商品植入微短剧｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 9:15 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI-HIVE video/image generation workflow with local helper scripts, API-key setup, user-selected media upload, and ffmpeg editing, with no evidence of hidden exfiltration or destructive behavior.

Install only if you intend to use AI-HIVE for commercial image/video generation. Expect user-selected media to be uploaded to AI-HIVE, generated outputs to be downloaded locally, and an API key to be stored if you run init; confirm prompts, route, budget, and asset rights before running generation commands.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises executable workflows that use environment variables, local file I/O, shell commands, network access, and ffmpeg, but it does not declare any permissions or clearly constrain those capabilities. That creates a trust-boundary problem: users or hosting platforms may assume the skill is low-privilege while it can access local files, invoke external tools, and contact remote services, increasing the chance of unintended data exposure or unsafe execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a narrowly scoped product-placement micro-drama skill, but the described behavior includes broader account access, wallet balance retrieval, model catalog enumeration, generic media upload, general text chat, local ffmpeg editing, and interactive API-key setup with local credential storage. This mismatch is dangerous because it can socially engineer users into granting broader trust and capabilities than the declared scope implies, enabling collection of account metadata, upload of arbitrary files, or execution of unanticipated local operations.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file is implemented as a broad AI-Hive client rather than a narrowly scoped product-placement micro-drama skill. That scope expansion exposes extra capabilities such as chat, model discovery, account inspection, and arbitrary upload, increasing attack surface and making it easier for downstream callers to repurpose the skill beyond its declared intent.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: Exposing user-info and model-listing endpoints gives the skill reconnaissance capabilities not needed for product-placement video generation. While not directly compromising the host, these endpoints can leak account metadata, available models, balance, or platform configuration that may aid misuse or unauthorized profiling.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest enables implicit invocation while the skill description covers a broad set of marketing, advertising, e-commerce, and creative requests, but the file does not define tight trigger boundaries or exclusion rules. This increases the chance the agent invokes the skill in contexts the user did not clearly intend, potentially causing unexpected promotional content generation, workflow execution, or external API-related actions without sufficiently explicit user consent.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The default prompt hard-codes Chinese output and a specific workflow framing without checking the user's language preference or asking for consent. While not directly enabling code execution, it can override user intent, reduce transparency, and make the agent behave in a less predictable way, especially when users expect another language or a neutral response format.

Static analysis

No suspicious patterns detected.