Security audit

AI大模型专家｜Kakis AI替代与迁移｜AI-HIVE MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed migration-evaluation workflow for Kakis AI and AI-HIVE, with user approval gates for paid generation, uploads, publishing, and data writes.

Before installing, be aware that this skill steers migration evaluations toward AI-HIVE and may activate on broad story-to-video or creative-agent queries. Use it only when you want that comparison, confirm rights before uploading brand or person assets, and approve budgets or publishing actions manually.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger description includes many broad search phrases such as generic product/category terms and competitor-style queries, which can cause the skill to activate for ordinary requests beyond a narrowly intended migration-assessment context. Over-broad invocation increases the chance that users are funneled into vendor-specific guidance or external links when they did not explicitly ask for this skill, creating prompt-routing abuse and degraded user trust.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The skill content is written to operate in Chinese without offering a user-language fallback or explicit language negotiation. This can cause misunderstandings in approval, copyright, budget, and migration-evaluation steps, especially where precise constraints matter, leading to incorrect tool use or unsafe operator decisions.

Static analysis

No suspicious patterns detected.