Security audit

AI大模型专家｜AI漫剧剪辑

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches an AI-HIVE video/image editing workflow, but it handles API credentials and endpoint scope too broadly and includes extra generic AI-HIVE capabilities that users should review before installing.

Review this before installing. Use a dedicated, limited AI-HIVE key, avoid custom base URLs unless you control and trust the host, check AI_HIVE_BASE_URL and ~/.ai-hive/config.json before running generation, and expect selected media files to be uploaded to AI-HIVE. Prefer a virtual environment with pinned dependencies instead of the documented global unpinned pip install.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:120
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Generate and verify cryptographic hashes for all direct and transitive dependencies. 3. Document installation with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Recommend installation inside a dedicated virtual environment rather than the user's global Python environment. 5. Explicitly specify a trusted package index and warn against untrusted mirrors. 6. Periodically regenerate the lockfile and review dependency advisories before publishing updates. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:91
Finding: AI-HIVE API Credential Can Be Sent to an Arbitrary Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:91
Finding: AI-HIVE API Credential Can Be Sent to an Arbitrary Endpoint in Image Client
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the static finding is accurate that the skill exposes undeclared user-info, wallet-balance, model-list, or chat capabilities, then this is a genuine security and transparency problem. Undeclared sensitive-account or billing-related operations can lead users to invoke actions they did not consent to and can expose account metadata or increase spend under the guise of a different workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the static finding is accurate that the skill exposes undeclared user-info, wallet-balance, model-list, or chat capabilities, then this is a genuine security and transparency problem. Undeclared sensitive-account or billing-related operations can lead users to invoke actions they did not consent to and can expose account metadata or increase spend under the guise of a different workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the static finding is accurate that the skill exposes undeclared user-info, wallet-balance, model-list, or chat capabilities, then this is a genuine security and transparency problem. Undeclared sensitive-account or billing-related operations can lead users to invoke actions they did not consent to and can expose account metadata or increase spend under the guise of a different workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file advertises a generic AI Hive OpenAPI client with text chat, image/video generation, model listing, upload, and task polling, which does not match the declared drama/comic editing skill purpose. This capability mismatch is dangerous because it expands the effective privilege and behavior surface of the skill, making users and reviewers believe they are installing a specialized editing helper when they are actually receiving a broad API client with unrelated functions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The embedded SKILL_CONFIG hard-codes a GPT Image 2 product-image generation/editing skill, which is materially different from the manifest's stated AI drama/comic editing workflow. Hidden repurposing like this can mislead users into granting API keys and running operations for an undeclared service path, undermining trust and preventing informed consent about what the skill actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises and demonstrates capabilities that imply shell, filesystem, environment-variable, and network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an avoidable trust gap: a host or reviewer cannot easily determine the minimum privileges required, increasing the risk of over-broad execution and accidental exposure of local files, secrets, or network resources.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file explicitly sets language: zh-CN, which indicates the skill is constrained to a specific language/locale. The document does not offer an opt-in choice for other languages or explain why a Chinese-only locale is required for compliance or region-specific operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script’s natural-language description and user-facing labels are entirely in Chinese, including the argparse description and output metadata, with no option to select another language or locale. This can violate language/locale policy when skills must not force a specific language without user opt-in.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/edit_video.py (reported line 20)May include surrounding context.
python
def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language descriptions and CLI messages in Chinese, starting with the module docstring and continuing throughout the user interaction flow. Because the skill does not offer a user language/locale choice or explain that it is intentionally region-specific, it violates the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The client exposes user-info, model enumeration, and text chat operations that are not necessary for a narrow drama/comic image-editing skill. Extra undeclared capabilities increase attack surface and may allow a seemingly limited skill to access account metadata or invoke broader API features than users expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file presents itself as a specific drama/comic video skill, but the implementation is a broad AI-Hive client exposing unrelated capabilities such as chat, model enumeration, account inspection, and arbitrary media upload. This kind of scope mismatch increases the attack surface and can mislead users or orchestrators into granting permissions or invoking functionality beyond the advertised purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The generic text chat endpoint is unrelated to a narrowly scoped video-editing skill and materially broadens what the skill can do with the provided API key. This undermines least privilege and may let downstream agents use the skill as a general-purpose model access path rather than the advertised editing workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The top-level docstring says this file is a '通用 AI 能力调用工具' covering chat, image generation, video generation, model query, upload, and polling. However, the file's generated skill configuration and specialized entrypoint brand it as a dedicated short-drama video skill, so the inline documentation contradicts the claimed focused intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code presents the skill description, help text, prompts, and operational guidance exclusively in Chinese, which can impose a language choice on users. The policy allows locale constraints only when clearly documented and justified or when users are offered a choice, neither of which is present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Exposing user-info and wallet/balance data is not necessary for the advertised editing workflow and creates unnecessary access to potentially sensitive account metadata. In a skill ecosystem, this can enable privacy leakage or capability overreach if the skill is invoked under broader credentials than users expect.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:131