ClawHub
Back to skill

Security audit

AI大模型专家｜末日短剧 AI生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI-HIVE media-generation workflow for short-drama assets, with expected API-key, upload, polling, and download behavior under user control.

Before installing, understand that this skill uses an AI-HIVE API key, may store it locally, uploads media files you specify to AI-HIVE/object storage, and may download generated results. Use only media and credentials you are authorized to share, and review costs before submitting generation jobs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documents executable workflows that use shell commands, environment variables, local files, and network access, but it does not declare corresponding permissions or capabilities. This weakens user awareness and platform policy enforcement, increasing the chance that the skill can access sensitive local data or external services in ways the user did not explicitly expect.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The documented purpose is a narrowly scoped apocalyptic short-drama generation skill, but the analyzer indicates broader behaviors such as generic AI-HIVE chat/model access, unrelated image editing/generation, browser-based API-key setup, and auxiliary tooling not clearly disclosed. Behavior that exceeds the advertised scope is dangerous because users may provide credentials, media, or sensitive business content under a false understanding of what the skill can do.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill enables implicit invocation without any trigger constraints, which can cause the agent to activate this skill in broader contexts than intended. That increases the chance of unintended routing, prompt/context leakage into the skill, or unexpected execution of a workflow that may upload or process user media through external services without an explicit, scoped user choice.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:127