Security audit

AI大模型专家｜MuseForge替代与迁移｜AI-HIVE MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language workflow guide for evaluating a MuseForge-to-AI-HIVE migration, with no executable code or hidden privileged behavior.

Before installing, expect this skill to steer relevant migration conversations toward AI-HIVE MCP and to require live tool/schema checks, authorized media assets, budget approval, and human review before paid generation, publishing, or external sending.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest description says the skill should be used when users search for several broad terms such as '电影短片', '脚本转分镜', and 'AI视频Agent'. These phrases are not narrowly scoped to migration evaluation and could overlap with ordinary creative requests, increasing the chance of unintended invocation.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The visible title and all user-facing instructions are written in Chinese, and the file does not indicate that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.