Security audit

评论区痛点转广告｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for AI-HIVE ad-content workflows, but it needs user awareness because it can store an API key, upload selected media, run ffmpeg, and submit paid generation jobs.

Install only if you are comfortable using AI-HIVE for this workflow. Treat the API key as a paid credential, review parameters before generation, avoid uploading private or unauthorized media/comments, and be aware that init writes a local config file for future use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises executable workflows that use environment variables, local file access, shell commands, and network/API calls, but it does not declare permissions or narrowly scope those capabilities. This creates a transparency and least-privilege problem: a host agent or reviewer may underestimate what the skill can do, increasing the chance of unauthorized file access, outbound requests, or command execution in sensitive environments.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The documented purpose is comment-pain-point analysis and ad/content planning, but the skill also includes broader operational capabilities such as generic AI-HIVE utilities, browser-based API key setup, local config storage, and ffmpeg-based media processing unrelated to the stated narrow use case. Description-behavior mismatch is dangerous because it can hide unexpected execution paths and expand the attack surface beyond what users and security reviewers reasonably expect.

Description-Behavior Mismatch

High

Confidence: 83% confidence
Finding: This file provides local video-editing capabilities even though the declared skill is focused on comment insight and ad-generation workflows, with media generation described as occurring via AI-HIVE OpenAPI. That mismatch increases the risk of hidden or unnecessary local execution capabilities being bundled into the skill, expanding the attack surface and enabling processing of arbitrary local files beyond the stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 76% confidence
Finding: The helper exposes local ffmpeg/ffprobe execution as a capability that is not justified by the stated business purpose of comment analysis and ad-copy transformation. Even without shell injection, invoking powerful local binaries on user-controlled paths can enable unintended access to local media, excessive resource consumption, or abuse of the agent environment if this script becomes reachable through skill actions.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file is presented as a narrowly scoped 'comment pain-point to ad' image skill, but the codebase embeds a broader general-purpose AI client with chat, video, model enumeration, media upload, and account lookup functionality. In an agent-skill context, this capability mismatch increases attack surface and enables users or downstream agents to invoke behaviors that were not clearly disclosed or reviewed for this skill’s stated purpose.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module docstring explicitly describes the tool as a general AI capability wrapper, which conflicts with the specialized skill metadata. This kind of scope contradiction is dangerous because it can mislead reviewers and operators about what the artifact can actually do, causing under-review of exposed capabilities.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Exposing user-info retrieval in a skill whose declared purpose is comment-to-ad image generation is an unjustified privilege expansion. Even if the endpoint is legitimate, it can disclose account or wallet information to callers and provides a foothold for data access beyond the user’s expected workflow.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Generic text chat is unrelated to the advertised image-only comment-to-ad workflow and materially broadens what the skill can send to the upstream API. In an agent environment, that extra channel can be repurposed for unreviewed prompt handling, data transmission, or policy bypass attempts outside the intended use case.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Video generation is a materially different capability from the skill’s stated image-focused purpose and increases both cost and misuse surface. Packaging it into the same file means a caller or orchestrator may access higher-risk functionality that was not expected from this specialized skill.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The implemented file is a broad AI Hive client exposing chat, model discovery, upload, task polling, and account inspection rather than a narrowly scoped comment-pain-point-to-ad workflow. This capability mismatch increases attack surface and creates a confused-deputy risk where callers may gain access to functions they did not expect or authorize under the advertised skill boundary.

Context-Inappropriate Capability

Low

Confidence: 90% confidence
Finding: The skill exposes a user-info endpoint that reveals account and wallet details unrelated to comment-to-ad generation. Even if intended for convenience, this broadens data exposure and may leak sensitive billing or account metadata to users or automations invoking the skill for a different purpose.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The generic text chat endpoint allows arbitrary model interaction outside the skill's declared purpose, effectively turning a specialized ad-video skill into a broader LLM client. This can be abused to bypass intended product controls, send unreviewed prompts or data to external models, and expand the blast radius of misuse.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: Standalone model discovery exposes the wider provider inventory and routing options beyond what the specialized skill needs. While not directly exploitable on its own, it facilitates capability enumeration and makes it easier to repurpose the skill as a general API client.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill’s description and default prompt allow very broad implicit triggering across multiple loosely related marketing and content tasks, without clear boundaries or authorization checks. This can cause the agent to invoke the skill in contexts the user did not explicitly intend, increasing the chance of unsafe automation, policy bypass through over-delegation, or accidental processing of sensitive third-party content such as exported comments and screenshots.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The default prompt hardcodes Chinese output ('production-ready Chinese workflow') regardless of the user’s language preference. Forcing a language without opt-in can mislead users, reduce transparency, and create opportunities for instruction confusion or incorrect execution in multilingual contexts, especially when the skill generates operational commands and external API steps.

Static analysis

No suspicious patterns detected.