Security audit

小说转短剧工作台｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE workflow for turning authorized novel content into short-drama planning and media-generation tasks, with paid API use and local media handling that users should control deliberately.

Install only if you intend to use AI-HIVE for short-drama planning and media generation. Keep the API key private, review any generated commands before running them, confirm costs before generation, and upload only media or novel text you are authorized to process.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises executable workflows that use environment variables, local file access, shell commands, and network calls, but it declares no permissions. This creates an authorization gap: a host or reviewer may underestimate the skill’s capabilities, increasing the risk of unintended data access, secret exposure, or external requests when the skill is invoked.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 82% confidence
Finding: The skill’s stated purpose is narrow, but the documented behavior includes broader generic AI-HIVE queries and ffmpeg video manipulation capabilities not clearly scoped in the description. This mismatch is dangerous because users and automated policy systems may trust the declared business purpose while the skill can perform more expansive operations, enabling capability smuggling and reducing effective oversight.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file implements a broad, reusable AI Hive CLI with chat, image generation, model listing, uploads, and account queries, while the declared skill is a narrowly scoped novel-to-short-drama video workbench. This scope expansion increases the attack surface and enables downstream use cases unrelated to the skill’s stated purpose, weakening least-privilege and policy enforcement.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: User-info retrieves account details and wallet balance that are not necessary for converting novels into short-drama assets. Unnecessary access to billing/account metadata expands data exposure and may leak sensitive operational information if the skill is invoked by an untrusted workflow or user.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The generic text chat endpoint allows arbitrary LLM interaction beyond short-drama adaptation and video generation, turning the skill into a general-purpose model proxy. In a constrained skill environment, that broad capability can be abused for unrelated content generation, policy bypass attempts, or unapproved processing of sensitive text.

Context-Inappropriate Capability

Low

Confidence: 79% confidence
Finding: Standalone image generation is broader than the stated video-oriented short-drama workbench and is not clearly required by the manifest. Even if not inherently dangerous, unnecessary media-generation capability increases misuse potential and broadens the operational surface of the skill.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill enables implicit invocation and uses a very broad default prompt trigger, which increases the chance the agent activates this skill for loosely related requests. In a workflow that can generate runnable AI-HIVE commands and production outputs, unintended activation can cause unauthorized processing of copyrighted text, unexpected API usage, or actions the user did not explicitly request.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The default prompt hard-codes Chinese output ('production-ready Chinese workflow') without checking the user's language preference. While not directly dangerous on its own, this can mislead users, reduce transparency, and cause downstream mistakes if generated commands, rights guidance, or production instructions are not understood by the operator.

Static analysis

No suspicious patterns detected.