Security audit

AI大模型专家｜短剧人物设定与人物小传

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI-HIVE planning and media-generation workflow, with user-directed API key setup, uploads, generation, polling, and downloads.

Install only if you intend to use AI-HIVE for short-drama planning plus image/video generation. Treat any file passed to upload, --image, --video, --audio, --first-frame, or --last-frame as leaving your machine, and store the AI-HIVE API key only on a device where ~/.ai-hive/config.json is acceptable credential storage.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation includes shell commands, environment variable use, local file output, and networked API interactions, yet no explicit permissions are declared. This creates a transparency and least-privilege problem: users and platforms cannot accurately assess that the skill can read/write files, use secrets, and invoke remote services before adoption.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The stated purpose is a planning/character-bible skill, but the described behavior expands into broad chat access, user/account queries, model enumeration, browser-based key configuration, fixed model invocation, and standalone media upload. This mismatch is dangerous because it obscures the real trust boundary and may lead users to expose credentials, spend funds, or upload content under assumptions that the skill is narrower than it actually is.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file implements a broad generic AI-Hive client with text chat, image generation, video generation, model listing, media upload, and task polling, while the declared skill is for drama character-bible/persona planning. This capability mismatch violates least privilege and creates unnecessary access paths that could be abused to invoke unrelated models, process arbitrary media, or incur costs outside the skill’s stated purpose.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The embedded SKILL_CONFIG explicitly repurposes this skill into a GPT Image 2 image-generation/editing wrapper, which does not match the metadata describing a character-bible skill. This kind of hidden repurposing is dangerous because users and platforms may grant trust or permissions based on the manifest, while the code performs materially different actions.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill can retrieve user account information and wallet/balance data even though that capability is not needed for a character-bible or focused image-generation workflow. Unnecessary access to account metadata expands privacy exposure and may reveal billing state or identifiers useful for profiling or social engineering.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The ability to enumerate the full model catalog is broader than necessary for the stated skill and can expose internal service capabilities, routing modes, and potentially pricing-related metadata. In context, this increases misuse potential by enabling discovery of unintended models and APIs beyond the promised workflow.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Video generation plus image/video/audio upload support is materially outside the stated character-bible purpose and even outside the later embedded image-only wrapper. These extra media pathways increase attack surface, enable unexpected data transfer of local files, and can trigger costly or privacy-impacting operations unrelated to user expectations.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file claims to be a character-bible/content-planning skill in metadata, but the implementation is a generic AI Hive CLI with chat, model enumeration, account info, upload, and media generation capabilities. This capability mismatch is dangerous because users and orchestrators may grant broader trust or permissions based on the advertised purpose while the code performs materially different remote actions.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script exposes a user-info command that retrieves account and wallet information even though the advertised skill is for character-bible creation. In a mislabeled skill, unnecessary access to account metadata expands the data surface and can leak sensitive billing or identity details to users or downstream tooling that did not expect such access.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code provides generic model inventory and query functionality unrelated to character-bible authoring. In context, this broadens remote introspection of the vendor environment and exposes operational capabilities that are unnecessary for the promised task, increasing attack surface and undermining principle of least functionality.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The embedded SKILL_CONFIG explicitly targets short-drama video generation, not character-bible creation, confirming that the shipped behavior contradicts the skill metadata. This kind of deceptive packaging increases risk because reviewers or users may approve the skill under a benign planning/content label while it actually performs media-generation and upload/download operations.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The module docstring and parser descriptions openly describe a generic AI/media skill, directly contradicting the manifest's character-bible intent. This inconsistency makes the skill more dangerous because it signals packaging or review-control failures that can hide materially different functionality from trust and permission decisions.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables implicit invocation via `allow_implicit_invocation: true` without any visible activation constraints, scoping rules, or user-confirmation requirements. This can cause the agent to trigger the skill in contexts the user did not clearly intend, leading to prompt hijacking, unintended data flow into the skill, or actions being framed as authoritative planning output without explicit consent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The upload path sends arbitrary user-provided media to remote object storage and the AI Hive service, but the skill description/help does not clearly warn that local files leave the host. In a mislabeled planning skill, this is especially risky because users may provide sensitive drafts or private media without realizing the data will be transmitted externally.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:128