Security audit

巨物与微缩奇观广告｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE video-ad workflow that uses user-provided media and API credentials, with no evidence of hidden or destructive behavior.

Install only if you intend to use AI-HIVE for ad video work. Review commands before running them, upload only media you are authorized to use, and treat AI_HIVE_API_KEY or ~/.ai-hive/config.json as sensitive because generation may use paid account access.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill embeds executable workflows that use environment variables, local file access, shell commands, and outbound network calls, but it does not declare corresponding permissions. This weakens reviewability and user consent because the agent may handle sensitive local data or invoke paid external APIs without an explicit permission boundary.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The documented purpose is narrowly framed as giant/miniature ad production, but the described capabilities include broader AI-HIVE chat, generic image generation, media upload, model enumeration, wallet or balance access, and local ffmpeg manipulation. This mismatch increases the risk of overbroad execution and surprise data exposure because reviewers and users may authorize the skill for a constrained creative task while it can access unrelated account and system-level functions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file presents itself as a purpose-specific giant/miniature ad video skill, but it embeds a broader generic AI client with chat, image generation, model enumeration, and account-related operations. This capability mismatch increases attack surface and violates least privilege: a caller expecting a narrow video skill can unknowingly gain access to unrelated API actions.

Description-Behavior Mismatch

Low

Confidence: 78% confidence
Finding: A standalone upload command lets users send arbitrary local media to the remote service outside the constrained ad-video generation flow. While not inherently malicious, it broadens exfiltration paths for local files and is not clearly necessary for the advertised narrow skill behavior.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill includes a user-info endpoint that can retrieve account information and wallet balance, which is unrelated to giant/miniature ad generation. Exposing account metadata in a creative-generation skill creates unnecessary access to sensitive billing or profile information and expands the consequences of misuse.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module docstring explicitly describes a general-purpose AI capability wrapper rather than a narrowly scoped ad-video skill. This kind of misleading packaging can conceal excess capabilities from reviewers and users, making risky functionality easier to smuggle into a workflow under a benign-looking label.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill enables implicit invocation without any trigger boundaries, so the agent may activate this ad-generation workflow in loosely related contexts. Because the skill can produce runnable AI-HIVE commands and external-media workflows, unintended activation could cause unauthorized content generation, API use, or policy-sensitive marketing assistance when the user did not explicitly request this skill.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The default prompt hardcodes Chinese output and does not preserve user language preference or request consent. This can mis-handle user intent, reduce transparency, and create misleading or unusable outputs in multilingual environments, especially if the agent silently reframes a request into a language the user did not choose.

Static analysis

No suspicious patterns detected.