Security audit

AI大模型专家｜ChatGPT Claude Gemini AI搜索引用

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI-HIVE planning and media-generation helper; it uses network calls, user-selected uploads, and local API-key storage, but I did not find hidden exfiltration, destructive actions, or deceptive behavior.

Install only if you intend to use AI-HIVE and are comfortable storing an AI-HIVE API key locally. Treat uploaded images, videos, audio, prompts, and generated tasks as data sent to the AI-HIVE service, and avoid using broad implicit invocation for unrelated AI-search discussions.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents capabilities that read environment variables, access local files, use the network, and execute shell commands, but it does not declare permissions. This weakens user and platform visibility into what the skill can do and increases the chance of over-privileged execution or accidental exposure of local data and API keys.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The published description frames the skill primarily as a planning and AI-search content structuring tool, but the referenced scripts appear to perform materially broader actions including API invocation, account and wallet queries, browser-based onboarding, local credential storage, and direct media generation. This mismatch can mislead users and reviewers about the real attack surface, causing them to approve or invoke a skill that handles credentials, billing-related data, and remote execution flows they did not expect.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file implements broad AI Hive account access, media upload, model discovery, chat, image generation, and video generation, while the advertised skill is framed as planning/search/citation support. This capability mismatch is dangerous because users or hosting platforms may grant trust and permissions based on the stated purpose, but the code can transfer local media and invoke unrelated remote actions.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The user-info endpoint exposes account metadata and wallet/billing-related information that is unrelated to a specialized planning/search skill. In context, this expands the data-access surface beyond user expectations and could leak sensitive subscription or balance information if the skill is invoked in a broader agent environment.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Model enumeration gives the skill a generic discovery capability over the provider account, which exceeds the stated narrow purpose. In an agent setting this can reveal tenant capabilities and enable opportunistic use of models unrelated to the skill's advertised function.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The invocation wording is broad enough to match ordinary conversation about AI search, ChatGPT, Claude, Gemini, GEO, or AEO rather than a clear request to run this specific skill. Over-broad triggers can cause unintended activation, exposing user prompts, local context, or linked capabilities to a skill when the user only meant to ask a general question.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The default prompt uses a very broad invocation phrase tied to common user goals like completing a project, confirming platform/audience, and generating an execution plan. Because implicit invocation is enabled, this wording increases the chance the skill will be triggered in situations where a user did not specifically intend to call it, causing unintended routing of requests and possible overreach into unrelated workflows.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:133