AI大模型专家｜短剧悬念钩子与卡点

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:04 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI-HIVE workflow helper for short-drama planning plus user-directed image/video generation, uploads, task polling, and downloads.

Install this only if you intend to use AI-HIVE. Review generated commands before running them, avoid uploading private or unlicensed media, and keep the AI-HIVE API key in a revocable environment variable or the protected config file rather than in shared artifacts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents executable commands that use environment variables, local file paths, shell execution, and networked API access, yet it declares no permissions. This creates a transparency and consent problem: a user or platform may treat the skill as low-risk while it can read local inputs, write outputs, and call external services with API keys.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The skill is presented as a narrowly scoped short-drama planning assistant, but the described behavior extends into broad AI-HIVE client functionality such as wallet/user info queries, model enumeration, general chat, media upload, and generic generation workflows. Scope mismatch is dangerous because users may expose credentials, media, or account context under a misleadingly narrow description, increasing the chance of over-privileged or unexpected data processing.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file’s embedded skill configuration and entrypoint implement a GPT Image 2 image-generation/upload/task wrapper, while the declared skill metadata describes a short-drama cliffhanger/planning expert. This mismatch is dangerous because users and orchestrators may grant the skill broader trust or permissions based on the advertised purpose, but the code actually performs unrelated networked media operations and can upload local files to a remote service.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The embedded SKILL_CONFIG explicitly advertises GPT Image 2 commercial image generation/editing, which directly contradicts the top-level skill description about drama cliffhanger planning. Such contradictory identity signals are a supply-chain integrity risk: they can conceal actual capabilities, mislead review processes, and cause users to provide prompts, files, or credentials under false assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: For a skill presented as drama-planning expertise, exposing image upload, generation, and task polling is unjustified capability expansion. The added media-handling surface increases the chance of unintended local file exfiltration and remote content generation without a clear user expectation, making the mismatch more dangerous in this context than it would be in an explicitly media-generation skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file presents itself as a short-drama/cliffhanger expert skill, but the implementation is a broad AI Hive API wrapper exposing generic chat, model discovery, upload, task polling, and media generation operations. This capability mismatch expands the attack surface and violates least privilege: users or upstream agents may invoke unrelated platform actions under the guise of a narrowly scoped creative-planning skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Exposing a user-info command that retrieves account and wallet balance is unrelated to the stated creative-assistance purpose and unnecessarily grants access to sensitive account metadata. In an agent ecosystem, this can leak billing or account details to workflows that only needed content-generation functionality.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: Listing all available models enables platform discovery beyond the narrow short-drama workflow described in the metadata. While not inherently dangerous alone, it broadens capability exposure and can help an attacker or misconfigured agent pivot into unsupported or higher-risk model usage.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill enables implicit invocation without any visible trigger constraints or narrowing conditions. That can cause the agent to activate in broader contexts than intended, increasing the chance of accidental routing, unexpected data exposure to the skill, or misuse in workflows where the user did not clearly request this specialized capability.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:128