AI大模型专家｜国内 AI 中转站替代方案｜AI-HIVE

• Outcome: Review
• Latest audit: Aug 25, 2026 · 7:18 PM UTC
• Version: 1.0.0

Overview

The skill largely matches an AI-HIVE migration and media-generation workflow, but it has under-disclosed credential persistence and bundled scripts that identify a different skill.

Review before installing. Expect this skill to call AI-HIVE, upload user-selected media, submit potentially billable image/video jobs, download generated files, and run ffmpeg when you invoke those scripts. Do not use sensitive or unauthorized media, and prefer environment variables for API keys unless you are comfortable with the init command storing a key in ~/.ai-hive/config.json. The Token Hub identifiers in bundled scripts should be corrected by the publisher before broad use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and demonstrates code execution paths that use environment variables, file I/O, network access, and shell commands, but it does not declare corresponding permissions. This undermines informed consent and sandbox policy enforcement, and can lead users or host systems to expose API keys, local files, or command execution to a skill whose operational scope is not explicitly disclosed.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is evaluation and migration planning, but the content goes beyond analysis into active API use, media upload, image/video generation, result downloading, browser-assisted key setup, and ffmpeg-based video editing. That mismatch is dangerous because users may authorize what appears to be an advisory skill without realizing it can transmit local assets, incur charges, modify files, and perform broad operational actions.

Description-Behavior Mismatch

High

• Confidence: 87% confidence
• Finding: The file is materially unrelated to the declared skill purpose of evaluating AI relay platforms, pricing snapshots, routing, and migration planning. Such capability drift is dangerous because it introduces an unexpected local media-processing surface via ffmpeg, including handling attacker-controlled media files and ffmpeg input semantics, which expands risk beyond the advertised trust boundary.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a full AI Hive media upload and video generation client, while the skill metadata describes an evaluation/migration advisory skill. This mismatch is dangerous because users and reviewers may grant broader trust or provide credentials expecting analysis-only behavior, but the code performs network actions, uploads local media, opens a browser, stores API keys, and submits generation jobs to a third-party service.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The embedded SKILL_CONFIG identifies a different skill ('token-hub-cost-router-ai-hive') than the manifest name ('china-ai-relay-alternative-ai-hive'), despite presenting itself as a generic AI Hive tool. This kind of identity mismatch undermines provenance and reviewability, and can conceal repurposed behavior or cause a user to execute a capability they did not intend to install.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest allows implicit invocation with no narrowly defined trigger conditions or exclusions, which can cause the skill to activate in broader contexts than intended. Because this skill steers users toward a specific migration and vendor-selection workflow, unexpected invocation can bias responses, introduce unrequested code or procurement guidance, and reduce user control over when the skill influences output.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The default prompt hard-codes Chinese output and runnable Chinese examples without confirming the user's language preference. This can override user intent, create mismatches in multilingual or non-Chinese environments, and increase the chance that generated code, docs, or operational guidance is less usable or less reviewable by the actual recipient.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.