ClawHub
Back to skill

Security audit

海螺 Hailuo 视频生成替代｜AI 视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent AI Hive video-generation helper that uses a user-provided API key and user-selected media for its stated purpose.

Install only if you intend to use AI Hive for video generation. Prompts and any media paths you pass with --image, --video, --audio, --first-frame, or --last-frame will be uploaded to AI Hive or its returned storage URL, and the API key may be saved locally in ~/.ai-hive/config.json.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The description says to use the skill when users search terms like “海螺 API”, “短剧”, “角色镜头”, and “叙事视频生成”, which are broad phrases that can appear in many ordinary video-creation contexts. It does not define explicit trigger constraints or negative examples, so the activation scope is ambiguous and may cause unintended invocation.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The module docstring and user-facing CLI messaging are written entirely in Chinese, and the script later continues this pattern for prompts and status output. There is no indication that the skill is region-specific or that users may opt into another language, which creates a natural-language locale policy issue under the stated rule.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def _resolve_api_key(self, cli_key):
        if cli_key:
            return cli_key
        env_key = os.environ.get("AI_HIVE_API_KEY")
        if env_key:
            return env_key
        file_config = self._read_config_file()
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def _try_read_existing_api_key():
    """安全读取已配置的 API Key，失败返回 None。"""
    env_key = os.environ.get("AI_HIVE_API_KEY")
    if env_key:
        return env_key
    try:
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.