AI大模型专家｜短剧台词旁白

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:09 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI-HIVE short-drama planning and media-generation workflow, with expected API-key, upload, polling, and download behavior but some broad helper code users should understand before use.

Install only if you are comfortable giving the skill an AI-HIVE API key, sending selected local media to AI-HIVE/object storage, and saving generated outputs locally. Avoid uploading confidential or unlicensed media, watch for API costs, and prefer --no-download when you only want task metadata.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises and demonstrates shell execution, environment-variable access, file I/O, and network/API usage, but does not declare any permissions or capability boundaries. This is dangerous because users and hosting platforms cannot accurately assess what the skill can access, increasing the risk of over-privileged execution, unsafe secret handling, and unintended local or network side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior extends well beyond short-drama planning into generic model access, account/wallet queries, arbitrary media generation, multimodal chat, and local credential setup. This mismatch is dangerous because users may grant trust, secrets, or execution authority based on a narrow declared purpose while the skill actually enables broader account, billing, and data-handling operations that can incur charges or expose sensitive information.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file advertises itself as a generic AI Hive OpenAPI client with chat, image, video, model listing, upload, and task polling, which materially exceeds the manifest’s claimed short-drama dialogue/voiceover purpose. This capability mismatch is dangerous because it can mislead users and reviewers into granting trust or permissions to a tool that performs broader networked operations, including account inspection, file upload, and remote content download.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The embedded SKILL_CONFIG markets the script as a GPT Image 2 image-generation/editing skill, directly contradicting the top-level skill metadata describing a drama-dialogue/voiceover planner. Such contradictory identity signals are a supply-chain risk because they obscure the real function of the code and can bypass user expectations or governance controls tied to the declared skill type.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The user-info command retrieves account and wallet information unrelated to a drama-dialogue/voiceover writing skill. In this context, exposing account inspection broadens the data-access surface and may disclose sensitive billing or account metadata to users or workflows that did not expect financial/account operations.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The models command enumerates all available backend models, which is broader than needed for a narrowly scoped drama-dialogue/voiceover tool. While not inherently malicious, it exposes backend capability inventory and expands misuse potential by turning the skill into a general discovery interface for unrelated AI services.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The standalone upload and download flows allow arbitrary local files to be sent to remote storage and arbitrary URLs from task results to be fetched to disk, which is much broader than a writing-focused skill implies. In a misrepresented skill, these file-transfer capabilities increase the risk of unintended data exfiltration, storage of sensitive media, and unreviewed content retrieval.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module docstring explicitly describes a 'general AI capability invocation tool,' conflicting with the skill’s declared specialized purpose. This mismatch undermines transparency and safe review because the code itself signals a broader operational scope than users would infer from the manifest.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file is presented as a narrow short-drama dialogue/voiceover skill, but the implementation is a broad AI Hive client exposing chat, model enumeration, media upload, video generation, and result download. This capability mismatch is dangerous because users or higher-level agents may grant trust, data, or permissions based on the benign-seeming manifest while the code performs much broader remote operations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes a user-info endpoint that can retrieve account and wallet details even though that capability is unrelated to short-drama dialogue/voiceover work. In an agent ecosystem, unnecessary account-inspection features increase the attack surface and can leak sensitive billing or identity information if the skill is invoked unexpectedly.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The module docstring openly describes a generic multi-capability AI tool, which conflicts with the much narrower marketplace positioning. This discrepancy is security-relevant because it can mislead users, policy engines, and reviewers about what data flows and remote actions the skill actually performs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill uploads arbitrary user-provided media to remote services and object storage without an explicit privacy notice, data-handling explanation, or confirmation step. This is dangerous because users may unknowingly send sensitive local files, and the mismatch between advertised purpose and actual network transfer makes unintended disclosure more likely.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The skill downloads remote content and writes it to a local output directory automatically, without clearly warning the user that new files will be created. While the write location is constrained and filenames are locally generated, silent file creation can still surprise users and consume disk space or store unwanted content.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:128