Security audit

AI大模型专家｜AI短剧智能剪辑

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly related to short-video editing, but it needs Review because it handles API keys, uploads media, and writes downloaded files with weak scoping and several under-disclosed risks.

Review before installing. Use a dedicated, revocable AI-HIVE API key with limited balance or scope if possible; avoid custom base URLs unless you fully trust the endpoint; do not upload confidential, unpublished, face, voice, or client media without authorization; and run it in an isolated environment with a controlled output directory.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:94
Finding: Bearer Credential Disclosure Through an Unrestricted API Base URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:397
Finding: Path Traversal in Generated Media Download Filenames
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:638
Finding: API Key Persisted in a Plaintext Configuration File
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:119
Finding: Unpinned Runtime Installation of a Third-Party Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a substantial AI editing and workflow platform for short-form drama/video production, including handling existing素材, producing deliverable edits, and using AI-HIVE to manage image/video model workflows. The supplied code does none of that. It only parses CLI arguments and emits a static JSON brief template. This is a materially different primary purpose, not just an implementation detail omission. Therefore the description does not accurately represent the code chunk’s actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad AI-driven short-video/short-drama editing and content-rewriting system connected to AI-HIVE infrastructure. The supplied code does not implement any AI behavior, remote service integration, orchestration, or content analysis/generation. Instead, it is a straightforward local CLI wrapper around ffmpeg/ffprobe for basic deterministic media edits. While some operations loosely relate to video editing (trim, aspect conversion, concat, mute, loudness normalization), the primary purpose and capabilities are materially narrower and different from the declared AI editing platform description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 虽然描述中提到 AI-HIVE 可做素材上传、路由、任务轮询和结果下载，这与部分底层实现一致，但这些只是平台级支持能力。就该代码块本身而言，主要行为并不是“短剧智能剪辑”，也没有看到任何视频剪辑、重剪、改版、镜头拼接、结构化短剧生产或文案原创重写逻辑。尤其是构建器生成的最终 skill 被固定配置为“gpt-image-2 图片生成与编辑”，其入口仅支持 generate/task/upload/init，明确聚焦图片生成/编辑，而非短剧剪辑。故声明与实际行为存在明显且实质性的用途不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents shell execution, file access, environment variable use, and network/API interactions, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization and transparency gap: users and hosting platforms cannot easily tell that the skill can read local files, invoke ffmpeg, access API keys, and transmit data externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly discusses uploading source materials, polling remote jobs, and downloading results through AI-HIVE, but it does not present a clear user-facing warning that local media and possibly metadata will be transmitted to an external service. In a media-editing context, uploaded files may contain sensitive content, faces, voices, business assets, or unpublished campaigns, so lack of clear disclosure materially increases privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill uses very broad activation/search phrases such as generic AI editing and short-drama terms that overlap heavily with normal user requests. Overbroad triggers can cause unintended invocation of a powerful skill that performs shell, file, and network operations, increasing the chance of surprise execution or data handling outside user expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill enables allow_implicit_invocation without any visible trigger constraints, scope limits, or user-confirmation requirements. That increases the chance the agent is auto-selected in contexts involving media processing, rewriting, or content generation, causing unintended execution, unnecessary data exposure, or actions based on ambiguous user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language description and user-facing strings are entirely in Chinese (AI短剧智能剪辑, 待确认, 剪辑复刻, and related aliases) with no indication that other languages are supported or that Chinese is an intentional, documented locale restriction. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/edit_video.py (reported line 20)May include surrounding context.
python
def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file's implemented capability is materially broader than the advertised skill purpose: besides image generation, it includes generic chat, model discovery, user-info retrieval, task querying, and arbitrary media upload. This capability mismatch increases attack surface and can mislead users or orchestrators into granting trust, credentials, or execution rights to a tool that can perform unrelated operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and user-facing CLI/help text are written in Chinese, and the script does not indicate that this skill is region-specific or provide an opt-in language selection. This can violate language/locale policy because it forces a specific language experience on users without choice or justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is implemented as a general-purpose AI Hive client exposing chat, image, video, model listing, upload, task polling, and account-oriented operations, while the declared skill is narrowly framed as short-drama smart editing. This capability mismatch increases attack surface and violates least privilege: a caller expecting a constrained editing tool may unknowingly grant a much broader interface access to account data and arbitrary model usage.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring explicitly presents the script as a universal AI capability invocation tool, contradicting the specialized persona and purpose described in the skill metadata. This kind of deceptive or overly broad packaging is dangerous because reviewers and users may trust the skill as narrowly scoped while it actually provides a much wider operational surface, enabling misuse under a less suspicious label.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file contains user-facing natural-language descriptions and prompts in Chinese, including the module docstring and later CLI help/output text. Because the skill does not offer a language or locale choice, it may violate a policy requiring language selection or opt-in rather than imposing a single locale.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The user-info endpoint exposes account/profile and wallet-balance data that are unrelated to video editing. In a skill ecosystem, unnecessary access to billing/account metadata can leak sensitive tenant information and help an attacker profile the victim account or optimize further abuse of the linked API key.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The metadata sets the language to zh-CN, and the skill content is entirely Chinese, but the file does not state that the user can choose another language or that the locale restriction is required for compliance or region-specific operation. This can conflict with language/locale policy expectations when a skill forces a single language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example API key value uses Chinese text ('请替换为你的APIKey') as the only placeholder, which imposes a specific language choice in user-facing configuration content. There is no indication that the skill is region-specific or that users may choose another language or locale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code writes a JSON file to a user-specified path via output.write_text(...), but there is no confirmation prompt, warning comment/docstring about overwriting output, or user-facing disclosure beyond printing the final path. For a code file, file writes are safety-relevant operations when they can modify user data, and this script does not disclose that behavior clearly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Exposing user-info and wallet-balance retrieval is unnecessary for an image-editing skill and permits account reconnaissance using the configured API key. While not directly code-execution, it can disclose billing/account metadata and enable unintended data access beyond the expected editing workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Allowing arbitrary model enumeration across TEXT, IMAGE, and VIDEO exposes generic platform-discovery functionality unrelated to the skill's stated narrow purpose. In context, this can help a caller probe available backend capabilities and pivot beyond intended image-editing operations using the same trusted integration and API key.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Model enumeration is broader than necessary for a dedicated short-drama editing skill and reveals the provider's available model inventory and routing modes. While not severe by itself, it expands reconnaissance value and allows consumers of the skill to pivot into unintended model usage beyond the advertised workflow.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:131