ClawHub
Back to skill

Security audit

AI大模型专家｜桌面智能体一站式工作台｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with an AI-HIVE workflow purpose, but it needs review because its helper can send an API key to an environment-selected server and its activation/safety controls are broader than the code enforces.

Review before installing. Use it only if you intend to work with AI-HIVE, keep AI_HIVE_API_KEY in a trusted environment, and do not set AI_HIVE_BASE_URL unless the destination is known and trusted. Require explicit confirmation before any paid, bulk, public-posting, deletion, or permission-changing action, and treat pause/revoke/audit claims as workflow instructions rather than guaranteed controls.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'req' from os.environ.get (line 28, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
url += "?" + urllib.parse.urlencode({"modelType": args.type})
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.load(resp)
    except Exception as exc:
        raise SystemExit(f"模型查询失败：{exc}") from exc
Confidence
81% confidence
Finding
The request sent to urlopen includes a bearer token sourced from an environment variable, and the destination base URL is also overrideable via AI_HIVE_BASE_URL. If that environment variable is manipulated, the script will transmit the secret API key to an attacker-controlled endpoint, creating a real credential exfiltration/SSRF-style risk despite the code's otherwise legitimate purpose.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill includes executable examples that rely on environment variables, local file I/O, and network access, yet no explicit permissions are declared. This creates a transparency and governance gap: users and hosting platforms may not realize the skill can access secrets, read/write local artifacts, and contact external services, which weakens review, consent, and sandboxing controls.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The skill materially overstates its operational safety and capabilities, claiming visible/pausable/revocable high-risk actions, runtime pricing queries, routing behavior, task/result persistence, and desktop workflow integration that are not actually implemented in the referenced behavior. This mismatch is dangerous because users may trust nonexistent safeguards and authorize sensitive actions under false assumptions about auditability, reversibility, and cost control.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill enables implicit invocation with no visible trigger constraints, so the agent may activate this skill based on broad keyword matches or weak relevance signals rather than clear user intent. In this skill’s context—desktop agent orchestration, model routing, task execution, and record saving—unexpected activation can cause unintended tool use, persistence of task data, or autonomous high-impact actions that the user did not explicitly request.

Static analysis

No suspicious patterns detected.