AI模型任务失败修复｜AI-HIVE

• Outcome: Review
• Latest audit: Aug 24, 2026 · 3:34 PM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it needs Review because broad auto-activation is paired with API-key use, external uploads, billable AI generation, local downloads, and media editing.

Install only if you intend to use AI-HIVE for authorized task repair and content generation. Disable or narrow implicit invocation, review any command before running it, confirm costs before generation, avoid uploading files you are not allowed to share, and prefer explicit API-key handling if you do not want credentials persisted under ~/.ai-hive.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exposes operational capabilities including environment-variable access, filesystem interaction, shell usage, and network calls without declaring permissions or clearly constraining how those capabilities are governed. In an agent setting, this creates a trust-boundary problem: users or reviewers may believe the skill is primarily advisory, while it can in practice perform actions that touch secrets, local files, and external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose frames the skill as task diagnosis and repair, but the content includes much broader execution behavior: general chat calls, asset generation, downloads, local config storage, and ffmpeg-based media processing. This mismatch is dangerous because it can mislead operators into invoking a skill with broader side effects than expected, including billable API usage, local file modification, and data exfiltration to third-party services.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements a local ffmpeg-based media editing utility, while the declared skill purpose is AI task failure repair and AI-HIVE/OpenAPI retry orchestration. This scope mismatch is dangerous because hidden or unjustified capabilities can be used to process local media outside expected authorization boundaries, weakening reviewability and enabling unadvertised data handling in a security-sensitive agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code provides trimming, aspect-ratio conversion, muting, loudness normalization, probing, and concatenation of local media files, none of which are clearly necessary for diagnosing authentication, parameter, routing, or async-status failures in AI model tasks. In a skill that is supposed to repair API/model task failures, these extra transformation features increase the attack surface and create opportunities for unauthorized local content manipulation or misuse of the agent as a general-purpose media processor.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file is packaged as a task-failure repair skill, but the module implements broad AI chat, image generation, video generation, upload, download, and polling capabilities. This violates least privilege and skill-boundary expectations: an agent invoking a narrowly scoped repair skill could be tricked into performing arbitrary content generation and external API actions outside the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The embedded skill entrypoint routes directly into a video-generation workflow (`generate`, `upload`, `task`) rather than a repair-oriented interface. In an agent ecosystem, this creates a capability mismatch that can be abused to get the agent to generate or upload media under the guise of fixing failed tasks, expanding both operational and policy risk.

Vague Triggers

Medium

• Confidence: 75% confidence
• Finding: Using the broad trigger phrase '任务修复' makes the skill easy to activate outside its intended AI-HIVE task-repair context. Overbroad invocation increases the chance that unrelated user requests are routed into a skill that can perform networked, file, and execution-adjacent operations, causing unintended actions or data handling.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The default prompt uses broad activation language ('Use $ai-model-task-repair-ai-hive to turn my request...') without narrowing when the skill should apply. This can cause the agent to invoke a task-repair workflow in situations where the user did not explicitly request it, increasing the chance of inappropriate handling of sensitive task data, unintended API-oriented actions, or confusing takeover of unrelated requests.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: Enabling implicit invocation without defined activation criteria allows the skill to auto-trigger based on loose semantic matches rather than explicit user consent. In a skill that handles retries, routing strategies, task restoration, and potentially external API workflows, this raises the risk of unintended operational guidance, accidental use in disallowed contexts, or over-collection/use of task identifiers and error payloads.

Static analysis

No suspicious patterns detected.