Security audit

eBay 电商视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it can send the user's AI Hive API key and selected media to a caller-configurable API endpoint without validating that endpoint.

Review before installing. Use this only if you are comfortable storing an AI Hive API key locally and uploading selected listing media to AI Hive. Do not set --base-url, AI_HIVE_BASE_URL, or config base_url to an untrusted host, because the skill may send your bearer token there. Prefer an isolated Python environment and pinned dependencies if possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:94
Finding: AI Hive bearer credential can be transmitted to an arbitrary endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:61
Finding: Runtime dependency is installed without version or integrity pinning
Content: View full analysis
``` ```python """AI Hive OpenAPI Skill — general AI capability invocation tool. Wraps AI Hive OpenAPI text chat, image generation, video generation, model queries, media uploads, and task polling through argparse subcommands. Dependency: requests (pip3 install requests) """ try: import requests except ImportError: print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The documented installation command retrieves `requests` and its transitive dependencies without a reviewed version constraint, lock file, or package hashes. The package name is legitimate and the audited project does not contain evidence of dependency confusion or typosquatting. Nevertheless, the installation is not reproducible and automatically accepts future dependency changes. Because Python packages and their installation metadata execute within the user's Python environment, compromise of an accepted package release or dependency-resolution source could affect the machine during installation or later import. This is a supply-chain hardening weakness rather than evidence that the currently named dependency is malicious. ### Attack Path 1. A user follows the documented `pip3 install requests` instruction. 2. `pip` resolves the latest versions available from its configured package index and mirrors. 3. A compromised future release, compromised index or mirror, or unexpectedly unsafe transitive dependency is selected because no reviewed versions or hashes are enforced. 4. Malicious package installation logic or imported ...[truncated 885 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes shell commands, installs packages, uses network access, and reads/writes files, but it does not declare any explicit tool scope or permissions. This creates unnecessary ambiguity about what the skill is allowed to do and increases the risk of over-privileged execution, supply-chain exposure from pip installation, and unintended filesystem or network side effects if run by an agent framework.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file presents itself as an eBay video skill, but it also exposes broad-purpose AI operations such as text chat, image generation, model enumeration, user-info retrieval, and generic media upload. This violates least-privilege expectations for a narrowly scoped skill and can let a caller use the skill as a general AI/API proxy, increasing the attack surface and enabling unintended access to account-backed capabilities.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module docstring explicitly describes a general-purpose AI tool, while the embedded skill configuration claims a specialized eBay video skill. This mismatch can mislead reviewers and users about the actual capability boundary, making it easier to smuggle broader functionality into an ostensibly narrow skill and reducing effective security oversight.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and user-facing interface text are written exclusively in Chinese, and later prompts/messages also assume Chinese-only interaction. For a general-purpose skill, this is a natural-language locale constraint without any user opt-in or explanation that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese across the substantive changelog entries. Under the policy, forcing a specific language without user opt-in or a documented justification can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description mixes in a specific Chinese-language usage cue ('Use this skill for eBay商品视频...') that steers invocation toward a particular language/locale without saying users may choose their preferred language. This can violate language/locale policy when no opt-in or region-specific justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example API key value includes Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may choose their preferred language, so this appears to violate the language/locale policy guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.