AI大模型专家｜Gemini API中转

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it should be reviewed because a Gemini-relay listing actually runs AI-HIVE image/video workflows that store an API key and can upload media or submit paid generation tasks.

Install only if you intend to use AI-HIVE image/video generation and are comfortable providing an AI-HIVE API key. Use a limited/revocable key, watch account balance or usage charges, avoid uploading sensitive media, and consider disabling implicit invocation or requiring explicit confirmation before any init, upload, or generate command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises shell, network, environment-variable, and file read/write driven workflows but does not declare permissions. This creates a trust and review gap: users or hosting platforms cannot accurately assess that the skill can access local files, invoke commands, persist data, and reach external services, which is especially sensitive for a skill centered on API keys and relay operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose focuses on Gemini/API relay management, but the referenced behavior includes broader capabilities such as chat/text calls, user/balance queries, browser-based key acquisition, local key persistence, and fixed image/video generation workflows. This mismatch is dangerous because users may grant trust or run setup steps under a narrower mental model while the skill can access credentials, account metadata, and unrelated generation endpoints, increasing the risk of over-collection, unintended charges, and misuse of sensitive API keys.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill-specific wrapper presents itself as a constrained GPT Image 2 image-generation tool, but still exposes generic `task` lookup and arbitrary file `upload` commands inherited from the broader relay client. This expands the capability surface beyond the declared purpose and can let an agent or user interact with unrelated tasks or stage arbitrary media in the backend, violating least-privilege expectations for a narrowly scoped skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file header and behavior do not match the advertised skill metadata. Instead of acting as a Gemini API relay or unified API-management tool, this code is a vendor-specific AI Hive client for chat/image/video generation, which can mislead users into supplying credentials or running functionality they did not intend. In a security-sensitive skill ecosystem, capability misrepresentation is dangerous because trust decisions are based on the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The embedded SKILL_CONFIG identifies the tool as a short-drama video generator using specific AI Hive model IDs, not a Gemini relay. This deep mismatch reinforces that the package is presenting one identity externally while executing a different workflow internally, increasing the risk of deceptive deployment and unauthorized credential collection for an unrelated service.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill enables implicit invocation with no documented activation boundaries, exclusions, or consent checks. That increases the chance the agent is auto-selected in unrelated contexts, which is risky here because the skill is positioned around API relay, routing, key management, audit, and enterprise workflow design, making accidental invocation more likely to expose sensitive operational guidance or trigger high-trust actions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:126