AI大模型专家｜豆包 AI搜索收录与引用

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:09 AM UTC
• Version: 1.0.0

Overview

The skill openly combines Doubao search/citation planning with AI-HIVE image and video generation, but users should treat it as a credential-backed paid media tool, not just advice.

Install only if you intend to use AI-HIVE for planning plus image/video generation. Keep the API key private, prefer environment variables or review ~/.ai-hive/config.json, confirm before uploading local media or submitting generation jobs, and watch for costs tied to the AI-HIVE account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and documents shell execution, environment-variable use, network access, and local file read/write behaviors, but no explicit permissions are declared. That creates a transparency and consent gap: users may invoke code that uploads media, stores config under the home directory, or downloads results locally without a clearly declared capability boundary. In this context, the risk is elevated because the skill is positioned as planning/search-operations assistance, yet it also drives operational automation touching credentials, files, and remote APIs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose emphasizes search strategy, content structure, and planning, but the referenced behaviors extend into credential setup, browser opening, account/balance queries, model selection, general chat calls, media upload, and local download. This mismatch is dangerous because users may trust the skill as a low-risk advisory tool while it actually performs higher-risk operational actions involving secrets, billing-sensitive APIs, and data transfer to remote services. The surrounding context makes it more dangerous, not less, because the skill blends business-planning language with broad execution capability that could incur cost or expose local/remote data.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The packaged skill behavior materially diverges from its declared purpose: metadata says Doubao search/citation planning, but the code exposes an AI-Hive image-generation wrapper bound to GPT Image 2. This is dangerous because users and higher-level agents may grant permissions, provide prompts/files, or make trust decisions based on the declared purpose while the actual code performs unrelated media generation and external API interactions.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: A broad generic client for text, image, video, audio upload, and task polling is embedded in a skill advertised for search/citation work. Even if not all capabilities are exposed by the final CLI, bundling unrelated media-generation and upload code increases attack surface, obscures true data flows to third-party services, and makes capability drift easier in a misleading skill context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file exposes broad account and platform operations such as user-info, model listing, upload token creation, upload completion, chat, and media generation APIs that are unrelated to the declared Doubao search/citation planning purpose. In a skill ecosystem, this creates a scope mismatch that can be abused to turn a seemingly narrow planning skill into a general-purpose API client using the user's AI Hive credentials and media assets.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The code performs full image/video generation workflows and downstream result downloading, which materially exceeds a search/citation planning assistant's expected behavior. This enables unadvertised consumption of paid generation resources, handling of user media, and retrieval of remote content under the guise of a different skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The interactive init flow opens a browser and guides the user through API-key onboarding, which is unnecessary for a Doubao search/citation expert and increases credential collection capability. Even though it does not directly exfiltrate the key, it normalizes credential entry and broadens the skill from content planning into account bootstrap and secret handling.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The embedded SKILL_CONFIG repurposes the file into a short-drama video generator with specific video-generation models, directly contradicting the published Doubao search/citation positioning. This hidden capability mismatch is dangerous because users and reviewers may grant trust or permissions based on the manifest while the code performs materially different, higher-risk actions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill enables implicit invocation without any visible trigger constraints, scope limits, or exclusion conditions. That increases the chance the agent will auto-select this skill in loosely related contexts, causing unintended routing, unexpected disclosure of project context to the skill, or unreviewed execution of its workflow.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:133