Security audit

美图 MOKI 视频生成替代｜AI 视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI video-generation wrapper that sends user-selected media to AI Hive, with some ordinary integration risks users should understand.

Install this only if you are comfortable sending selected images, videos, audio, prompts, and task data to AI Hive and its storage provider. Use a virtual environment, avoid uploading confidential or regulated assets unless approved, consider setting --output-dir or --no-download, and protect the AI_HIVE_API_KEY or ~/.ai-hive/config.json credential.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:232
Finding: Unvalidated Server-Controlled Upload and Download URLs
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:53
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
``` The script also directs users to the same unpinned installation command when the dependency is unavailable: ```python try: import requests except ImportError: print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The installation instructions request the latest version of `requests` and its transitive dependencies from the user's configured Python package index. The project does not provide a pinned requirements file, lockfile, package hashes, or a documented trusted index. As a result, dependency selection can vary over time and between environments. The installation process is exposed to compromised package releases, compromised or incorrectly configured package indexes, and unexpected future dependency changes. The package name itself is not a visible typosquat, and the audit found no evidence that the current `requests` package is malicious; the issue is the absence of reproducible and integrity-checked dependency resolution. ### Attack Path 1. A user follows the documented `pip3 install requests` instruction. 2. `pip` resolves the package and transitive dependencies through the user's configured package index and resolver state. 3. A compromised release, malicious index mirror, or unsafe index configuration supplies an altered package. 4. Package installation code or subsequently imported Python code executes under the installing user's account. 5. The malicious dependency gains access to data and resources available to that user, potentially including media files and environment variables use ...[truncated 736 chars]
Remediation: View remediation
``` 2. Generate and publish cryptographic hashes for the dependency and all transitive dependencies, then install with `pip --require-hashes`. 3. Prefer a lockfile produced by a reproducible dependency-management workflow. 4. Document the trusted Python package index and avoid implicitly trusting arbitrary extra indexes or mirrors. 5. Recommend installation inside a dedicated virtual environment under a non-privileged user. 6. Add automated dependency vulnerability and integrity scanning to the release process. 7. Periodically update pinned versions after security review rather than resolving uncontrolled latest versions during installation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes shell commands, reads local files, and communicates with a remote API, but it does not declare any explicit tool scope or permission boundaries. That increases the chance the agent will run with broader-than-necessary capabilities, making accidental file access, environment-variable exposure, or unintended network actions harder to constrain and audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The invocation description is broad and includes generic terms like video generation, advertising, and campaign use cases, which can cause the skill to trigger in situations beyond the user's intent. Unintended invocation can lead to accidental media processing, file handling, or network transmission to the external service without the user specifically choosing this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that it uploads, generates, queries, and downloads media via a remote API, but it does not clearly warn the user at the point of use that local images and videos will be transmitted off-device. In a brand-asset workflow, those files may contain unreleased campaign materials, licensed talent, or other sensitive commercial content, so silent transmission creates meaningful confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: User-facing natural-language strings, instructions, errors, and help text throughout the file are presented only in Chinese, and there is no indication that users can opt into another language. Under the stated policy, a skill that enforces a specific language without user choice is a locale-policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script uploads user-supplied images, videos, and audio to the AI Hive API and a returned object-storage URL, but it does not present an explicit consent, privacy, or data-destination warning at the upload point. In a media-generation skill, users may provide sensitive or proprietary brand assets, so silent transmission to third-party services can cause unintended disclosure or compliance violations even though the network behavior is part of the core function.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The tool automatically downloads generated outputs and writes them to ~/Downloads/AiHive by default without a prominent warning in the command help or a confirmation step. This can expose generated assets on shared machines, place files in monitored directories, or surprise users who expected task metadata only.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.