ClawHub
Back to skill

Security audit

商品讲解视频一键生成

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI Hive video-generation helper that uses an API key, user-provided media, and local output files in ways that fit its product-explainer video purpose.

Before installing, use this only with product media you are willing to send to AI Hive, review the AI Hive account/API-key terms, and keep the stored ~/.ai-hive/config.json key protected or prefer the AI_HIVE_API_KEY environment variable if you do not want a persistent key file.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes shell commands, reads and writes files, accesses environment variables, and performs network operations, yet declares no permissions. This creates a transparency and consent gap: users and the platform may treat the skill as documentation-only while it can execute code and reach external services, increasing the chance of unintended data access, credential use, or exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose is product explainer video generation, but the detected behavior includes user/account queries, wallet balance access, model enumeration, generic chat, media upload, and interactive browser-based API key setup. These capabilities materially exceed user expectations and can expose sensitive account, billing, or credential data under the guise of a media-generation workflow.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.