Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly supports video and AI-HIVE workflows, but it is broader than advertised and can send API keys and media to a configurable endpoint.
Install only if you intend to use AI-HIVE with short-drama media and are comfortable providing an API key and uploading selected media. Review or remove the base-url override paths, avoid using production credentials with custom endpoints, pin dependencies, and prefer explicit invocation before any upload or generation task.
scripts/imagegen.py:91Arbitrary API endpoint overrides can disclose bearer credentials and user media
SKILL.md:120Unpinned runtime dependency installation creates supply-chain exposure
The declared description promises a substantive media-processing and AI orchestration skill for short-drama dialogue editing, silence deletion, denoising, pacing, repackaging, and AI-HIVE workflow integration. The supplied code does none of that. It only parses CLI arguments and writes a JSON file describing a draft production brief. While some field names and search aliases align with the domain, the primary behavior is materially different: metadata templating rather than editing or AI-assisted media processing. Therefore this is a clear description-to-behavior mismatch.
The description presents a broad AI-powered short-drama editing and creative-production assistant, including dialogue editing, silence deletion, denoising, content restructuring, and integration with AI-HIVE services. The supplied code does not implement any AI functionality or remote platform integration. Instead, it is a narrowly scoped command-line wrapper around ffmpeg/ffprobe for basic media transformations: trim, aspect conversion, mute, loudness normalization, concat, and metadata probing. While some functions loosely relate to video post-production (e.g., trimming, muting, aspect conversion), key advertised capabilities such as silence removal, denoising, dialogue/rhythm-aware editing, and AI-HIVE orchestration are absent. Therefore the declared description materially overstates and misrepresents the actual behavior.
The description emphasizes post-production workflow for short dramas: dialogue-based editing, silence removal, denoising, rhythm tuning, reorganizing existing footage into rough/fine cuts or vertical ad versions, and related storyboard/persona uses. The supplied code does not implement any direct editing or audio/video analysis pipeline. Instead, it is a generic AI-HIVE API wrapper, and the concrete skill configuration at the bottom fixes the model to public_model_gpt_image_2 with title GPT Image 2 图片生成与编辑. The exposed entrypoint supports generate, task, upload, and init, all centered on image generation/editing. Although the generic client also contains chat/video endpoints, none of this corresponds to silence deletion, denoising, dialogue segmentation, or short-drama cut assembly. Therefore the declared purpose materially misrepresents the actual primary behavior.
There is a substantial description-behavior mismatch. The description emphasizes post-production/editorial functions on existing footage: dialogue clipping, silence handling, denoising, pacing, and preparing deliverable edits/versions. The code does not perform any direct video/audio editing operations locally or through explicit editing endpoints. Instead, it acts as a generic AI-HIVE API client with commands for user info, model discovery, chat, image generation, video generation, upload, task polling, and downloads. The generated skill configuration narrows this further to a 'short-drama video' generation tool that selects among text-to-video, image-to-video, and reference-to-video models. While the description briefly mentions AI-HIVE upload/routing/polling/download, that part is only supporting infrastructure; the core advertised editing capabilities are absent, and the actual primary behavior is AI content generation.
The file advertises itself as a specialized short-drama dialogue/silence editing skill, but actually exposes a broad generic AI Hive client with model enumeration, chat, media upload, image/video generation, task polling, and result download. This capability mismatch violates least privilege and can mislead users or orchestrators into granting broader networked and account-scoped operations than the declared skill purpose requires.
The embedded skill configuration hardcodes a GPT Image 2 image generation/editing workflow, which is materially different from the manifest's claimed short-drama dialogue and silence editing purpose. A mislabeled skill can bypass user expectations and policy review, enabling arbitrary image-generation operations under a trusted but inaccurate label.
The file is presented as a specialized short-drama dialogue/silence-editing skill, but the implementation is a broad AI Hive client supporting chat, image/video generation, model enumeration, account queries, upload, polling, and download. This capability mismatch violates least privilege and can mislead users or orchestrators into granting trust, API keys, and data access far beyond the declared purpose.
