AI大模型专家｜OpenAI 兼容中转接口迁移｜AI-HIVE

• Outcome: Review
• Latest audit: Aug 25, 2026 · 8:07 PM UTC
• Version: 1.0.0

Overview

This AI-HIVE migration skill is mostly user-directed, but it needs review because some packaged scripts do not fully match the published skill identity and the init flow can persist an API key locally.

Review this before installing if you do not want AI-HIVE-specific guidance to trigger implicitly, if you do not want media uploaded to AI-HIVE, or if you do not want an API key saved under ~/.ai-hive/config.json. Use environment variables instead of the init persistence flow when possible, confirm budgets before generation, and treat the Token Hub naming in scripts as a packaging inconsistency that should be fixed by the publisher.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and demonstrates capabilities that require sensitive operations such as shell execution, network access, local file read/write, and environment-variable handling, but it declares no permissions. This creates a transparency and consent gap: users or hosting platforms may not realize the skill can access local files, invoke external services, or process API keys and media, increasing the risk of over-privileged execution and accidental secret exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose frames the skill as migration assessment and planning, but the actual behavior expands into operational actions: uploading user media, generating and downloading assets, querying account/wallet information, launching a browser, writing local API key configuration, and performing local video transformations. This mismatch is dangerous because users may consent to advisory analysis while unintentionally granting the skill authority to exfiltrate data, alter local state, incur charges, or expose credentials through local configuration and browser-assisted flows.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file header and implementation do not match the declared skill purpose. Instead of OpenAI-compatible relay migration or audit guidance, the code is a general AI Hive media-generation CLI, which can mislead users into running unrelated code and sending prompts, files, and credentials to a third-party service they did not intend to use. In a security review context, capability/identity mismatch is dangerous because it defeats informed consent and can hide data exfiltration paths behind deceptive packaging.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The embedded SKILL_CONFIG repurposes the file into a different 'Token Hub' video-generation skill that contradicts the supplied manifest identity. This kind of hidden rebranding/rerouting increases the risk that users invoke one skill while actually operating another workflow, causing unintended uploads, billing, and model usage under false pretenses. The contradiction is especially concerning because it appears late in the file and overrides the apparent top-level purpose.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill enables implicit invocation globally without any trigger constraints, so it may auto-activate in conversations that only loosely match the topic. Because this skill can influence API migration decisions and generate runnable integration guidance, unintended invocation can steer users toward a specific relay/vendor flow without clear user intent or consent.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The default prompt hard-codes runnable Chinese examples without offering a user-choice mechanism. This is primarily a safety and UX control issue: forced output language can cause misunderstandings, reduce review accuracy, and increase the chance that users apply generated migration steps incorrectly if Chinese is not their preferred language.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.