Security audit

用户访谈转客户案例视频｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE case-video workflow that can upload user-selected media and store an API key, but those actions are user-directed and aligned with its purpose.

Install only if you are comfortable giving the skill AI-HIVE API access, uploading selected interview/media files to AI-HIVE, and storing an API key locally if you use init. Review prompts, routes, and costs before generation, and avoid using it with unlicensed interviews, private customer data, or unsupported marketing claims.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill exposes operational capabilities including environment access, file read/write, network calls, and shell-style command usage without declaring permissions. This weakens user and platform visibility into what the skill can do, increasing the chance of unintended API key exposure, filesystem modification, or network activity under misleading expectations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose is narrowly scoped to transforming authorized interviews into customer case-study videos, but the referenced behavior extends into generic chat, generic image generation, account/balance lookup, model enumeration, standalone upload, and broad ffmpeg utilities. This scope creep creates a confused-deputy risk: a user or orchestrator may invoke the skill for a trusted narrow purpose while it can actually perform materially broader actions and access unrelated functions.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file implements a broad, general-purpose AI client while the skill is presented as a narrowly scoped customer-interview-to-case-video tool. That capability mismatch increases the attack surface and enables operators or downstream agents to invoke unrelated functions such as chat, image generation, account inspection, and arbitrary media handling under the cover of a specialized skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill can query user account information and wallet balance, which is unrelated to producing customer case videos. Unnecessary access to billing and account metadata violates least privilege and may expose sensitive operational information to prompts, logs, or unauthorized users of the skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The generic text-chat endpoint is outside the skill's declared purpose and can be used for arbitrary model interaction. In a constrained agent setting, hidden general chat functionality enables prompt routing and data processing far beyond the approved customer-interview video workflow.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Standalone image generation exceeds the stated workflow of transforming authorized interviews into customer case videos. This broader capability allows content creation unrelated to approved use, undermining scope-based trust and making policy evasion easier.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module explicitly describes itself as a general AI invocation tool, contradicting the specialized manifest. This inconsistency is security-relevant because reviewers and orchestrators may grant permissions based on the narrow description while the code actually supports much broader operations.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases are broad and common, covering generic marketing and content terms that may match many unrelated user requests. Over-broad invocation increases the likelihood that the skill is auto-selected in contexts where its code capabilities, network access, or media-processing behaviors are unnecessary or surprising.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The default prompt hard-codes a Chinese-language response format ('production-ready Chinese workflow') regardless of the user's stated preference. This can override user intent, reduce transparency, and create prompt-steering behavior that is undesirable in multilingual or policy-sensitive contexts, though it is not a direct code-execution or data-exfiltration issue.

Static analysis

No suspicious patterns detected.