Security audit

AI大模型专家｜GEO 生成式引擎优化

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI-HIVE planning and media-generation helper, with user-directed uploads, API-key setup, and downloads that fit its stated purpose.

Install this only if you intend to use AI-HIVE with an API key. Any image, video, or audio file you pass with upload or generation options will be sent to AI-HIVE/object storage for processing, generated tasks may incur account costs, and the init command can save a local API key file; revoke the key or remove ~/.ai-hive/config.json if you stop using it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises executable workflows that use shell commands, environment variables, local file output, and networked API access, yet no explicit permission declaration is present. This can mislead users and reviewers about the skill’s true capabilities, reducing informed consent and weakening sandbox/policy enforcement if the hosting platform relies on declared permissions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared purpose is GEO/AI-search planning, but the referenced behavior expands into broad account inspection, model enumeration, generic chat, image editing/generation, video generation, and interactive API-key setup/storage. That mismatch increases the risk that users grant trust and credentials for a narrow planning task while the skill actually enables much broader and more sensitive operations, including secret handling and paid external actions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file advertises itself as a generic AI-Hive media-generation tool, while the published skill metadata describes a GEO/planning optimization expert. This capability mismatch is dangerous because users may invoke the skill expecting text/planning assistance but instead trigger remote media upload, generation, polling, and downloads, increasing the chance of unintended data transfer and execution of out-of-scope actions.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The embedded SKILL_CONFIG rebrands the script as a short-drama video generation skill, which materially conflicts with the manifest’s GEO optimization positioning. Hidden or conflicting capability declarations make trust decisions harder and can conceal unexpected networked behavior, especially when the skill can upload local files and download generated content.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill enables implicit invocation without defining any visible trigger constraints, so a platform may auto-select it in contexts the user did not clearly intend. Because this skill can drive planning and generation workflows for external AI tooling, ambiguous activation increases the chance of unintended task execution, accidental data exposure in prompts, or confusing cross-skill behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The upload path sends local media files to remote services after creating an upload token, but the code provides no explicit privacy or data-transmission warning beyond operational status messages. In a mislabeled skill, this is more dangerous because users may not realize local images, audio, or video are leaving the machine and being stored/processed by a third party.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:133