Security audit

数字人口播视频工作室｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE video-production helper with expected network, media upload, download, and API-key handling, though users should be aware it can submit paid generation jobs.

Install only if you are comfortable using AI-HIVE for media generation. Treat API keys as sensitive, prefer environment variables unless you want local persistence, review parameters before running generation commands, and upload only media you are authorized to use because generation may incur charges.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documents executable workflows that use environment variables, local files, shell commands, and network access, but it does not declare permissions to match those capabilities. This reduces transparency and weakens user and platform review because the skill can handle sensitive inputs like API keys, local media paths, and downloaded artifacts without an explicit permission boundary.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior exceeds the stated purpose of a digital-human video studio by apparently including wallet/user queries, generic chat, standalone image generation, broader CLI utility behavior, and local API-key setup/storage flows. This mismatch is dangerous because users may authorize the skill expecting a constrained content-production tool while it can access account metadata, invoke broader model operations, and potentially persist credentials or open interactive browser flows outside the declared scope.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file implements a general-purpose AI Hive client with chat, image generation, model enumeration, uploads, and account queries, while the advertised skill is narrowly framed as a digital-human talking-video studio. This scope mismatch increases capability exposure: callers expecting a constrained video tool may unintentionally gain broader API access that can be abused for unrelated actions or data access.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The skill can call the user-info endpoint and display account and wallet-related information, which is not necessary for generating digital-human videos. Unneeded access to billing/account metadata expands the blast radius of the skill and can disclose sensitive usage or balance information to users or wrappers that only expected media generation behavior.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The chat subcommand exposes a generic text/multimodal chat interface unrelated to the skill's stated specialized video-studio purpose. In a constrained-scope agent environment, this broadens the reachable functionality and may let consumers route arbitrary prompts and uploaded images through the account under the guise of a narrower skill.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The image-generation subcommand provides standalone image synthesis outside the claimed digital-human talking-video workflow. That mismatch creates unnecessary capability surface and may enable unrelated content generation, spend consumption, or policy circumvention through a skill users believe is limited to video production.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The default prompt is broad enough to auto-trigger the skill for generic requests about video creation, workflows, or production-ready commands, which can invoke external-capable behavior without clear user intent. In this skill context, that risk is elevated because the skill is designed to generate runnable AI-HIVE commands and operational workflows, so an accidental invocation could lead to unintended content-generation or API-oriented actions.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The default prompt hard-codes Chinese output regardless of the user's language preference, which can override user intent and reduce transparency about what actions or instructions are being generated. In a skill that emits production workflows and runnable commands, forced language can increase the chance that users misunderstand outputs, miss safety limitations, or execute steps they cannot properly review.

Static analysis

No suspicious patterns detected.