T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:91- Finding
Unrestricted API endpoint override can disclose credentials and user media
- Content
View full analysis
- Remediation
View remediation
Security audit
旧广告智能改版｜AI-HIVE
Security checks for vulnerabilities and agentic risk
Overview
The skill is broadly aligned with AI-HIVE ad-video refresh work, but it needs review because its client can send API keys and selected media to an arbitrary configured API endpoint.
Review before installing or running with real brand assets. Use only the official AI-HIVE endpoint unless you intentionally trust a custom server, check AI_HIVE_BASE_URL and ~/.ai-hive/config.json before use, avoid uploading sensitive or unlicensed media, and rotate the API key if you suspect the endpoint or config was modified.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a specialized advertising creative-refresh skill with workflow orchestration, analysis, and external AI generation/API operations. The supplied code does not implement those behaviors. Instead, it is a narrow local CLI wrapper around ffmpeg/ffprobe for basic editing operations. While such utilities could support a broader ad-editing system, this chunk by itself materially differs from the declared primary purpose and lacks the key advertised capabilities. Therefore this is a clear description-behavior mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/videogen.py init --skill-name old-ad-creative-refresh-ai-hive
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/videogen.py init --skill-name old-ad-creative-refresh-ai-hive
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises executable workflows involving shell commands, file operations, environment variables, and network access, but does not declare any explicit tool scope or permission boundaries. In an agent environment, this can lead to overbroad invocation or unintended execution of sensitive operations without clear policy constraints, increasing the risk of data exposure, misuse of API credentials, or unsafe command execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrase 'AI视频编辑' is broad enough to match many unrelated user requests, which can cause the skill to activate outside its intended domain. Overbroad routing is dangerous in agent systems because it may steer users into workflows involving shell commands, file handling, and networked generation APIs even when a narrower or safer skill would be more appropriate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The condition allowing activation when a user wants to turn a reference case into original content is insufficiently constrained and can facilitate copyright infringement, style imitation, or improper reuse of third-party material. In this skill's marketing/media context, that ambiguity is more dangerous because users are specifically working with ads, reference creatives, and derivative transformations where ownership and similarity boundaries matter.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language string explicitly instructs the skill to produce a "production-ready Chinese workflow," which imposes a language choice on the user. The file does not offer a language option or explain a justified region-specific constraint, so this appears to violate the language/locale policy requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file hard-codes Chinese-language skill naming and defaults in user-facing natural language, including the module docstring and argparse description, without offering any language or locale selection. This can violate the language/locale policy because the skill appears to impose a specific language experience rather than providing opt-in or documenting a justified regional constraint.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest frames this skill as a focused capability for authorized old-ad refresh and reuse, with AI-HIVE used as an implementation detail for model config, uploads, pricing, routing, polling, and downloads. However, the file implements a broad '通用 AI 能力调用工具' and includes commands for freeform chat, account info retrieval, model enumeration, generic image generation, generic video generation, and raw media upload, which materially exceed the advertised specialized purpose.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file-level documentation explicitly says this is a '通用 AI 能力调用工具' wrapping chat, image generation, video generation, model query, upload, and polling. That actively conflicts with the specialized skill identity at the bottom of the file and in the manifest, which presents a focused old-ad creative refresh capability rather than a generic AI client.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This Python file contains user-facing natural language entirely in Chinese, beginning with the module description and continuing throughout prompts and help text. Because the skill does not offer a language/locale option or explain that it is intentionally China/Chinese-specific, it conflicts with the policy against forcing a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This tool uploads user-supplied media and prompts to a third-party remote API and object storage, but it does not present a clear privacy notice or confirmation before transmission. In a skill handling old ads and brand assets, that can lead users to unintentionally disclose proprietary marketing material, personal data in media, or confidential prompts to external processors.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
A standalone chat endpoint allows arbitrary text/multimodal conversations against any TEXT model, which is not a necessary or explicit part of the manifest's old-ad refresh scope. The manifest describes ad decomposition, asset retention, new-platform variants, and AI video editing/generation flows, not a general conversational AI tool.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes transforming authorized legacy ad assets and orchestrating AI-HIVE generation workflows, but it does not justify exposing account-profile or balance inspection. User-info is an operational/account-management capability, not an obvious requirement of ad-refresh processing.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
While checking model configuration can support generation, this implementation exposes a generic model browser across TEXT, IMAGE, and VIDEO types rather than a narrow selection tied to the refresh workflow. That makes the skill usable as a general AI-HIVE exploration client rather than a purpose-built old-ad refresh tool.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The init command automatically launches an external website where the user is instructed to log in and create/copy an API key. While the action is visible, there is no explicit warning that this will open a third-party site and involve credential/API-key handling outside the local CLI, which is a safety-relevant operation.
- Content
Static analysis
No suspicious patterns detected.