Security audit

汽车功能演示视频｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE automotive video workflow with expected network uploads, local media handling, and API-key setup, but users should review its broad activation settings.

Install this only if you are comfortable using AI-HIVE for automotive video work, uploading authorized media to that service, and storing an AI-HIVE API key locally. Review generated commands before running them, confirm pricing and routing before paid generation, and avoid using it for copyrighted reference copying, unverified vehicle claims, or assets you are not allowed to upload.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises executable scripts, shell commands, network access, local file processing, and environment-variable use, yet no explicit permissions are declared. This creates a trust-boundary problem: a caller or reviewer may believe the skill is documentation-only while it can actually access secrets, read/write local files, invoke external services, and run local tooling like ffmpeg.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose is a narrow automotive feature-demo workflow, but the finding indicates broader latent capabilities: general text/image generation, account and wallet retrieval, model enumeration across types, standalone uploads, and local media editing. This mismatch is dangerous because users and policy controls may grant access based on a narrow use case while the skill can be repurposed for wider data access, unexpected charges, or out-of-scope content generation.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file is packaged as a narrowly scoped automotive feature demo skill, but the implementation exposes a broader AI client with chat, image generation, model listing, upload, and user-info capabilities. This scope expansion weakens least-privilege boundaries and can let downstream users or agents invoke unrelated functions not implied by the skill’s declared purpose, increasing misuse and data exposure risk.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: Describing the module as a 'general AI capability invocation tool' contradicts the specialized skill declaration and signals that the artifact contains broader behavior than reviewers or orchestrators may expect. In a skill-based system, misleading scope documentation is security-relevant because trust and approval may be granted based on the declared narrow purpose while the code retains general-purpose capabilities.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The top-level CLI advertises a generic AI Hive tool, which can mislead operators into using or approving the package outside its reviewed automotive skill scope. While mainly a documentation/interface issue, it contributes to capability confusion and makes policy bypass via alternate entrypoints more plausible.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The trigger phrases include very broad terms such as '汽车视频', '功能演示', '汽车广告', and 'AI汽车', which can match ordinary discussion and cause the skill to activate in contexts unrelated to the intended workflow. Overbroad triggering increases the chance that a skill with network, file, and shell-adjacent capabilities is invoked unnecessarily, expanding attack surface and raising the risk of unintended data handling or user confusion.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The default prompt is written as a broad catch-all invocation that can activate the skill for loosely related requests without clear boundaries or user confirmation. Because this skill can generate runnable AI-HIVE commands and production-ready workflows, over-broad triggering increases the chance of unintended execution paths, inappropriate content generation, or use outside the intended automotive-demo scope.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Enabling implicit invocation without precise activation rules allows the skill to be selected automatically in ambiguous contexts. In a skill that supports media-generation workflows and external API operations, this can cause the system to apply the skill when the user did not explicitly request it, creating risks of unauthorized content generation, policy bypass through context switching, or accidental execution of sensitive workflow steps.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: Forcing Chinese output without user choice is primarily a safety and control issue rather than a direct exploit primitive, but it can reduce transparency and user comprehension if the user expected another language. In security-sensitive or policy-constrained workflows, forced language output can also make it harder for users or reviewers to notice unsafe instructions, misleading claims, or compliance issues in generated commands and checklists.

Static analysis

No suspicious patterns detected.