secrets, modifies files, or performs network actions beyond what a user expects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is narrow video-generation workflow support, but the behavior reportedly extends to chat APIs, image generation APIs, model enumeration across multiple modalities, wallet/account retrieval, and browser-assisted API key setup/storage. This mismatch is dangerous because users and policy systems may authorize the skill under a narrower trust assumption while the implementation can access additional data, accounts, and external capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file presents itself as a specialized Douyin e-commerce video skill, but it embeds a broader generic AI-Hive client with unrelated capabilities such as chat, image generation, model listing, and account access. This expands the accessible attack surface and violates least-privilege expectations: a user or orchestrator invoking this skill may unintentionally grant broader account and model access than the skill description implies.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: Exposing a user-info endpoint in a video-generation skill permits retrieval of account details and wallet/balance information that are unrelated to the declared task. In an agent setting, this creates an unnecessary data-access path that could leak sensitive account metadata or be abused for reconnaissance.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Standalone text-chat and image-generation flows materially exceed the declared scope of a Douyin e-commerce video-generation/editing skill. In agent ecosystems, scope creep is security-relevant because policy, approvals, and user expectations may be based on the advertised capability, while the code can perform broader API actions.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The top-level documentation describes a generic AI capability tool rather than the narrowly branded video skill, creating a mismatch between advertised and actual behavior. Such mismatches are dangerous in agent environments because trust, routing, and approval decisions can be made from metadata and docs that understate the tool's real capabilities.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation with no visible trigger constraints, while the skill is capable of performing real external actions such as uploading assets, submitting jobs, polling status, and downloading generated results. That creates a meaningful risk of unintended activation, which could lead to unapproved API usage, cost-incurring operations, or unexpected handling of user media/content.

Static analysis

No suspicious patterns detected.