Security audit

用户晒单视频自动混剪｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE video montage workflow with expected file, network, and API-key use, but users should review broad triggers and credential storage before use.

Install only if you intend to use AI-HIVE for authorized customer-review or marketing video montage. Expect it to store or use an AI-HIVE API key, upload selected media to AI-HIVE/object storage, run ffmpeg on local files, and possibly incur generation costs after you approve parameters. Keep API keys out of logs and repositories, verify rights for customer footage, music, logos, and claims, and avoid relying on broad trigger phrases for unrelated brand-ad work.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes and demonstrates code paths that can access environment variables, read/write local files, make network requests, and invoke shell-adjacent tooling like ffmpeg, yet it declares no permissions. This creates a transparency and policy-enforcement gap: users or platforms may invoke the skill without understanding its operational reach, increasing the risk of unintended data exposure, local file modification, or outbound requests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a narrowly scoped customer-review video montage workflow, but the detected behavior includes generic chat, image generation, model catalog access, wallet/user-info queries, and local credential initialization. This mismatch is dangerous because users and orchestrators may trust the skill with sensitive inputs under a limited-use assumption while it exposes broader capabilities that can access account metadata, spend-enabled APIs, or unrelated generation features.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Overly broad trigger phrases such as “用户内容” and “品牌广告” can cause the skill to activate for many unrelated requests. In an agent environment, this broad matching increases the chance that users are routed into a skill with networked, file-handling, and potentially billable generation behavior when they did not intend to use this specialized workflow.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The invocation rule for turning a reference case into original content is ambiguous and extends beyond the stated montage scope. That ambiguity can pull in requests involving imitation, copyright-sensitive transformation, or generic content creation, which is especially risky here because the skill also advertises AI-assisted generation and reference-media handling.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The default prompt says to use the skill whenever the user wants the request turned into a production-ready workflow, runnable AI-HIVE commands, and a quality checklist, but it does not clearly constrain invocation to authorized, compliant montage use cases. In a skill handling marketing media generation, broad triggers can cause the agent to invoke it for adjacent unsafe requests such as deceptive endorsements, unauthorized reuse, or policy-evasive ad content, increasing the chance of harmful automation.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The default prompt forces output into Chinese without user choice, which can create comprehension and review failures when the operator, reviewer, or downstream system expects another language. In a compliance-sensitive workflow involving rights, claims, and runnable commands, language coercion can obscure safety caveats or authorization requirements and lead to misuse or missed policy violations.

Static analysis

No suspicious patterns detected.