Security audit

AI批量短视频生产工作流｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE short-video workflow helper that uses user-provided API credentials, uploads selected media, submits video jobs, and downloads results.

Install only if you are comfortable using AI-HIVE with your own API key. Treat generation as potentially billable, review prompts and media before submission, upload only assets you are authorized to use, and prefer an environment variable if you do not want the init command to store the key under ~/.ai-hive/config.json.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises executable workflows and code examples that use environment variables, local files, network access, and shell commands, yet no explicit permissions are declared. That creates a transparency and policy-enforcement gap: users or hosting systems may underestimate what the skill can access or trigger, increasing the chance of unintended data exposure, credential misuse, or unreviewed external calls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is a constrained batch short-video production workflow, but the underlying behavior reportedly includes broader capabilities such as querying user account and wallet information, generic model listing, generic chat and image generation, and interactive API-key setup with local credential storage. This mismatch is dangerous because it expands the attack surface beyond user expectations, enabling access to sensitive account data and persistent local secrets under the cover of a narrower advertised function.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The file is implemented as a broad AI Hive client for chat, image, video, uploads, model listing, and account inspection, while the declared skill is narrowly about batch video production. This capability mismatch increases attack surface and enables use of the skill for unintended operations that a caller may not expect or authorize.

Context-Inappropriate Capability

Low

Confidence: 79% confidence
Finding: The skill exposes a user-info endpoint that returns account information and wallet balance, which is not necessary for producing batch videos. Even if not directly secret-bearing, this discloses account metadata and billing context beyond the stated purpose, violating least privilege.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The generic text chat command allows arbitrary prompts and optional system instructions, which goes beyond a specialized video-generation workflow. In a skill expected to only orchestrate batch video production, this can be repurposed as an unrestricted general AI endpoint using the same stored credentials.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The image-generation command is a standalone generic generation capability rather than a tightly scoped helper for the declared batch-video workflow. This broadens what a caller can do with the skill and may consume credits or create content outside the user's authorization expectations.

Intent-Code Divergence

Medium

Confidence: 76% confidence
Finding: The module docstring advertises a generic AI capability tool, contradicting the specialized batch-video description in the metadata. That mismatch is a strong signal that the implementation intentionally or carelessly exposes more functionality than reviewers and users would infer from the manifest.

Static analysis

No suspicious patterns detected.