MiniMax H3 视频生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its video-generation purpose, but it has credential and file-write risks that users should review before installing.

Install only if you are comfortable giving the skill an AI Hive API key and letting it upload selected media to AI Hive. Do not use a custom base URL unless you fully trust that endpoint, because the script will send your bearer token there. Prefer --no-download or a dedicated output directory for untrusted tasks, and consider pinning dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/videogen.py:91

Finding

API Credential Disclosure Through an Unrestricted Custom Base URL

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py:91-100, 130-149, 587
Vulnerability Type: Server-side credential forwarding to an untrusted endpoint
Risk Level: High

Vulnerable Code

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

python

def __init__(self, config):
    self.config = config
    self.base = config.base_url
    self.headers = {
        "Authorization": f"Bearer {config.api_key}",
        "Content-Type": "application/json",
    }

def _url(self, path):
    return f"{self.base}/openapi/v1/{path}"

def _request(self, method, url, **kwargs):
    self.config.log(f"{method} {url}")
    try:
        resp = requests.request(
            method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
        )

python

parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")

Technical Analysis

The application accepts the API base URL from a command-line argument, environment variable, or configuration file without validating its scheme or hostname. The HTTP client subsequently adds the AI Hive API key to every API request as an Authorization: Bearer header.

Consequently, any URL supplied through --base-url, AI_HIVE_BASE_URL, or ~/.ai-hive/config.json becomes a credential recipient. The implementation permits plaintext HTTP and arbitrary external hosts. An attacker who can influence a command, environment variable, or configuration file can redirect authenticated requests to an attacker-controlled server.

Attack Path

1. The attacker convinces the user to run the skill with a ...[truncated 972 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the configured URL with urllib.parse.urlparse.
• Require the https scheme and reject embedded credentials, fragments, unexpected ports, and malformed hostnames.
• Allowlist ai-hive.iclip.cn for normal operation.
• If custom API endpoints are genuinely required, require a separate explicit opt-in option and interactive confirmation before sending credentials.
• Do not automatically reuse the production API key with custom hosts. Require a separately supplied credential for non-default endpoints.
• Reject redirects to hosts outside the approved allowlist, or disable redirects for authenticated API requests.
• Apply equivalent validation to command-line, environment-variable, and configuration-file values.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:396

Finding

Arbitrary File Write Through Unsanitized API-Controlled Download Filenames

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py:396-413
Vulnerability Type: Path traversal and arbitrary file write
Risk Level: Medium

Vulnerable Code

python

# Download results
out_dir = Path(output_dir)
out_dir.mkdir(parents=True, exist_ok=True)
task_type = task.get("taskType", "task")
for i, item in enumerate(succeeded):
    result_url = item.get("resultUrl")
    if not result_url:
        continue
    ext = ".mp4" if "video" in task_type.lower() else ".png"
    filename = f"{task_type}_{task_id}_{i+1}{ext}"
    out_path = out_dir / filename
    download_file(result_url, out_path)

# Last frame
for item in succeeded:
    last_frame = item.get("lastFrameUrl")
    if last_frame:
        out_path = out_dir / f"{task_type}_{task_id}_lastframe.png"
        download_file(last_frame, out_path)

The destination is opened directly during download:

python

with open(str(out_path), "wb") as f:
    for chunk in resp.iter_content(chunk_size=8192):
        if chunk:
            f.write(chunk)

Technical Analysis

The download filename includes taskType, which is received from the remote API, without removing directory separators or validating the resolved destination. If the response contains traversal components such as ../, or an absolute path, Path can resolve the generated destination outside the requested output directory.

The downloaded response is then opened in wb mode. This creates a new file or truncates an existing file. The risk becomes exploitable if the configured API endpoint, API service, network trust boundary, or returned task data is compromised.

