Security audit

粉丝投票共创剧情｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE media workflow helper, with paid API use and local credential storage that are user-directed rather than hidden.

Install only if you intend to use AI-HIVE for this workflow. Generation may cost money, selected reference media may be uploaded to AI-HIVE, and init can save an API key locally; review final parameters before running generate commands.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes code-capable behaviors including environment access, filesystem read/write, network access, and shell-style execution, but does not declare permissions or constrain them in the manifest. That creates a transparency and governance gap: an invoking agent or reviewer cannot easily assess the real execution surface, increasing the chance of over-privileged use, secret exposure, or unintended external actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The documented purpose is a narrowly scoped fan-vote story co-creation workflow, but the described/embedded capabilities extend to generic AI-HIVE chat, media upload, model enumeration, user-info retrieval, and general ffmpeg operations. This mismatch is dangerous because broad hidden capabilities can be invoked under a benign-looking skill label, enabling data exfiltration, unrelated account queries, or unintended content manipulation outside user expectations.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file is packaged as a specific fan-vote story image skill, but it embeds a broader generic AI client with chat, video, model listing, user-info, upload, and task management capabilities. Excess capability increases attack surface and violates least-privilege: a caller or future wrapper change could expose operations unrelated to the declared skill purpose.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill can query user account information and wallet balance even though that is unrelated to fan-vote story image generation. Exposing account metadata unnecessarily expands sensitive-data access and may leak billing or identity details if the command becomes reachable through the skill interface or reuse of this script.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: A generic text-chat endpoint is broader than the declared image/story asset workflow and can be repurposed for arbitrary model interaction. In a skill context, hidden general-purpose capabilities can bypass product scoping, content controls, or operator expectations about what the skill is allowed to do.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Video generation is not part of the declared image-generation wrapper but is fully implemented in the file. This creates unnecessary high-cost and broader-content-generation capability that could be invoked through code reuse, accidental exposure, or future routing changes.

Intent-Code Divergence

Low

Confidence: 76% confidence
Finding: The docstring describes the tool as a general-purpose AI capability caller while the skill is presented as a narrowly scoped fan-vote story image skill. This scope mismatch is a security concern because it can mislead reviewers and operators about the actual capabilities present, reducing effective oversight.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file is presented as a specialized fan-vote story co-creation video skill, but it actually exposes broad generic AI operations including model enumeration, text chat, image generation, raw upload, and account-related queries. This scope mismatch increases attack surface and allows callers to use capabilities unrelated to the declared purpose, undermining least privilege and making policy bypass easier within a trusted skill wrapper.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: The skill can retrieve user account information and wallet balance through get_user_info(), which is not necessary for generating fan-vote co-creation assets. Even if the data is limited, exposing account metadata through an unrelated content-generation skill creates unnecessary data access and may leak sensitive billing or identity information to callers who only expected media generation.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The default prompt hard-codes a Chinese-only response style ('production-ready Chinese workflow') without checking the user's language preference. This can override user intent, reduce transparency, and create prompt-steering behavior that may cause the agent to respond in an unexpected language or format, especially under implicit invocation.

Static analysis

No suspicious patterns detected.