Security audit

AI大模型专家｜海外 AI API 聚合平台替代方案｜AI-HIVE

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed AI-HIVE migration and media-generation helper, but it stores API keys locally and exposes broader account/API actions than its main description makes clear.

Review this skill before installing if you do not want a vendor-specific AI-HIVE workflow to be invoked implicitly. Only run init if you are comfortable storing an AI-HIVE API key at ~/.ai-hive/config.json, and only run generation/upload commands with media you are authorized to send to AI-HIVE and a budget for possible API charges.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and demonstrates shell execution, file read/write, environment-variable handling, and networked API calls, yet declares no permissions. This creates a transparency and containment problem: a caller or review system cannot accurately assess the skill’s operational reach, increasing the chance of unintended credential exposure, local file modification, or remote actions during use.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is described as an evaluation/migration aid, but the detected behavior extends into active browser-guided login, API-key acquisition/storage, direct API operations, wallet/user-info access, and local ffmpeg processing. That mismatch is dangerous because users may consent to a low-risk advisory workflow while the skill actually performs higher-risk actions involving credentials, billing, local system changes, and third-party content generation.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file presents itself as a video-generation skill but embeds a much broader general-purpose API client exposing chat, image generation, model enumeration, user-info, upload, and task operations. This violates least-privilege and skill-scope expectations, increasing the blast radius if the skill is invoked or trusted for a narrower purpose than what the code can actually do.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill can call the user-info endpoint, which may reveal account profile details and wallet balance unrelated to the stated purpose of comparing or generating video workflows. Unnecessary access to account metadata creates avoidable privacy exposure and can disclose sensitive operational or billing information to anyone able to invoke the skill.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables allow_implicit_invocation without any visible trigger constraints, allowing the agent to invoke this skill based on loose semantic matching rather than explicit user intent. Because this skill steers users toward a specific third-party platform and can generate migration plans and runnable code, unexpected invocation could bias recommendations, cause unintended workflow changes, or expose user context to a skill they did not deliberately choose.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The metadata and default prompt are written to produce Chinese-language output and Chinese examples without an explicit user opt-in, which can override user preference and reduce transparency about what the skill will do. In security-sensitive or migration-related contexts, forcing a language can lead to user misunderstanding of recommendations, acceptance criteria, or generated code, increasing the chance of operational mistakes.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.