ClawHub
Back to skill

Security audit

AI大模型专家｜Codex 桌面智能体全能工作台｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE workflow helper that uses an API key, network model lookup, and local plan files in ways that match its stated purpose.

Before installing, confirm you intend to use AI-HIVE and are comfortable providing an AI_HIVE_API_KEY in your environment. Review any generated execution plan before running paid, batch, publishing, deletion, or account-affecting actions.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs use of environment variables, local file inputs/outputs, and networked AI-HIVE queries, but it does not declare any permissions or capability boundaries. That creates a mismatch between documented behavior and actual operational needs, which can lead to overbroad or implicit access to files, credentials, and remote services without clear user consent or enforcement.

Static analysis

No suspicious patterns detected.