批量素材重复度检测｜AI-HIVE

• Outcome: Review
• Latest audit: Aug 24, 2026 · 4:16 PM UTC
• Version: 1.0.0

Overview

This skill needs review because it is labeled as duplicate checking but mainly provides AI-HIVE media generation, upload, download, and editing workflows that can use local media, API credentials, and billable remote tasks.

Install only if you want an AI-HIVE media generation/editing workflow as well as planning guidance for duplicate review. Do not use it with sensitive or unlicensed media unless you are comfortable uploading those files to AI-HIVE, and require explicit confirmation before any generation call that may spend credits.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill exposes operational capabilities including environment variable access, filesystem reads/writes, shell execution, and network access without declaring permissions or constraining their use. This is dangerous because users and hosting platforms may treat the skill as low-risk duplicate checking while it can actually invoke external services, process local files, and run commands, increasing the chance of secret exposure, unintended file access, or command misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose says the skill performs duplicate/similarity checking, but the behavior expands into generic AI chat, media generation, wallet/model queries, uploads, polling, downloads, and ffmpeg-based editing while lacking actual duplicate-detection logic. This mismatch is dangerous because it can mislead reviewers and users into authorizing a QA tool that in practice can generate content, transmit assets to third parties, incur charges, and handle media in ways outside the stated trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The code examples actively perform image and video generation and encourage use of external APIs with local media inputs, which exceeds a pure review/deduplication role. In context, this is dangerous because users may submit sensitive or copyrighted assets expecting analysis only, while the skill can upload them externally, trigger billable jobs, and create new content under a misleading QA-oriented label.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file implements local video editing actions such as trim, aspect conversion, mute, loudness normalization, and concatenation, but the skill metadata describes duplicate-checking and AI-HIVE workflow orchestration. This capability mismatch is dangerous because it expands the skill's effective privileges and behavior beyond declared purpose, making covert content manipulation easier to hide inside a supposedly analysis-only skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The local modification commands directly alter media content and can concatenate arbitrary user-supplied files, which is not justified by a duplicate-checking workflow. In context, this makes the skill more dangerous because a user or downstream agent may trust it as a checker while it actually provides transformation primitives that could be repurposed for unauthorized content rewriting or concealment of manipulations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The packaged skill is presented as a batch duplicate-checking tool, but the actual exposed workflow is an AI image generation wrapper with media upload, task polling, and result download. This mismatch is dangerous because users or orchestrators may grant it access to sensitive creative assets expecting analysis-only behavior, while the skill instead transmits those assets to a remote generation API and performs materially different actions.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The file contains a general text chat capability unrelated to the advertised duplicate-checking purpose. Extra undocumented capabilities expand the attack surface and can be invoked by an agent or operator who trusts the skill's narrower description, leading to unreviewed data egress to the external API.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The module also supports video generation and uploading even though the packaged wrapper is framed as an image-focused duplicate-checking skill. Hidden or unrelated media-generation features increase the chance that sensitive user media is uploaded or transformed under false assumptions about the tool's scope.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The module docstring explicitly describes a general AI capability caller, which contradicts the packaged identity as a batch duplicate-checking skill. In security-sensitive agent systems, this kind of identity/capability mismatch undermines trust boundaries and can cause reviewers or automated policy layers to approve a tool for a narrower purpose than it actually serves.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file is presented as a batch duplicate-checking skill, but its implementation is a general AI-Hive client for chat, image generation, and video generation. This capability mismatch is dangerous because users and orchestrators may grant it access or invoke it under a lower-risk classification while it performs unrelated content-generation actions, including creating new media instead of analyzing existing assets.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill-specific generate entrypoint for a supposed duplicate-checking skill routes directly into video generation via model selection and cmd_video(). In context, this is more dangerous because the deceptive packaging can cause automated systems or users to approve a deduplication tool that actually uploads media and triggers remote generation jobs, expanding both cost and data-exposure risk.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The skill parser description identifies the tool as a raw video skill, contradicting the advertised duplicate-checking use case. While not an exploit primitive by itself, this inconsistency is a security-relevant deception signal that increases the likelihood of misuse, mistaken approval, and unsafe invocation in environments that rely on metadata for trust decisions.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code exposes generic account inspection and model-discovery capabilities unrelated to duplicate checking, such as querying user info and available models. In a narrowly scoped skill, unnecessary capabilities enlarge the attack surface and permit unintended data access or reconnaissance against the linked AI-Hive account.

Static analysis

No suspicious patterns detected.