Pika 视频生成替代｜AI 视频生成与编辑

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.0

Overview

This AI video skill is mostly purpose-aligned, but its helper script gives the remote service too much control over where user media is uploaded from and where generated downloads are saved.

Install only if you are comfortable giving this skill an AI Hive API key and uploading selected images or videos to AI Hive-controlled upload URLs. Prefer a sandboxed environment, avoid sensitive media, set a specific output directory, and review or patch the downloader before routine use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pika_effect.py:293

Finding

Server-Controlled Task ID Permits Output Path Traversal

Content

View full analysis

Vulnerability Details

File Location: scripts/pika_effect.py:254-259 and scripts/pika_effect.py:284-293
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: High

Vulnerable Code

python

task_id = response.get("taskId")
if not task_id:
    print(json.dumps(response, ensure_ascii=False, indent=2))
    return
print("taskId =", task_id)
if not args.no_download:
    wait_for_task(hive, task_id, Path(args.output_dir))

python

for index, item in enumerate(task.get("items", []), 1):
    if item.get("status") == "FAILED":
        print("[failed]", item.get("errorMessage"), file=sys.stderr)
    result_url = item.get("resultUrl")
    if item.get("status") == "COMPLETED" and result_url:
        download(result_url, output_dir / "{}_{}.mp4".format(task_id, index))

Technical Analysis

The task ID returned by the remote generation service is inserted directly into a destination path without validation or sanitization. pathlib.Path does not prevent traversal when a path component contains sequences such as ../.

The resulting destination is subsequently opened in write-binary mode by download(). Parent directories are also created automatically. A malicious or compromised service could therefore construct a task ID that causes the result to be written outside the configured output directory.

Although the generated filename always receives an _<index>.mp4 suffix, the attacker can still target writable paths with a compatible filename or create files in unintended directories.

Attack Path

1. The user submits a generation request to the configured AI Hive API.
2. A compromised or malicious API response supplies a task ID containing path traversal components.
3. The same service returns a completed task and a controlled result URL.
4. wait_for_task() concatenates the untrusted task ID into the output path.
5. download() creates the ...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

• Validate task IDs against a strict allowlist before using them, for example ^[A-Za-z0-9_-]{1,128}$.
• Do not use remote identifiers directly as filenames. Generate a local random filename and store the remote task ID only as metadata.
• Resolve both the output directory and final destination with Path.resolve().
• Verify that the resolved destination is contained beneath the resolved output directory before opening it.
• Refuse absolute paths, path separators, dot components, control characters, and platform-specific separator variants.
• Use exclusive file creation where overwriting is not required.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pika_effect.py:159

Finding

Remote API Can Select Arbitrary Upload and Download Hosts

Content

View full analysis

Vulnerability Details

File Location: scripts/pika_effect.py:159-180 and scripts/pika_effect.py:265-276
Vulnerability Type: Unrestricted remote destination and insufficient redirect validation
Risk Level: Medium

Vulnerable Code

python

token = hive.upload_token(path.name, content_type, path.stat().st_size)
media_id = token["mediaId"]
upload = token["upload"]
upload_url = upload["url"]
scheme = urlparse(upload_url).scheme
if scheme != "https":
    raise SystemExit("对象存储上传地址必须使用 HTTPS")
try:
    with path.open("rb") as handle:
        response = requests.request(
            upload.get("method", "PUT"),
            upload_url,
            headers=upload.get("headers", {}),
            data=handle,
            timeout=300,
        )

python

def download(url, destination):
    if urlparse(url).scheme != "https":
        raise SystemExit("结果下载地址必须使用 HTTPS")
    destination.parent.mkdir(parents=True, exist_ok=True)
    try:
        with requests.get(url, stream=True, timeout=300) as response:
            response.raise_for_status()
            with destination.open("wb") as handle:
                for chunk in response.iter_content(8192):
                    if chunk:
                        handle.write(chunk)

Technical Analysis

Upload and result URLs originate from the remote API. The implementation validates only that the initial URL uses the HTTPS scheme. It does not validate the hostname, port, embedded credentials, or final destination after redirects.

The requests library follows redirects by default. Consequently, an initially valid HTTPS URL can redirect to another unapproved host and may potentially redirect to a non-HTTPS destination. For uploads, this can disclose user-selected images or videos to infrastructure outside the intended service boundary. For downloads, it allows the remote service to select an arbitrary source for content w ...[truncated 1199 chars]

Remediation

View remediation

Remediation Suggestions

• Maintain an explicit allowlist of approved object-storage hostnames and ports.
• Require HTTPS for the initial URL and every redirect target.
• Disable automatic redirects with allow_redirects=False, or process redirects manually and validate each destination.
• Reject URLs containing user information, unexpected ports, malformed hostnames, or IP-literal destinations unless explicitly required.
• Resolve hostnames carefully if private or loopback address access is not intended.
• Document every external domain to which user media may be uploaded.
• Where supported, bind signed upload URLs to the expected HTTP method, content type, filename, and content length.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pika_effect.py:265

