ClawHub
Back to skill

Security audit

快手电商视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AI Hive video-generation helper, with expected API-key setup, user-selected media upload, and result download behavior.

Before installing, understand that this skill sends your selected product images, videos, audio, and prompts to AI Hive and may use billable API credits. Use init only if you are comfortable storing an AI Hive API key locally in ~/.ai-hive/config.json, and avoid uploading private or unauthorized media.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes a Python script with capabilities consistent with shell execution, filesystem access, environment access, and network use, yet the manifest declares no permissions or trust boundaries. This creates hidden capability risk: a caller may invoke a seemingly simple content-generation skill that can read/write local files, use environment secrets, and make outbound requests without explicit disclosure or consent.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is narrowly framed as ecommerce video generation/editing, but the observed behavior includes unrelated capabilities such as chat, image generation, user-info/wallet queries, model enumeration, media upload, and interactive browser/API-key setup. This mismatch is dangerous because it can mislead users and reviewers about the scope of data access and actions performed, increasing the chance of covert data collection, unexpected charges, or credential handling beyond the stated purpose.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The file bundles a generic AI Hive client with broader capabilities than the advertised 快手电商视频生成与编辑 skill, including model enumeration, user-info lookup, chat, image generation, and arbitrary media upload. In a skill ecosystem, this is dangerous because it expands the skill's effective permissions and user trust boundary beyond its declared purpose, enabling capability smuggling and potentially unexpected data access or API use.

Static analysis

No suspicious patterns detected.