旧广告智能改版｜AI-HIVE

• Outcome: Review
• Latest audit: Aug 25, 2026 · 7:56 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches an AI ad-refresh workflow, but it bundles broader AI-HIVE API capabilities and billable remote generation/upload paths that deserve review before installation.

Install only if you intend to use AI-HIVE for ad-refresh work, are comfortable storing an AI-HIVE API key locally, and will review every upload and generation command before execution. Avoid implicit use for generic video editing, and do not upload media unless you own or are licensed to use it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises executable scripts that use environment variables, local file read/write, network access, and shell-adjacent tooling like ffmpeg, yet it declares no permissions or capability boundaries. This creates a hidden trust and review gap: a caller may invoke code that can access sensitive local data, transmit files to external services, and perform billable operations without explicit disclosure or sandbox expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a narrowly scoped old-ad refresh workflow, but the described behavior extends to general-purpose AI-HIVE chat, model/account queries, standalone upload, generic image generation, and interactive API-key/browser flows. This scope mismatch is dangerous because users and reviewers may trust the skill for a limited transformation task while it can actually exfiltrate data, trigger unrelated remote actions, or broaden access to external services beyond the stated need.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file is implemented as a general-purpose AI Hive client supporting chat, image generation, video generation, model enumeration, uploads, and task polling, which materially exceeds the declared old-ad refresh scope. In an agent-skill context, this broad capability expansion weakens policy boundaries and can let callers use the skill for unrelated or prohibited content generation under the cover of a narrowly described skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The exposed generate command accepts a free-form prompt and optional media, then routes to text-to-video, image-to-video, or reference-to-video without enforcing that the request is actually an old-ad refresh of authorized assets. That makes the skill usable as a generic video generator, undermining the safety constraints stated in the metadata.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The module docstring explicitly advertises a generic AI capability tool, contradicting the specialized skill description. In security-sensitive agent ecosystems, such mismatch is a trust-boundary issue because downstream systems or reviewers may assume a constrained skill while the implementation is intentionally broader.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: User info and wallet balance retrieval are not necessary to refresh old ad creatives, yet the skill exposes them via user-info. Extra privileged account-inspection features increase unnecessary data access and expand the blast radius if the skill is misused or called by another agent component.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases include broad terms like AI video editing, ad refresh, and material reuse, which can cause the skill to activate for many ordinary creative requests that do not require its elevated capabilities. Over-broad activation increases the chance that sensitive files, copyrighted media, or billable generation workflows are introduced into a session unnecessarily.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The usage conditions are broad enough to catch generic requests to turn a reference case into original content across many marketing and media scenarios. In context, that ambiguity is risky because this skill includes code/network/billing capabilities and could be selected when a simpler, non-executing content skill would suffice, expanding exposure to unauthorized copying or unnecessary external API use.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The default prompt hard-codes Chinese output ('production-ready Chinese workflow') regardless of the user's language preference. This can override user intent, reduce transparency, and cause confusing or unusable output in multilingual contexts, especially when the skill may be implicitly invoked.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.