ClawHub
Back to skill

Security audit

即梦 Dreamina 视频生成替代｜AI 视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed AI Hive video-generation helper that uploads user-selected media to a third-party API and stores an AI Hive key when initialized.

Install only if you are comfortable sending prompts and selected media files to AI Hive and storing an AI Hive API key locally. Avoid using sensitive, private, or unlicensed media unless you have reviewed the service’s data handling terms, and use --no-download if you do not want completed outputs saved locally by default.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium
Confidence
88% confidence
Finding
This markdown file includes a long 'Use when users search' clause, but several listed triggers are broad topical terms rather than narrowly scoped invocation phrases. Without clearer constraints or negative examples, the skill may be invoked for general advertising or short-video requests that do not specifically call for Dreamina migration or Seedance-based storyboard generation.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The file states that traffic and keys go to `https://ai-hive.iclip.cn/api` and shows commands that initialize and query a video-generation workflow, while earlier examples use local media files as inputs. Although the endpoint is disclosed, there is no clear warning to users that their supplied images/videos and related data will be transmitted to a third-party service, which is a privacy-relevant behavior.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The module docstring and all user-facing CLI text are written exclusively in Chinese, and the workflow instructions assume Chinese-language interaction. This is a natural-language locale policy concern because the skill does not offer any opt-in or alternative language choice for users who may expect another language.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The code uploads user-supplied image, video, and audio files to the AI Hive API and then to object storage, which is a privacy-relevant network transmission. Although progress messages are printed, there is no explicit warning that local media content will be transmitted to external services.

Missing User Warnings

Low
Confidence
71% confidence
Finding
The polling workflow automatically creates an output directory and writes generated files to disk when downloads are enabled. While download progress is shown at runtime, the skill description and argument help do not clearly warn users up front that artifacts will be saved locally by default.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def _resolve_api_key(self, cli_key):
        if cli_key:
            return cli_key
        env_key = os.environ.get("AI_HIVE_API_KEY")
        if env_key:
            return env_key
        file_config = self._read_config_file()
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def _try_read_existing_api_key():
    """安全读取已配置的 API Key，失败返回 None。"""
    env_key = os.environ.get("AI_HIVE_API_KEY")
    if env_key:
        return env_key
    try:
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.