Security audit

AI大模型专家｜品牌电商带货短剧

Security checks across malware telemetry and agentic risk

Overview

This skill appears to match its stated short-drama media workflow, with disclosed AI-HIVE API use, local key setup, media upload, and downloads.

Install only if you are comfortable sending chosen prompts and media files to AI-HIVE and storing or supplying an AI-HIVE API key locally. Review file paths before upload, avoid unnecessary private素材, and revoke the API key if you stop using the service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises executable scripts that use environment variables, local file I/O, shell commands, and network access, but the manifest shown in SKILL.md does not declare permissions or clearly scope those capabilities. That gap weakens reviewability and informed consent: users and platforms cannot easily tell that running the skill may access local files, persist outputs, and transmit data to a remote service.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is narrowly framed around short-drama/e-commerce video production, but the finding indicates materially broader behaviors including generic chat, account and wallet retrieval, model enumeration, local credential setup, and unrelated image tooling. This mismatch is dangerous because it can mislead users about data exposure and operational scope, causing them to provide API keys, files, or trust they would not grant if the full behavior were transparently declared.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file is presented as an image-generation skill, but it bundles generic chat, model enumeration, media upload, task polling, and account-related API capabilities. This expands the effective permission and feature surface beyond the declared purpose, increasing the chance that an integrating agent or user invokes unrelated capabilities and exposes more data than necessary.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill can query user account information and wallet balance through get_user_info(), which is not required for image generation. Unnecessary access to account metadata increases privacy exposure and may reveal billing or account details to downstream users, logs, or agents that only needed creative generation features.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The generic text chat endpoint allows arbitrary model interaction beyond the stated image/video production purpose of the skill. In a constrained skill environment, this scope creep can enable unintended prompt handling, extra data transmission, and policy bypass via a broader-capability backend than users expect.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The default prompt is broad and generic enough to overlap with ordinary user requests about brand e-commerce short dramas, which can cause the skill to activate in situations where the user did not explicitly intend to invoke it. This increases the chance of unintended routing of user requests, potentially exposing data, bypassing clearer user consent boundaries, or causing the agent to take domain-specific actions automatically.

Vague Triggers

High

Confidence: 95% confidence
Finding: Enabling implicit invocation without defined trigger constraints means the platform may auto-select this skill for loosely related requests, creating an unsafe trust boundary. In a workflow that can generate executable commands and orchestrate media-generation steps, unintended invocation can lead to unauthorized processing, accidental disclosure of user materials, or actions being taken without sufficiently explicit user authorization.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:127