Security audit

AI大模型专家｜Pixelo Video Agent替代与迁移｜AI-HIVE MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed migration-assessment guide for Pixelo-to-AI-HIVE video workflows, with some overly broad activation wording but no hidden or destructive behavior.

Installers should treat this as a commercial migration-planning aid and verify current Pixelo and AI-HIVE capabilities before relying on it. Be careful to use it only when evaluating Pixelo alternatives or AI-HIVE migration, and require human approval before uploads, paid generation, publishing, or external sharing as the skill itself recommends.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation text includes many broad trigger phrases such as educational video, AI video agent, and creative agent platform, which can cause the skill to activate for generic user requests outside the narrowly intended Pixelo migration-assessment scenario. Over-broad activation increases the chance the skill overrides a more appropriate skill or injects migration/commercial guidance into unrelated conversations, creating scope hijacking and policy misalignment rather than direct code execution risk.

Static analysis

No suspicious patterns detected.