Security audit

AI大模型专家｜AI短剧智能剪辑

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed AI-HIVE short-video editing helper with expected API-key, media-upload, and local ffmpeg use, though it has some broad and loosely scoped helper code users should notice.

Install only if you are comfortable sending selected media, prompts, and task data to AI-HIVE and storing an AI-HIVE API key locally. Use it with authorized source material, review commands before running uploads or generation, and consider disabling implicit invocation in sensitive multi-skill environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents capabilities that read environment variables, access local files, invoke shell commands, and make network requests, but it does not declare corresponding permissions. This creates a transparency and consent gap: users or hosting platforms may authorize the skill based on incomplete metadata while the skill can still handle sensitive local media, API keys, and remote uploads.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as a short-drama editing assistant, but the described behavior extends into generic account queries, wallet/balance access, model enumeration, arbitrary media upload, general chat, image generation/editing, video generation, and browser-assisted API key setup. This mismatch is dangerous because users may grant trust and provide sensitive media or credentials for a narrow editing workflow while the skill actually exposes a much broader operational and data-handling surface.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file presents itself as a generic AI capability wrapper with chat, model discovery, upload, and task APIs, which materially exceeds the manifest’s claimed short-drama smart-editing purpose. This kind of scope drift is dangerous because users or calling agents may grant trust, permissions, or API access based on the narrower description while the code exposes broader remote capabilities.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: User-info retrieval exposes account metadata and wallet/balance information that is not necessary for a short-drama editing skill. Even if not directly exfiltrating data, collecting or displaying unrelated account details expands the privacy and reconnaissance surface and violates least-privilege expectations set by the skill description.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Generic text-chat support is outside the stated smart-editing scope and enables arbitrary prompting against remote models. In context, this broadens the skill from a specialized media-editing tool into a general AI interface, increasing opportunities for misuse, prompt handling of sensitive data, and policy bypass through undeclared functionality.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The embedded SKILL_CONFIG explicitly rebrands the tool as a GPT Image 2 picture generation/editing skill, which directly conflicts with the manifest describing short-drama smart editing. This is more serious than a vague mismatch because the executable entrypoint is wired to a different product capability, creating a strong risk of deceptive packaging and incorrect trust assumptions by users or orchestrators.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The module docstring describes a general-purpose AI invocation tool, contradicting the claimed specialized short-drama editing role. This discrepancy matters in security review because capability misrepresentation can cause operators to approve or invoke a skill under false assumptions about what network actions and model operations it can perform.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The file is presented as a narrowly scoped short-drama smart-editing skill, but the implementation exposes generic chat, image, video, model enumeration, upload, and task APIs. This capability mismatch weakens least-privilege expectations and can let callers use the skill for broader actions than users or platform reviewers would reasonably infer from the advertised purpose.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The top-level documentation describes a generic AI capability tool while the embedded skill configuration markets a specific short-drama video skill. This inconsistency can mislead review systems and users about the real operational scope, increasing the chance that overly broad functionality is approved or invoked under a narrower trust assumption.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The manifest enables implicit invocation (`allow_implicit_invocation: true`) without any visible trigger scoping or constraints, which can cause the skill to be auto-selected in contexts broader than intended. Because this skill can drive content-generation and editing workflows from a generic prompt, unintended invocation could expose user data or trigger actions on the wrong project context, especially in multi-skill environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:131