Security audit

AI大模型专家｜CometAPI 替代方案｜AI-HIVE

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with AI-HIVE migration and media-generation work, but it handles paid-service credentials and local media with credential storage that is not clearly disclosed in the top-level instructions.

Review before installing. Use a low-privilege AI-HIVE API key, avoid the init flow if you do not want a key stored in ~/.ai-hive/config.json, upload only media you are allowed to share with AI-HIVE, and check generated download paths before running batch jobs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises executable commands that use environment variables, shell execution, local file read/write, and network access, but no permissions are declared. That creates a capability-transparency gap: users or hosting systems may not realize the skill can access secrets, upload local media, and modify files, increasing the chance of over-privileged execution or unsafe consent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as an evaluation/migration assistant, but the documented behavior goes much further: it can call remote APIs, upload local media, download generated content, save API keys locally, launch a browser, and run ffmpeg/ffprobe on local files. This mismatch is dangerous because users may invoke what sounds like advisory functionality while unknowingly granting an execution path that touches credentials, local assets, and external services.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The skill embeds a local ffmpeg execution helper that is unrelated to the manifest’s stated purpose of comparing CometAPI alternatives and migration options. Even though the wrapper is small and appears auditable, adding local binary execution expands the attack surface and enables processing of attacker-controlled media files in a context where such capability is not expected.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file performs concrete short-video editing operations—trim, aspect conversion, mute, loudness normalization, probing, and concatenation—that do not match the advertised scope of API-alternative evaluation and migration analysis. This capability mismatch is dangerous because it introduces hidden behavior and local media-processing functionality that could be abused to manipulate files or invoke complex parsers on untrusted content under the guise of an unrelated business-analysis skill.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The code materially exceeds the skill's declared purpose. Instead of only helping with CometAPI alternative evaluation or migration planning, it is a fully operational AI-Hive client that can authenticate, upload local media, invoke remote generation APIs, and download results. In an agent ecosystem, this capability mismatch is dangerous because users or orchestrators may grant trust based on the manifest while the code performs external actions and handles credentials.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The init workflow launches a browser and guides users through creating and pasting an API key, which is unrelated to a comparison-only or migration-audit skill. This expands the skill into credential acquisition and account onboarding, increasing phishing-like risk and making it easier to normalize secret entry into a tool whose declared purpose does not require it.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill can upload arbitrary local files to remote storage and download remote results to the local filesystem, which goes beyond an advisory/comparison role. In context, this is sensitive because a user expecting analysis-only behavior may unknowingly expose private media or allow unreviewed remote content to be written locally.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill enables implicit invocation without any trigger constraints, so it may activate in broader contexts than intended and steer users toward a specific migration workflow automatically. In a security-sensitive agent ecosystem, this increases the risk of unwanted prompt injection surface, unintended tool selection, and unsolicited recommendation behavior tied to commercial or operational decisions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.