Finding

Unbounded Result Downloads Can Exhaust Local Disk Space

Content

View full analysis

Vulnerability Details

File Location: scripts/pika_effect.py:265-276
Vulnerability Type: Uncontrolled resource consumption
Risk Level: Medium

Vulnerable Code

python

def download(url, destination):
    if urlparse(url).scheme != "https":
        raise SystemExit("结果下载地址必须使用 HTTPS")
    destination.parent.mkdir(parents=True, exist_ok=True)
    try:
        with requests.get(url, stream=True, timeout=300) as response:
            response.raise_for_status()
            with destination.open("wb") as handle:
                for chunk in response.iter_content(8192):
                    if chunk:
                        handle.write(chunk)
    except requests.RequestException as exc:
        raise SystemExit("结果下载失败：" + str(exc))
    print("[saved]", destination)

Technical Analysis

The response body is streamed to disk until the server finishes sending data. The implementation does not enforce a maximum result size, validate Content-Length, track cumulative bytes, or check available disk capacity.

The configured timeout does not impose an overall file-size limit. A server that continues providing data within the timeout behavior of requests can cause the destination file to grow until the filesystem is full.

Partial files are also not removed when a request fails after writing has begun.

Attack Path

1. A generation task is reported as completed with a malicious or faulty result URL.
2. The URL serves an extremely large response or a response of indefinite length.
3. The downloader writes every received chunk without maintaining a byte limit.
4. The output filesystem becomes full or reaches its quota.
5. The Skill and unrelated applications may fail to write files, resulting in denial of service or data loss.

Impact Assessment

An attacker controlling the result endpoint can consume storage available to the current user and potentially fill a shared files ...[truncated 179 chars]

Remediation

View remediation

Remediation Suggestions

• Define a conservative, configurable maximum video result size.
• Reject responses whose declared Content-Length exceeds that limit.
• Track cumulative bytes while streaming and abort immediately when the limit is exceeded.
• Download to a temporary file in the destination directory and atomically rename it only after successful validation.
• Delete partial files after network failures, validation failures, or limit violations.
• Optionally check available disk capacity before starting the download.
• Apply an overall transfer deadline in addition to connect and read timeouts.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:87

Finding

Third-Party Dependency Installation Is Unpinned

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:86-88 and scripts/pika_effect.py:16-18
Vulnerability Type: Unpinned dependency and non-reproducible installation
Risk Level: Low

Vulnerable Code

bash

pip3 install requests
python3 "$SKILL_PATH/scripts/pika_effect.py" init --api-key sk-api-your-ai-hive-key
python3 "$SKILL_PATH/scripts/pika_effect.py" task --task-id <taskId>

python

try:
    import requests
except ImportError:
    raise SystemExit("缺少 requests，请运行 pip3 install requests")

Technical Analysis

The installation guidance retrieves requests without a fixed version, lock file, or integrity hash. Its transitive dependencies are likewise uncontrolled. As a result, installations performed at different times may execute different dependency code.

No evidence of typosquatting, dependency confusion, or a currently malicious package was identified. The risk is that a future compromised release, package-index compromise, or incompatible dependency update would be installed automatically when users follow the documented command.

Attack Path

1. A user follows the documented pip3 install requests instruction.
2. The package installer resolves whatever package and dependency versions are current at that time.
3. If the package index or a resolved release has been compromised, malicious installation or runtime code executes with the user's privileges.
4. The compromised dependency can access the API key, uploaded media, generated files, and other resources available to that user.

Impact Assessment

The dependency executes with the privileges of the user running pip. In a successful supply-chain compromise, it could read the AI Hive API key, access local files, alter generated output, or execute arbitrary user-level code. The current repository does not contain evidence that the legitimate requests package is malicious; this finding concerns unsafe and no ...[truncated 37 chars]

Remediation

View remediation

Remediation Suggestions

• Pin a reviewed requests version and all transitive dependencies in a requirements or lock file.
• Use integrity hashes, such as pip install --require-hashes -r requirements.txt.
• Install dependencies in an isolated virtual environment rather than a global interpreter.
• Specify the trusted package index and use TLS certificate verification.
• Periodically scan and deliberately update pinned dependencies after security review.
• Replace the free-form installation instruction with a reproducible installation command based on the lock file.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a local Python script, accepts API keys, uploads local files, queries remote tasks, and installs dependencies, but it does not declare any explicit tool or permission scope. That creates an authorization gap where an agent may expose shell, filesystem, environment, and network capabilities more broadly than intended, increasing the blast radius if the skill is misused or the script is modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description contains many broad trigger phrases such as generic video generation, editing, API, effects, and alternative-product searches, which can cause the skill to activate for loosely related requests. Overbroad routing can lead an agent to invoke networked/scripted behavior in contexts the user did not intend, potentially causing unnecessary file access, uploads, or external API use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Natural-language policy checks apply to all file types. The skill content and usage guidance are presented almost entirely in Chinese, but the file does not state that the skill is region-specific or offer users a language/locale option, which can amount to forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language descriptions entirely in Chinese and frames the tool's purpose in that locale without any indication of language choice or opt-in. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.