Security audit

播客访谈转短视频｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE podcast-to-shorts workflow that uses user-provided media and API credentials, with no evidence of hidden execution or exfiltration.

Install this only if you are comfortable uploading authorized media to AI-HIVE and using an AI-HIVE API key for potentially billable generation. Review generated commands before running them, keep API keys out of chats and logs, and choose output paths carefully so local ffmpeg edits do not overwrite originals.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises and includes code paths that can access environment variables, local files, the network, and shell/ffmpeg, yet no explicit permission model is declared. That creates an over-privileged and under-specified execution surface where users or downstream agents may invoke sensitive capabilities without clear review boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is a narrow podcast-to-shorts workflow, but the described behavior extends to general text chat, image generation, account/balance querying, model enumeration, credential setup/storage, media upload, and generic ffmpeg utilities. This mismatch is dangerous because users and orchestrators may trust the skill with narrower expectations while it exposes broader data access, billing, and content-generation functionality than advertised.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file is presented as a narrowly scoped podcast-interview-to-shorts skill, but the implementation exposes a much broader generic AI client for text chat, image generation, video generation, model enumeration, uploads, and account operations. This scope expansion weakens least-privilege expectations for users and orchestrators, making it easier to invoke unrelated capabilities and increasing the blast radius if the skill is misused or compromised.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The skill exposes a user-info/account inspection endpoint even though the declared purpose is podcast interview clipping and short-video generation. While not directly exploitive on its own, this expands accessible account metadata beyond task needs and violates minimization expectations for a specialized skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: A generic text chat capability is included even though the skill is supposed to convert podcasts/interviews into short videos. This creates hidden functionality outside the declared contract, enabling arbitrary model interaction and increasing the chance of prompt abuse, policy bypass attempts, or unintended data processing with the same credentials.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill includes general-purpose image generation unrelated to the stated podcast-to-shorts scope. This unnecessary capability broadening increases misuse potential, allows off-purpose content generation under the skill's credentials, and undermines trust in manifest-based scoping.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module docstring explicitly advertises a generic AI capability tool, contradicting the manifest's specialized identity. This mismatch is dangerous because reviewers, users, or automation may trust the declared skill scope while the code intentionally or carelessly exposes broader actions, reducing transparency and weakening security review assumptions.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases include broad terms such as knowledge video, content repurposing, Shorts, and requests to turn a reference case into original content, which can capture many unrelated requests. Over-broad activation increases the chance this skill is selected in inappropriate contexts, exposing users to unnecessary file/network/billing operations and capabilities outside the intended safety envelope.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill enables implicit invocation while only describing broad use cases, so it may be triggered for loosely related requests without clear user intent. In a skill that can generate executable AI-HIVE commands and production workflows, ambiguous activation increases the chance of unintended tool use, unwanted API activity, or processing of sensitive media inputs.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The default prompt hard-codes Chinese output without checking the user's preferred language, which can override user expectations and reduce transparency. While not a direct code-execution issue, forced language behavior can mislead users, degrade reviewability of generated commands, and increase the risk of mistakes when outputs are operational or compliance-sensitive.

Static analysis

No suspicious patterns detected.