Security audit

AI大模型专家｜短剧 AI选角与定妆

Security checks across malware telemetry and agentic risk

Overview

The skill looks like a real AI-HIVE media-generation workflow, but its API-key use, media upload/download ability, implicit invocation, and mismatched generic image tooling should be reviewed before installation.

Install only if you are comfortable with AI-HIVE receiving the media files you explicitly provide and with this skill storing an AI-HIVE API key locally. Use a limited/revocable API key, verify generated commands before running them, avoid uploading private or unauthorized media, and consider disabling implicit invocation or using explicit skill calls only.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents and encourages capabilities including shell execution, environment-variable access, file read/write, and network operations, but it does not declare permissions or scope those capabilities. This creates a trust and review gap: users may invoke the skill expecting a content-planning tool while it can access sensitive local resources and external services, increasing the chance of secret exposure, unsafe file access, or unintended command execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a narrowly scoped short-drama casting/makeup assistant, but the documented behavior includes generic chat, model inspection, account/balance queries, browser-based onboarding, and arbitrary media upload/download. That mismatch is dangerous because users may grant trust and provide credentials or files for a specialized workflow without realizing the skill can perform broader actions, enabling data leakage, overscoped access, and misuse of user accounts or assets.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The packaged skill metadata says this skill is for drama casting/makeup, but the embedded SKILL_CONFIG hard-codes a generic GPT Image 2 product/ad image generator. This is a capability/intent mismatch that can mislead users and reviewers, causing them to grant trust, credentials, or permissions under false assumptions while actually exposing broader or different image-generation behavior.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module docstring describes a general-purpose AI capability wrapper for chat, image, video, model query, media upload, and task polling, which conflicts with the claimed specialized casting/makeup skill. Such scope inflation increases the chance that operators misunderstand what the code can do and approve or deploy a more powerful tool than intended.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The file includes generic account querying, model enumeration, text chat, image generation, video generation, and task access methods beyond a narrow casting/makeup image skill. Extra exposed capabilities enlarge the attack surface and permit misuse of the skill for unrelated actions, especially when paired with an API key and flexible base URL.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill enables implicit invocation (`allow_implicit_invocation: true`) without any visible narrow trigger constraints, which can cause the agent to activate this skill in contexts the user did not clearly intend. Because this skill appears oriented around generating project plans and executable commands for media workflows, unintended activation could lead to unauthorized data use, confusing tool routing, or actions taken on unrelated user requests.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:128