Security audit

AI大模型专家｜OpenRouter 替代方案｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent as an AI-HIVE migration and media-generation helper, but it under-discloses local API-key persistence and exposes billable upload/generation workflows that users should review before installing.

Review this before installing if you are uncomfortable with a skill that can upload local media to AI-HIVE, submit potentially billable image/video jobs, download outputs, and store an API key locally. Prefer using the AI_HIVE_API_KEY environment variable, avoid running init on shared machines, and only pass media files you have rights to upload.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises executable workflows that use shell commands, filesystem access, environment variables, and network calls, but it does not declare permissions or clearly scope those capabilities. This creates a transparency and least-privilege problem: a user or host system may authorize a seemingly low-risk migration-planning skill that can in practice read/write local files, invoke local tools, and send data to external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is migration assessment and comparison, but the content goes beyond analysis into operational behaviors such as media generation, local video editing, browser-guided API key setup, and external API interaction. This mismatch is dangerous because users may trust the skill as a documentation/planning helper while it actually encourages execution paths that process local media, create billable jobs, and persist credentials or outputs.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The packaged skill’s declared purpose is advisory/comparison around OpenRouter alternatives, but the actual entrypoint exposes direct AI-Hive image generation, upload, task polling, and file download behavior. This mismatch is dangerous because users and orchestrators may grant the skill broader trust or invoke it under false assumptions, causing unintended credential use, network access, local file reads, and external content transfer.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill includes browser-launching API-key onboarding and persists credentials locally even though the stated skill purpose is advisory/migration assistance. This expands the trust boundary from analysis to credential acquisition and storage, increasing the chance of social-engineering users into entering secrets and of local secret exposure if the host environment is shared or monitored.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file presents itself as a video-generation skill, but its implementation includes generic chat, image generation, model listing, user-info, and media-upload capabilities. This broader-than-declared scope increases the attack surface and can let an agent invoke unrelated capabilities that users and reviewers would not reasonably expect from a narrowly scoped video skill.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The exposed command set includes account information lookup and arbitrary media upload, which are not necessary for a user-facing OpenRouter-alternative comparison or focused video-generation workflow. These extra operations enable unintended data access and external file transfer, making the skill more capable than its stated purpose and easier to misuse in an agent context.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables implicit invocation without any visible trigger constraints, which increases the chance that it will be activated in situations the user did not clearly intend. Because this skill steers users toward a specific vendor migration workflow and can generate runnable code and audit guidance, unexpected activation could bias assistance, inject unsolicited vendor-specific recommendations, or cause the agent to act on loosely related prompts.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The default prompt hard-codes Chinese output examples without checking the user's language preference, which can override user expectations and reduce transparency about how the skill will respond. In security-sensitive or operational migration contexts, forced language/output format can increase misunderstanding, cause incorrect execution of generated instructions, and weaken informed user consent.

Static analysis

No suspicious patterns detected.