Attack Path

1. The attacker controls or compromises the API endpoint used by the skill. This can also be combined with the unrestricted custom base URL issue.
2. The malicious endpoint accepts a generation request and returns a task identifier.
3. During polling, it returns ...[truncated 930 chars]

Remediation

View remediation

Remediation Suggestions

• Do not derive local filenames directly from API response fields.
• Generate filenames from locally created random identifiers or strictly validated alphanumeric values.
• Replace every character outside a narrow allowlist such as [A-Za-z0-9._-].
• Explicitly reject /, \, .., absolute paths, drive prefixes, and control characters.
• Resolve both the output directory and destination path, then verify that the destination remains beneath the output directory before opening it.
• Open downloads with exclusive creation where overwriting is unnecessary.
• Download to a safely created temporary file and atomically rename it after successful validation.
• Apply size limits and validate the expected media type before retaining downloaded content.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:169

Finding

Unpinned Third-Party Dependency Produces Non-Reproducible Installations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:169-174
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

bash

pip3 install requests

The script provides the same unpinned installation instruction:

python

"""AI Hive OpenAPI Skill — general AI capability invocation tool.

Dependencies: requests (pip3 install requests)
"""

python

except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The documented installation command does not specify a reviewed version, lockfile, or package hash. Installation therefore resolves whatever version is available from the active Python package index at installation time.

Although requests is a legitimate package and no malicious dependency is included in the repository, the unpinned process is non-reproducible. Security behavior can change across versions, and installation depends on the integrity of the configured package index and its transitive dependency resolution.

Attack Path

1. A user follows the documented pip3 install requests instruction.
2. pip resolves the current package version and transitive dependencies from the configured package index.
3. A future compromised release, compromised package index, maliciously configured mirror, or incompatible dependency version is selected.
4. Package installation or subsequent import executes the affected dependency code in the user's Python environment.
5. That code receives the privileges of the user running the installation or skill.

Impact Assessment

The practical impact depends on a supply-chain compromise or unsafe package-index configuration. If exploited, dependency code executes with the invoking user's privileges and may access the API key, prompts, uploaded media, generated files, and other data available to that user. No direct ev ...[truncated 71 chars]

Remediation

View remediation

Remediation Suggestions

• Declare dependencies in a version-controlled requirements or lock file.
• Pin requests and its transitive dependencies to reviewed versions.
• Use hash verification, such as pip install --require-hashes -r requirements.txt.
• Install only from an approved HTTPS package index.
• Review and update pinned versions through a controlled dependency-update process.
• Run dependency vulnerability scanning in continuous integration.
• Prefer an isolated virtual environment rather than installing into a shared Python environment.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains substantive user-facing natural-language content entirely in Chinese, but does not indicate that the skill is intended only for a Chinese-speaking audience or offer any language/locale opt-in. Under the policy rule, forcing a specific language without user choice or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents and encourages behaviors that imply shell execution, network access, environment/config handling, and file writes, but it does not declare any explicit tool scope or permission boundaries. This creates a least-privilege failure: an agent may invoke the skill with broader capabilities than users expect, including writing API keys to disk, uploading local files, and downloading outputs, increasing the blast radius if the skill is misused or the implementation is compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description contains an extremely broad set of trigger terms spanning generic video creation, competitor products, platforms, and e-commerce contexts. Overbroad matching can cause the skill to activate for loosely related requests, leading to unintended network/file operations, accidental credential setup flows, or confusing tool selection when a safer or narrower skill should have been chosen.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The applicability section further expands activation to essentially any Chinese or English user searching common video-generation terms, without clear boundaries tied to this skill's actual purpose. In context, this is more dangerous because the skill is action-capable: once selected, it can guide API-key setup, upload user-provided media, submit jobs, and write results locally, so accidental invocation has real side effects and potential cost/privacy consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language strings and documentation entirely in Chinese, including the module docstring and command help text, without any opt-in or alternative locale support. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest frames this skill as a MiniMax H3 video generation skill covering text-to-video and media-conditioned video workflows. Yet the file includes fully implemented chat/text and image generation API operations plus their command handlers and parser support, which are not justified by the skill's declared purpose and represent broader AI capability surface area.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The placeholder value for api_key contains Chinese-only instructional text (请替换为你的APIKey). This imposes a specific language in user-facing configuration guidance without offering an alternative or documenting a locale-specific justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level module docstring says the tool wraps text chat, image generation, video generation, model querying, media upload, and task polling as a general AI Hive OpenAPI utility. However, the executable skill entrypoint uses SKILL_CONFIG and skill_main to expose only MiniMax H3-oriented video generation, task query, upload, and init flows, which is materially narrower than the documented behavior for this skill file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.