Security audit

游戏买量广告创意｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE video-ad workflow helper that uses expected local files, API credentials, network calls, and ffmpeg processing for its stated purpose.

Install only if you intend to use AI-HIVE for ad/video generation. Expect to provide an AI-HIVE API key, possible billable API calls, uploads of media files you explicitly pass to the script, and local output files. Review prompts, routing, pricing snapshots, and media rights before running generation commands.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill includes executable code paths that use environment variables, filesystem access, shell commands, and network calls, but it does not declare corresponding permissions. This creates a mismatch between the skill's documented trust boundary and its actual capabilities, which can lead to unintended secret exposure, local file access, or external API calls if the host or user assumes the skill is non-privileged.

Static analysis

No suspicious patterns detected.