Security audit

AI视频穿帮检测｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE media QA workflow with optional generation/editing helpers, and I found no hidden exfiltration, destructive behavior, or automatic privileged execution.

Install only if you intend to use AI-HIVE for Chinese-language video QA workflows and optional paid media generation. Review commands before running them, use only media you are authorized to upload, keep the API key out of logs and repositories, and do not treat the included scripts as a complete automated continuity-audit engine.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises executable capabilities including environment access, file read/write, network access, and shell usage, yet provides no explicit permission declaration or scoping. This weakens security review and user consent because a seemingly narrow media-QA skill can invoke broad local and remote actions, increasing the chance of unintended data exposure, filesystem changes, or outbound requests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is a continuity-checking skill, but the file also includes broader functions such as general image/video generation, wallet or user-info querying, browser-style API-key setup, credential storage, and ffmpeg editing workflows. This mismatch is dangerous because it can cause users or orchestrators to grant trust and invocation to a skill believed to be review-only, while it actually has materially broader execution and data-handling behavior.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill markets itself as an AI video continuity-check tool, but the exposed skill entrypoint only supports image generation, task lookup, upload, and API-key initialization. This mismatch can mislead users and upstream agents into sending sensitive review materials or trusting continuity-audit results that are never actually produced, creating integrity and workflow-security risk through deceptive capability claims.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: Inline metadata and CLI descriptions claim a video continuity-check skill, while the actual behavior forwards prompts to an image-generation model (`public_model_gpt_image_2`). In an agent ecosystem, deceptive metadata is security-relevant because routing and trust decisions may rely on the declared purpose, causing inappropriate handling of user data and false assurances about review outcomes.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file is presented as a video continuity/quality-checking skill, but its implemented capabilities are a general AI Hive client for chat, image generation, and video generation. This mismatch can cause callers, reviewers, or policy systems to grant the skill broader trust or permissions than intended, enabling use for unrelated and potentially unsafe content generation under a misleading label.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill-specific generate path routes directly into video generation rather than performing continuity inspection on existing media. In the context of a skill advertised for QA/review, this creates a deceptive capability boundary that could be abused to generate synthetic media where only analysis was expected.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The configuration and parser describe the tool as 'AI视频穿帮检测', but the operational flow is a wrapper around video generation APIs. This inconsistency undermines security review and user consent because the declared purpose does not match the actual actions the code performs.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger conditions are broad business-context phrases, which can cause the skill to activate for many loosely related requests. Over-broad routing is risky here because the skill has network, shell, file, and generation behaviors, so accidental invocation could expose user assets, start costly actions, or steer workflows into an unnecessarily powerful tool.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Implicit invocation is enabled with no visible trigger constraints, exclusions, or authorization checks, which increases the chance this skill is auto-selected in contexts the user did not explicitly intend. Because the skill can turn requests into runnable AI-HIVE commands and workflow outputs, accidental invocation could cause unintended external API usage, processing of sensitive media, or policy-sensitive assistance without clear user consent.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The default prompt hard-codes Chinese output rather than adapting to user preference, which can reduce transparency and user comprehension if the user expects another language. In a security-relevant workflow, language forcing can cause users to misunderstand generated commands, quality checks, or policy boundaries, increasing the risk of misuse or accidental approval of unsafe actions.

Static analysis

No suspicious patterns detected.