Security audit

AI大模型专家｜农业企业AI图片视频营销

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits its AI-HIVE marketing purpose, but it needs Review because its init flow stores an API key locally while the skill text says keys should only stay in environment variables.

Review before installing. Use this only if you are comfortable sending selected media and prompts to AI-HIVE, and prefer supplying AI_HIVE_API_KEY as an environment variable instead of running init. Upload only files you have rights to use and avoid sensitive customer, farm, financial, or compliance material unless AI-HIVE handling is acceptable for your organization.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill embeds executable shell/Python workflows that use environment variables, local file paths, networked API calls, and file read/write behavior, but it declares no corresponding permissions or trust boundaries. This can cause the host agent or user to invoke code with broader access than expected, increasing the risk of unintended local file access, secret exposure, or external requests without informed consent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is marketing asset generation and planning, but the described behavior extends into broader capabilities such as local ffmpeg-based media editing, browser-assisted API key retrieval, wallet/user-info queries, and generic chat API use. This mismatch is dangerous because users may authorize the skill for a narrow marketing task while it performs materially different actions involving secrets, financial/account data, browser interaction, and arbitrary network calls.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Implicit invocation allows the skill to activate without a narrowly defined trigger scope, increasing the chance it will be invoked in unrelated conversations. Because this skill can drive AI-HIVE marketing workflows and handle media-generation task orchestration, unintended activation could cause unauthorized actions, unintended data handling, or user confusion about what system is acting.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: This code uploads arbitrary local files provided by the user to remote storage and then to the AI Hive service, but the skill interface does not present a clear disclosure that referenced files will leave the local machine. In a marketing skill, users may upload proprietary farm, product, customer, or compliance-sensitive media, so lack of explicit disclosure raises privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The init flow stores the API key in a plaintext JSON config file under the user's home directory. Although the code sets permissions to 0600, local plaintext credential storage still increases exposure through backups, endpoint compromise, accidental sharing, or later permission drift; the script also does not give an explicit warning before persisting the secret.

Static analysis

No suspicious patterns detected.