T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imagegen.py:89- Finding
API Credential Disclosure Through an Unrestricted Endpoint Override
- Content
View full analysis
- Remediation
View remediation
Security audit
批量素材重复度检测｜AI-HIVE
Security checks for vulnerabilities and agentic risk
Overview
This skill is framed as duplicate-checking and quality review, but its shipped tools mainly generate/upload/download AI media and include credential and file-write risks that need review before installation.
Review this as a media-generation/API integration skill, not just a duplicate-checking helper. Only install it if you intend to use AI-HIVE with billable generation, media uploads, local downloads, and a locally stored API key; avoid custom base URLs unless independently trusted, and do not rely on it for actual duplicate detection without separate tooling.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:325- Finding
Untrusted Service Responses Control Download Sources and Output Paths
- Content
View full analysis
0: pct = int(downloaded * 100 / total) bar = "█" * (pct // 5) + "░" * (20 - pct // 5) print(f"\r {bar} {pct}% ({downloaded // 1024}KB)", end="", flush=True) print() size_mb = downloaded / (1024 * 1024) print(f"[ok] {out_path} ({size_mb:.1f} MB)") except requests.exceptions.RequestException as e: print(f"\n[error] Download failed: {e}", file=sys.stderr) ``` ```python out_dir = Path(output_dir) out_dir.mkdir(parents=True, exist_ok=True) task_type = task.get("taskType", "task") for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) for item in succeeded: last_frame = item.get("lastFrameUrl") if last_frame: out_path = out_dir / f"{task_type}_{task_id}_lastframe.png" download_file(last_frame, out_path) ``` ### Technical Analysis The task response controls `r ...[truncated 2271 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/imagegen.py:7- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill's declared primary function is duplicate-detection/quality checking, but the examples and implied behavior support AI video generation and other generic model operations instead. Such deceptive or sloppy scoping increases risk of unauthorized content creation, external data transfer, and unexpected billing under the guise of a lower-risk analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared primary function is duplicate-detection/quality checking, but the examples and implied behavior support AI video generation and other generic model operations instead. Such deceptive or sloppy scoping increases risk of unauthorized content creation, external data transfer, and unexpected billing under the guise of a lower-risk analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared primary function is duplicate-detection/quality checking, but the examples and implied behavior support AI video generation and other generic model operations instead. Such deceptive or sloppy scoping increases risk of unauthorized content creation, external data transfer, and unexpected billing under the guise of a lower-risk analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared primary function is duplicate-detection/quality checking, but the examples and implied behavior support AI video generation and other generic model operations instead. Such deceptive or sloppy scoping increases risk of unauthorized content creation, external data transfer, and unexpected billing under the guise of a lower-risk analysis utility.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill for batch duplicate detection, creative similarity analysis, and optionally AI-HIVE-based generation workflows such as configuration lookup, upload, routing, polling, and download. This file instead implements local ffmpeg-based video editing operations like trim, aspect-ratio conversion, muting, loudness normalization, and concatenation, with no duplicate-analysis logic or AI-HIVE integration.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file header and overall implementation do not match the advertised duplicate-checking purpose of the skill. Instead of analyzing similarity or deduplication, the code exposes generic AI-Hive chat, image generation, and video generation flows, which can cause capability confusion and let callers invoke materially different behavior than the skill promises.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Video generation is a materially different and higher-risk capability than duplicate checking, especially in a skill explicitly framed as QA/deduplication tooling. Keeping this code in the same skill creates hidden functionality that could be invoked or repurposed to generate media under a misleading trust boundary, undermining governance, billing controls, and content policy enforcement.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The fixed skill configuration advertises batch duplicate-checking, but the generate path hardcodes a model and forwards all requests directly into cmd_image, making the effective behavior image generation only. This mismatch is dangerous because downstream systems or users may trust the skill for review/QA while it actually creates content, enabling policy bypass or unauthorized content generation under a misleading label.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is presented as a duplicate-checking and quality-inspection tool, but the implemented entrypoint and skill-specific logic are for video generation through external AI Hive generation APIs. This mismatch can deceive users or higher-level agents into uploading media and issuing prompts under a benign inspection pretext, while actually invoking content generation workflows with different policy, cost, and abuse implications.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The embedded metadata, title, keywords, and examples claim a batch duplicate-detection use case, while the parser and dispatch path expose only generate/task/upload operations for video creation. This kind of semantic disguise is dangerous because orchestration systems may approve or route the skill based on its declared low-risk purpose, enabling unreviewed generative behavior and external media exfiltration.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises runnable commands that imply access to environment variables, local files, network calls, and shell execution, but it declares no explicit tool scope or permissions. This creates an overprivileged/ambiguous execution model where an agent may invoke sensitive capabilities without clear guardrails, increasing the chance of secret exposure, unintended filesystem access, or external requests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation expands from duplicate checking into broader content-generation assistance, including transforming reference cases into 'original' content. In this context, scope expansion is risky because it can facilitate copyright-adjacent imitation workflows and lead agents to perform higher-risk generation tasks than users intended from the skill name and framing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation conditions are broad and business-intent driven, covering many marketing and ecommerce scenarios without tight operational boundaries. Overbroad triggers can cause the skill to be selected in contexts where users did not consent to media generation, external API use, or handling of sensitive commercial assets, increasing the chance of misuse and overreach.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The runnable examples emphasize image/video generation, task submission, polling, and editing rather than duplicate-detection operations. This is dangerous because examples are often treated as the authoritative behavior of a skill, so an agent may execute cost-incurring or data-exporting workflows even though the skill is branded as a checking tool.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The natural-language string in the default prompt instructs the skill to produce a 'production-ready Chinese workflow', which imposes a specific language choice by default. This is a locale/language policy issue because the file does not offer the user a language choice or indicate that Chinese output is optional.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Enabling implicit invocation without clear trigger constraints allows the skill to activate in broader contexts than intended, which can cause unreviewed prompt injection of its workflow instructions into unrelated user sessions. Because this skill can generate production-ready workflows and runnable AI-HIVE commands for bulk media processing, accidental activation increases the risk of unintended external API usage, scope creep, and user confusion about what actions are being prepared.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python skill includes its primary description and operational guidance entirely in Chinese, and later user prompts and CLI help are also Chinese-only. That imposes a specific language on all users without an explicit opt-in or alternative, which matches the language/locale policy violation criteria.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
A batch creative duplicate-checking skill may need media upload and analysis, but a full generic text chat endpoint is not an obvious or declared requirement of that purpose. This broadens the skill into general conversational AI beyond duplicate detection or quality checking.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Within this skill context, the inline guidance explicitly steers users to reuse uploaded media for chat/image/video generation workflows. That documentation conflicts with the advertised duplicate-checking purpose by describing the skill as a generic generation helper rather than an analysis tool.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and all user-facing help/instructions are written in Chinese, which effectively fixes the interaction language for this skill. The file does not offer a language choice or document that the skill is intentionally region-specific, so this is a natural-language locale policy concern.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a skill for batch image/video duplicate detection, creative similarity analysis, and AI-HIVE generation workflow support. This script only collects basic project metadata and writes a JSON draft with generic fields such as project, audience, goal, and platform, without any duplicate-check inputs like media batches, thresholds, grouping, or AI-HIVE API workflow configuration.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code embeds Chinese-only natural-language strings in the docstring, argument parser description, skill name, and search aliases. Under the policy rule for language/locale, this can be a violation because the skill appears to assume a fixed language without documenting user opt-in or offering a locale choice.
- Content
Static analysis
No suspicious patterns detected.