ClawHub
Back to skill

Security audit

AI大模型专家｜电商视频

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AI-HIVE ecommerce video skill that uploads user-selected media and downloads generated results, with privacy and cost considerations but no artifact-backed malicious behavior.

Install only if you are comfortable using AI-HIVE for ecommerce video generation. Confirm the prompt, budget, and any files before generation, and do not upload confidential, regulated, or third-party media unless you have permission and understand AI-HIVE's retention terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documents capabilities to read environment variables, read/write local files, invoke shell commands, and make network requests, but does not declare permissions or present them transparently. That creates a trust and consent gap: users may trigger actions affecting local data or external services without understanding the full scope of access.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented purpose is narrowly framed as an e-commerce video generation workflow, but the behavior reportedly extends to broader AI-HIVE functions such as chat, image generation, model discovery, and account or wallet data access. This mismatch is dangerous because users may authorize or trust the skill for a limited purpose while it can access unrelated features and potentially sensitive account information.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises automatic upload of images, video, and audio to the AI-HIVE platform and automatic download of generated results, but does not clearly disclose the privacy and data-handling implications. Users may unknowingly transmit proprietary, personal, or regulated media to a third-party service, creating confidentiality and compliance risks.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill enables implicit invocation (`allow_implicit_invocation: true`) without any narrowly defined trigger constraints, so an agent may auto-select and run this capability based on broad user intent. In this skill, implicit execution is more sensitive because it can upload user-provided media, submit jobs to an external AI-HIVE service, poll task status, and download outputs, increasing the chance of unintended external data transfer and side-effectful actions.

Static analysis

No suspicious patterns detected.