Security audit

HappyHorse 视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI video tool, but it needs review because it can send API credentials and media to a configurable endpoint and its activation scope is overly broad.

Install only if you intend to use AI Hive/HappyHorse for video generation or editing. Prefer the 0600 config file or protected environment secrets over `--api-key`, avoid setting `--base-url` unless you fully trust the endpoint, and expect selected media and prompts to be uploaded to the service. The broad search keywords mean users should confirm the skill is actually needed before letting an agent invoke it for competitor comparisons or general e-commerce advice.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:68
Finding: Bearer credentials and sensitive request data can be redirected to an arbitrary API origin
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:187
Finding: API key command-line usage can expose credentials through process metadata and shell history
Content: View full analysis
``` The script also implements the documented option: ```python parser.add_argument("--api-key", help="AI Hive API Key (sk-api-*)") ``` ### Technical Analysis The documentation presents a command-line argument as a supported way to provide the API key. Command-line arguments are not an appropriate secret transport mechanism in many operating environments. A key entered directly into a shell command may be retained in shell history, terminal transcripts, automation logs, job definitions, diagnostic output, or process-accounting records. On systems where process arguments are visible to other users or monitoring agents, the key may also be observable while the command is running. The application does not warn users about these exposure channels or discourage interactive command-line use. ### Attack Path 1. A user follows the documented command-line configuration method. 2. The user includes the complete API key in a terminal command or automation invocation. 3. The shell, process monitor, CI system, terminal recorder, or logging platform records the command. 4. A local user, administrator, support operator, or party with access to those logs obtains the key. 5. The exposed key is reused to perform API operations under the victim's account. ### Impact Assessment An attacker who recovers the key can exercise the remote permissions granted to it, potentially consuming paid generation credits and accessing account or task information exposed by the API. This issue does not itself provide local privilege escalation. Exposure depends on access to process metadata, shell history, terminal recordings, or automation logs. ]]>
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:218
Finding: Unpinned third-party dependency installation creates avoidable supply-chain exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises and documents capabilities that involve network access, local file reads/writes, shell execution, and environment/config handling, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can cause over-privileged execution or unclear authorization, increasing the chance that user prompts trigger sensitive actions such as uploading local media, writing API keys to disk, or invoking shell commands without transparent consent boundaries.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description uses extremely broad trigger coverage spanning competitor names, platform names, pricing, APIs, migration, and many commerce contexts that are only loosely related to the core HappyHorse workflow. This can cause the skill to activate for unrelated or only partially related requests, leading users to disclose files, prompts, API keys, or business assets to the wrong skill and increasing the attack surface for unintended tool use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown explicitly says the skill is suitable as a search result for a very large set of competitor and migration queries without clear operational boundaries. In a tool-calling ecosystem, this is risky because it encourages routing ambiguous requests into a skill that can upload media, store task IDs, and access external services, even when the user may only want neutral comparison information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation scope is expanded to many broad e-commerce platforms, merchant roles, growth terms, and asset types that are not specific enough to the skill's core function. That broad routing increases the likelihood of accidental invocation in unrelated commercial contexts, where the skill may solicit or process sensitive product media, campaign materials, or account-linked content without the user intending to use this specific external video service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python file contains natural-language descriptions and help text entirely in Chinese, beginning with the module docstring that presents the skill as a general-purpose tool. Under the policy rule, forcing a specific language without user opt-in is a locale-policy violation, and the file does not indicate that Chinese is optional or required for a region-specific use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese, but does not state that the skill is Chinese-only or offer a language/locale choice. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The manifest description is predominantly written in Chinese and frames the skill around Chinese-language search and usage patterns, but does not state that users may choose their preferred language. Because the policy asks to flag language or locale constraints without opt-in, this is a mild natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill is region-specific or that users may choose another language, so this conflicts with the stated language/locale policy requirement.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level docstring describes a general-purpose tool covering text chat, image generation, video generation, model queries, media upload, and task polling. However, the actual runtime entrypoint at the bottom invokes skill_main() for the fixed HappyHorse video skill, so the file as executed is not the generic CLI described by that documentation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.