The module docstring explicitly describes a generic AI capability invocation tool, directly contradicting the skill's marketed specialized editing purpose. This discrepancy is a strong indicator of scope deception, which can cause users and reviewers to underestimate the code's real powers and approve access they otherwise would not grant.
The wrapper exposed to users is still a generic short-drama video generation tool rather than a dialogue-editing or silence-removal utility. In skill ecosystems, deceptive or overstated specialization is dangerous because users may provide media and credentials under false assumptions about what actions the tool can perform.
The skill advertises and demonstrates shell execution, local file access, environment-variable use, and networked API interaction, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an avoidable trust and containment gap: a host may permit more capability than users expect, and reviewers cannot easily verify whether the skill's operational surface is intentionally limited.
The skill describes uploading media, polling remote tasks, and downloading results, but it does not present a clear user-facing warning that local files and possibly sensitive media will be transmitted to an external service. For media-editing workflows, source footage may contain private faces, voices, unreleased ads, or customer data, so missing disclosure materially increases privacy and compliance risk.
The trigger language is broad enough to match ordinary conversation about editing, silence removal, denoising, pacing, and related creative tasks. In a skill with shell, file, network, and env capabilities, accidental invocation can cause unintended local processing or external data transfer, making overbroad activation a real security and privacy risk.
The display name, short description, and default prompt are all written in Chinese, which may effectively force a specific language experience for users. There is no indication that users can opt into another language or that the locale constraint is intentional and justified for a region-specific use case.
The skill enables implicit invocation without any narrowly scoped trigger, exclusions, or clear activation boundaries. That increases the chance the agent will auto-select this skill in unrelated contexts, causing unintended use of media-processing and rewriting capabilities on user content or broadening prompt-injection exposure through over-permissive routing.
The file hard-codes Chinese-language descriptions and skill identifiers such as "短剧对白剪辑与静音处理" in the module docstring, CLI parser description, and output data. This imposes a specific language/locale behavior with no user opt-in or explanation that the skill is intentionally region-specific.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(args: list[str]) -> None:
print(" ".join(args))
subprocess.run(args, check=True)
def main() -> None:
The top-level documentation explicitly describes a 'general AI capability invocation tool,' contradicting the manifest's narrower description. This inconsistency increases the chance that reviewers, users, or automated systems will mis-scope trust and permissions, especially because the code performs networked operations against external APIs and downloads results.
This Python file contains user-facing descriptions, prompts, help text, and operational guidance almost entirely in Chinese, starting from the module docstring and continuing throughout the CLI UX. Because there is no indication that users can choose another language or that the skill is restricted to a Chinese-speaking context, this creates a locale/language policy issue under the rule for natural-language policy violations.
The skill can call user-info to retrieve account information and wallet balance even though that is unrelated to the declared editing workflow. Unnecessary access to account metadata expands the privacy and reconnaissance surface, and in a misleadingly labeled skill this makes abuse or overscoped deployment more plausible.
The module docstring is entirely in Chinese and presents the tool as a general-purpose skill, while later prompts and operational messages are also Chinese-only. For a general skill, this constitutes a natural-language locale constraint without any explicit user choice or justification.
Retrieving user account information and wallet balance is unrelated to drama dialogue editing and silence handling, creating unnecessary access to sensitive billing/account data. Even if intended for convenience, exposing this endpoint increases privacy and reconnaissance risk if the skill is invoked in broader automation contexts.
Enumerating all TEXT, IMAGE, and VIDEO models is broader than necessary for a specialized editing skill and reveals platform capability inventory that can be abused for reconnaissance or policy bypass attempts. In context, the mismatch makes the skill more dangerous because it disguises a general-purpose AI control surface as a narrow production utility.
The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill offers a language choice or that the locale restriction is intentional and documented.
Detected: suspicious.exposed_secret_literal