商品讲解视频一键生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent AI Hive video generator, but it handles a persistent API key and can send it to arbitrary configured endpoints without enough scoping or disclosure.

Review this skill before installing if you use valuable AI Hive credentials. Only use the default AI Hive endpoint unless you deliberately trust a custom endpoint, avoid setting AI_HIVE_BASE_URL from untrusted environments, and treat uploaded product images, video, and audio as data sent to the configured service. Prefer installing dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:75

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:75
Vulnerability Type: Unpinned dependency installation from the active Python package index
Risk Level: Medium

Vulnerable Code:

bash

pip3 install requests

Technical Analysis

The documented installation procedure installs requests without a version constraint, cryptographic hash, lockfile, or isolated virtual environment. The package artifact ultimately installed therefore depends on the state and configuration of the user's active Python package index at installation time.

Although requests is a legitimate package, this installation pattern does not ensure that users receive a previously audited release. A compromised package index or mirror, poisoned pip configuration, or maliciously replaced artifact could introduce attacker-controlled code. Installation into the global Python environment may also change dependencies used by unrelated applications.

Attack Path

1. An attacker compromises or controls the Python package source or mirror configured on the victim's system.
2. The attacker supplies a malicious or modified artifact in response to the unpinned requests dependency request.
3. The user follows the installation command in SKILL.md.
4. pip downloads and installs the attacker-controlled artifact without verifying a project-provided hash.
5. Malicious package code can execute during installation or when scripts/videogen.py imports requests.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running pip or the Skill. This may expose local files, the AI Hive API key, uploaded media, and other credentials accessible to that account. If pip is run with elevated privileges, the impact could extend to system-wide Python packages and privileged filesystem locations.

The repository does not itself contain a malicious dependency name, and exploitation requires compromise or manip ...[truncated 47 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and its transitive dependencies to reviewed versions in a lockfile.
• Require cryptographic hashes during installation, such as through a hash-locked requirements file and pip install --require-hashes.
• Document installation inside a dedicated virtual environment instead of the global Python environment.
• Use a trusted, explicitly configured package index and require TLS certificate validation.
• Add automated dependency vulnerability and integrity scanning to the release process.
• Periodically update the lockfile after reviewing security advisories and release changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:92

Finding

Bearer API Key Can Be Transmitted to an Unrestricted Custom Endpoint

Content

View full analysis

Vulnerability Details

File Locations: scripts/videogen.py:92-99, scripts/videogen.py:126-144, and scripts/videogen.py:587
Vulnerability Type: Unrestricted credential-bearing network destination
Risk Level: Medium

Vulnerable Code:

python

def _resolve_base_url(self, cli_url):
    if cli_url:
        return cli_url.rstrip("/")
    env_url = os.environ.get("AI_HIVE_BASE_URL")
    if env_url:
        return env_url.rstrip("/")
    file_config = self._read_config_file()
    if file_config.get("base_url"):
        return file_config["base_url"].rstrip("/")
    return DEFAULT_BASE_URL

python

class AiHiveClient:
    """封装 AI Hive OpenAPI HTTP 调用。"""

    def __init__(self, config):
        self.config = config
        self.base = config.base_url
        self.headers = {
            "Authorization": f"Bearer {config.api_key}",
            "Content-Type": "application/json",
        }

    def _url(self, path):
        return f"{self.base}/openapi/v1/{path}"

    def _request(self, method, url, **kwargs):
        self.config.log(f"{method} {url}")
        try:
            resp = requests.request(
                method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs
            )

python

parser.add_argument("--base-url", help=f"API Base URL (默认 {DEFAULT_BASE_URL})")

Technical Analysis

The API destination can be replaced through the --base-url argument, the AI_HIVE_BASE_URL environment variable, or the local configuration file. The value is used without validating its scheme, hostname, port, or origin.

Every request made through AiHiveClient._request includes the AI Hive bearer key in the Authorization header. Consequently, a custom base URL may direct the credential to an attacker-controlled host. Plain HTTP URLs are also accepted, allowing the credential and request contents to be exposed to network interception.

...[truncated 1705 chars]

Remediation

View remediation

Remediation Suggestions

• Require the https scheme for all credential-bearing API requests and reject plain HTTP.
• Allowlist the official AI Hive hostname by default.
• If custom endpoints are required for development, place them behind an explicit opt-in flag and display the exact destination before sending credentials.
• Require separate credentials for custom or development endpoints rather than automatically reusing the production API key.
• Parse URLs with a standard URL parser and reject embedded user information, unexpected ports, fragments, malformed hosts, and unsafe schemes.
• Validate environment- and file-derived endpoint settings with the same policy applied to command-line values.
• Consider ignoring environment-based base URL overrides in privileged or automated execution contexts.
• Redact or avoid printing sensitive URL components in verbose logs.
• Document that endpoint overrides affect both credential transmission and media-upload destinations.
• Rotate the API key immediately if it may already have been sent to an untrusted endpoint.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill exposes executable commands that install packages, access the network, and run a Python script, but it does not declare any explicit tool scope or permission boundaries. That creates an avoidable trust gap: an agent or reviewer cannot tell from the manifest what capabilities are intended, increasing the chance of over-privileged execution or misuse if the script or its inputs are compromised.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a focused skill for turning product materials into explainer videos and related scripts/shots, but this file implements a broader '通用 AI 能力调用工具' with user-info lookup, model listing, generic task querying, and standalone media upload. Those capabilities are not just implementation details of generating explainer videos; they materially expand the skill into a general AI Hive API client.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains user-facing docstrings, errors, CLI help text, and prompts in Chinese only, beginning at the module docstring and continuing throughout the script. Under the policy, forcing a specific language without opt-in is a natural-language policy violation because users are not offered any language or locale choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

A product-explainer video generation skill does not inherently need to expose a user-info endpoint that retrieves account details and wallet balance. This is an administrative/account capability rather than a direct requirement for creating product explanation videos.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest is centered on generating product explainer videos, but the code contains full chat and image-generation command handlers and parser entries for those capabilities. While scripts and visuals may support video production, exposing standalone chat and image generation makes the actual behavior significantly broader than the declared skill purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill opens a browser, guides the user through portal login, and stores API credentials locally in a config file. Credential onboarding may be convenient, but it is not a direct capability implied by a product-explainer video generator and broadens the skill into account bootstrap/credential management.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing natural language exclusively in Chinese across the substantive changelog entries. Under the policy rule, forcing a specific language without opt-in can be a locale/language policy violation when no alternative or choice is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description and main instructions are primarily written in Chinese, with no note that other languages are supported or optional. This can violate language/locale policy when a skill imposes a specific language experience without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing content. There is no indication that this skill is region-specific or that users may choose another language, so this appears to violate the language/locale policy for natural-language content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.