Minimax H3 视频生成与编辑

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its video-generation purpose, but it needs review because it can send the user's AI Hive API key to any configured API base URL.

Review before installing. Use this skill only with the official AI Hive endpoint unless you fully trust the alternate server, because a custom base URL can receive your API key. Prefer a dedicated API key with limited balance or quota, avoid setting AI_HIVE_BASE_URL from untrusted instructions, and upload only media you intend to send to AI Hive or its object-storage upload endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/videogen.py:81

Finding

API Credential Disclosure Through an Unrestricted Base URL

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py, lines 81–91, 127–145, and 511–514
Vulnerability Type: Bearer-token disclosure through a user-controlled API endpoint
Risk Level: High

Vulnerable Code

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

python

def __init__(self, config):
    self.config = config
    self.base = config.base_url
    self.headers = {
        "Authorization": f"Bearer {config.api_key}",
        "Content-Type": "application/json",
    }

def _url(self, path):
    return f"{self.base}/openapi/v1/{path}"

def _request(self, method, url, **kwargs):
    self.config.log(f"{method} {url}")
    try:
        resp = requests.request(
            method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
        )

python

def add_common_args(parser):
    parser.add_argument("--api-key", help="AI Hive API Key (sk-api-*)")
    parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")
    parser.add_argument("--verbose", action="store_true", help="Verbose logging")

Technical Analysis

The API base URL can be supplied through the --base-url command-line option, the AI_HIVE_BASE_URL environment variable, or the local configuration file. The value is accepted without validating its scheme or hostname.

The HTTP client independently creates an Authorization: Bearer header containing the AI Hive API key and sends that header to every URL built from the selected base URL. Consequently, selecting an attacker-controlled host causes the legitimate API credential to be transmitted ...[truncated 1686 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict authenticated requests to an explicit allowlist of trusted HTTPS origins, such as https://ai-hive.iclip.cn.
2. Parse the URL with urllib.parse.urlparse and reject:
   • Any scheme other than https.
   • URLs containing embedded credentials.
   • Unapproved hostnames or ports.
   • Ambiguous, malformed, or relative URLs.
3. Do not attach the AI Hive bearer token to custom endpoints. If custom servers must be supported, require a separate credential explicitly associated with that origin.
4. Disable cross-origin redirects for authenticated requests, or verify every redirect destination before forwarding the Authorization header.
5. Prefer removing --base-url and AI_HIVE_BASE_URL from the end-user Skill interface unless custom endpoints are essential.
6. Treat the configuration file as untrusted input even though its permissions are tightened.
7. Add tests confirming that HTTP endpoints, lookalike domains, subdomain tricks, embedded credentials, and cross-origin redirects cannot receive the API key.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:225

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 225–229; scripts/videogen.py, lines 7 and 15–19
Vulnerability Type: Unpinned third-party dependency and non-reproducible installation
Risk Level: Low

Vulnerable Code

bash

pip3 install requests

python

try:
    import requests
except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The installation instructions ask users to install requests without a version constraint, lock file, or cryptographic hashes. Pip therefore resolves whatever package version and transitive dependencies are available from the configured package index at installation time.

This does not demonstrate that the current requests package is malicious. However, it makes the Skill's environment non-reproducible and leaves installation behavior dependent on mutable external package repositories and local pip configuration. Exposure includes a future compromised release, an unsafe package mirror, or unexpected transitive dependency changes.

The package name is correctly spelled, so this is not a demonstrated typosquatting issue. The risk comes from the absence of version and integrity controls.

Attack Path

1. The user follows the documented pip3 install requests instruction.
2. Pip consults the user's configured index or mirror and resolves the current requests release and its transitive dependencies.
3. An upstream account compromise, malicious mirror, repository compromise, or future hostile dependency release supplies altered package content.
4. Pip installs that content without checking it against project-maintained hashes.
5. Malicious installation or import-time code executes with the privileges of the user running pip or the Skill.

Impact Assessment

Successful supply-chain compromise could execute arbitrary Python code in the installation ...[truncated 526 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency manifest with exact versions, such as requirements.txt.

2. Generate and commit cryptographic hashes for all direct and transitive dependencies.

3. Document installation with hash enforcement, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Use the official Python package index over HTTPS and warn users that custom mirrors change the trust boundary.

5. Periodically update dependencies through a controlled review process that includes vulnerability scanning and compatibility testing.

6. Recommend installation in a dedicated virtual environment rather than the system Python environment.

7. If supporting multiple Python versions, maintain a lock file or hashed requirements set appropriate for each supported environment.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown file contains substantive user-facing changelog entries entirely in Chinese, which can amount to a language/locale policy issue when no user opt-in or alternative language is provided. The file does not indicate that the skill is intentionally region-specific or that Chinese is a documented requirement.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and documents behaviors that involve environment access, file read/write, network calls, and shell execution, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this creates an authority mismatch: the skill can be invoked in contexts where users and reviewers do not have a clear, enforceable understanding of what resources it may access or modify.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description contains extremely broad trigger terms spanning many brands, workflows, platforms, and generic user intents, which can cause the skill to match conversations far outside a narrow Minimax H3 use case. Over-broad invocation increases the chance that a network/file-capable skill is selected unnecessarily, exposing user data or causing unintended external actions in situations where the user did not specifically ask for this tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown explicitly frames large lists of related tools, companies, platforms, and search intents as additional invocation targets without meaningful constraints. In context, this makes the skill act like a catch-all routing surface for many unrelated discussions, which is risky because the skill can upload files, query remote APIs, persist task IDs, and download outputs once selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language strings and documentation entirely in Chinese, including the top-level description and later CLI prompts. The skill does not offer a language choice or indicate that Chinese-only output is a justified locale constraint, which conflicts with the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The applicability statement explicitly targets Chinese or English users, but the skill does not clearly state that users may choose their preferred language for interaction or outputs. Because language targeting is expressed in the natural-language description rather than as an optional preference, it can be read as a locale policy constraint without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example API key value includes Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. The file does not offer an alternative language or explain that the skill is intended only for a Chinese-speaking audience, so this appears to violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The top-level docstring describes this file as a '通用 AI 能力调用工具' that wraps text chat, image generation, video generation, model querying, media upload, and task polling. However, the actual main entrypoint invokes skill_main(), whose parser only exposes the narrower skill commands generate/task/upload/init for the Minimax H3 video skill, so the documentation materially overstates what this file does when run as the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.