T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imagegen.py:92- Finding
Bearer API Key Disclosure Through Unrestricted Base URL Override in Image Generation Client
- Content
View full analysis
- Remediation
View remediation
Security audit
小说转短剧工作台｜AI-HIVE
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with an AI-HIVE short-drama workflow, but it handles API keys and uploads while allowing an unvalidated custom API endpoint that could expose credentials or media.
Review this before installing if you will use real AI-HIVE credentials or private manuscripts/media. Use only the default AI-HIVE endpoint, do not set --base-url or AI_HIVE_BASE_URL unless you fully trust the destination, and treat generated commands as potentially billable. Avoid storing long-lived API keys unless necessary, and use only authorized source material.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:92- Finding
Bearer API Key Disclosure Through Unrestricted Base URL Override in Video Generation Client
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A skill framed as a screenplay adaptation workbench but capable of account queries, wallet/balance access, model listing, uploads/downloads, browser-based API-key setup, and generic generation significantly expands the attack surface beyond what the description suggests. This can mislead users into exposing credentials, account metadata, or billable operations in a context that appears much narrower and safer than it is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A skill framed as a screenplay adaptation workbench but capable of account queries, wallet/balance access, model listing, uploads/downloads, browser-based API-key setup, and generic generation significantly expands the attack surface beyond what the description suggests. This can mislead users into exposing credentials, account metadata, or billable operations in a context that appears much narrower and safer than it is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A skill framed as a screenplay adaptation workbench but capable of account queries, wallet/balance access, model listing, uploads/downloads, browser-based API-key setup, and generic generation significantly expands the attack surface beyond what the description suggests. This can mislead users into exposing credentials, account metadata, or billable operations in a context that appears much narrower and safer than it is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A skill framed as a screenplay adaptation workbench but capable of account queries, wallet/balance access, model listing, uploads/downloads, browser-based API-key setup, and generic generation significantly expands the attack surface beyond what the description suggests. This can mislead users into exposing credentials, account metadata, or billable operations in a context that appears much narrower and safer than it is.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The exported skill entrypoint and fixed configuration implement only a thin image-generation wrapper, while the skill is marketed as a novel-to-short-drama adaptation workstation. This mismatch is dangerous because users may provide copyrighted manuscripts, adaptation inputs, or production assets under false assumptions about workflow scope, causing unintended data disclosure to a generic image API and bypassing expected domain-specific controls or review steps.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and demonstrates capabilities that imply access to shell, filesystem, environment variables, and networked APIs, but it declares no explicit tool scope or permission boundaries. In practice, this creates an over-privileged integration surface where a caller or future implementation could read secrets, modify files, or invoke external services without clear least-privilege controls or user visibility.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
In the usage triggers, the skill activates when a user mentions "AI编剧", which is a broad term that could match many unrelated creative-writing requests beyond this specific novel-to-short-drama workflow. The file does not provide negative examples or tighter constraints for this trigger, increasing the risk of unintended invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
"剧情拆分" can refer to many common editing, summarization, or narrative-analysis tasks and is not specific enough on its own to this skill's intended adaptation workflow. Because no limitation or negative examples accompany it, the activation condition may capture ordinary requests that should route elsewhere.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The default prompt hard-codes Chinese output regardless of the user's language preference, which can override user intent and reduce transparency about what the agent is doing. While not a direct exploit primitive, forced language behavior can impair review, consent, and safe oversight, especially when the skill produces production-ready workflows and runnable commands.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill enables implicit invocation without any visible trigger constraints or narrowing conditions, which can cause the agent to auto-activate this capability in contexts the user did not clearly request. In a skill that can generate executable workflows and AI-HIVE commands, ambiguous activation increases the risk of unintended use, scope creep, or unsafe handling of copyrighted or marketing-sensitive tasks.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a workspace for adapting authorized novels into short-drama planning artifacts and, when needed, generating assets through AI-HIVE OpenAPI. This script instead probes, trims, crops/pads, mutes, normalizes, and concatenates local video files via ffmpeg, which is a separate post-production capability not justified by the stated purpose or described workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains user-facing natural-language descriptions and prompts that are exclusively in Chinese, beginning with the module docstring. The skill does not offer a language selection or document that it is intentionally restricted to Chinese users, which can violate a language/locale policy requiring user choice or explicit justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file contains broader chat and video-generation capabilities unrelated to the stated skill purpose, increasing attack surface and enabling functionality that users or orchestrators may invoke unexpectedly. In this context, hidden extra capabilities are risky because the skill handles external API calls, uploads local media, and could route sensitive text, images, audio, or video beyond the narrowly described short-drama image workbench use case.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file advertises and implements a broad, generic AI Hive client with chat, image, video, model listing, uploads, and task polling, while the skill metadata describes a narrower novel-to-short-drama video workbench. This capability mismatch increases the attack surface and allows callers to use the skill as a general-purpose AI gateway outside its declared scope, undermining least privilege and policy enforcement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring is entirely in Chinese and presents the skill as a general-purpose AI tool, while later user-facing prompts and help text are also predominantly Chinese. Because this is a general utility rather than a clearly region-specific compliance tool, the natural-language interface effectively imposes a specific language/locale without user opt-in.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill exposes a user-info operation that retrieves account information and wallet balance, which is not necessary for transforming novels into short-drama assets. Even if the API only returns the caller's own data, exposing unrelated account inspection expands sensitive-data access and can leak billing or identity details through the agent surface.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The embedded skill parser presents itself as a dedicated video-generation skill, but the same file still contains reusable generic chat, image, model, and account-management functionality. This inconsistency can mislead reviewers and integrators about the real capability envelope, making policy bypass or accidental misuse more likely.
- Content
Static analysis
No suspicious patterns detected.