Security audit

AI大模型专家｜短剧动态分镜与预演

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI-HIVE media-generation workflow that uses user-provided prompts, media files, and an API key to generate and download short-drama planning assets and videos.

Install only if you are comfortable giving this skill an AI-HIVE API key and uploading the specific media files you choose for generation. Prefer environment-variable credentials or the disclosed local config file, keep the key private, and review generated upload/generation commands before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises executable workflows that use shell commands, local files, environment variables, and network access, yet no explicit permissions are declared. This weakens least-privilege controls and prevents users or hosting platforms from understanding the actual trust boundary before running the skill.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is narrowly framed around short-drama animatic/previs generation, but the finding indicates broader capabilities including arbitrary model chat, account/balance retrieval, model enumeration, unrelated image tooling, and generic media upload. This mismatch is dangerous because users may grant trust, credentials, or files for a specific creative workflow while the skill can access additional functions and sensitive account-related operations outside that expected scope.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill is packaged as a narrowly scoped GPT Image 2 image-generation tool, but it still ships broader operational commands inherited from the generic client, including account-oriented functionality. In a skill ecosystem, that scope mismatch is dangerous because users and orchestrators may grant trust or credentials based on the advertised image-editing purpose while the code retains unrelated capabilities.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code includes a user-info endpoint that can retrieve account information and wallet balance, which is not necessary for an image-generation/editing skill. Even if it is not automatically invoked here, including account-inspection capability expands the blast radius of the skill and enables unnecessary access to sensitive billing/account metadata when API credentials are provided.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file implements a broad generic AI/OpenAPI client for chat, image, video, model discovery, media upload, and task polling, while the declared skill is a narrowly scoped short-drama animatic/previs capability. This scope mismatch increases the reachable attack surface and enables users or downstream agents to invoke capabilities unrelated to the stated purpose, undermining least-privilege expectations for skills.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Retrieving user account information and wallet balance is not necessary for generating short-drama animatics or previs outputs. In a skill context, exposing billing/account data creates unnecessary access to sensitive operational information and broadens the consequences if the skill is misused or invoked by an untrusted workflow.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The generic text chat endpoint is outside the declared specialized video-previs purpose and allows arbitrary prompt forwarding to external models. This transforms the skill into a broader general-purpose model access wrapper, increasing data exfiltration opportunities and bypassing policy assumptions that the skill only performs scoped video-previs operations.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The default prompt and description authorize the skill to handle an end-to-end workflow ('complete' planning, generation, and delivery) without clear boundaries on when it should be invoked. Broad trigger language can cause over-invocation or inappropriate routing, leading the agent to act on unrelated user requests, expose external integrations unexpectedly, or perform higher-impact actions than the user intended.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:127