Security audit

商品链接转抖音带货视频｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE ecommerce media workflow that uses user-provided prompts, media, and API credentials to generate or edit marketing images and videos.

Install only if you are comfortable using AI-HIVE for ecommerce media work. Treat generated claims as drafts, confirm product facts and rights to any uploaded media, and review prompts, routing, cost, and output paths before running generation commands.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents executable workflows that use environment variables, local file I/O, network access, and shell-based tooling, yet it declares no permissions. This creates a transparency and containment problem: a host or reviewer cannot accurately scope what the skill may access, and users may invoke it without understanding that it can touch local files, read secrets from the environment, and make external API calls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared purpose is a narrow ecommerce video workflow, but the described/code-backed behavior includes generic AI-HIVE chat/model listing, local credential setup, and broad ffmpeg utilities unrelated to the core task. That mismatch is dangerous because it expands the effective capability surface beyond user expectations, making it easier to exfiltrate data, manipulate local media, or perform off-scope actions under the guise of a specialized marketing tool.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The packaged skill claims to convert product URLs into Douyin sales videos, but the exposed entrypoint is actually an image-generation wrapper with hard-coded model routing and no product-link parsing or end-to-end video workflow. This mismatch is dangerous because users and orchestrators may grant the skill permissions or trust assumptions based on its manifest, while the code performs a materially different function, increasing the risk of deceptive capability exposure and policy bypass.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file contains a broad generic API client with chat, model listing, wallet lookup, arbitrary upload, image generation, video generation, and task polling capabilities beyond the stated skill purpose. Excess capability increases attack surface and can enable misuse of granted credentials or platform access in ways users did not intend when invoking a narrowly scoped commerce-video skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill can call a user-info endpoint that reportedly returns account and wallet balance information, which is unrelated to generating commerce media from product inputs. Exposing account metadata in an unrelated skill creates unnecessary privacy and financial-information access and broadens what a compromised or misleading skill can learn about the user.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill-specific wrapper advertises a product-link-to-Douyin-video use case, but its generate path only forwards to cmd_image and does not ingest product URLs, extract product facts, or create videos. In security terms, that is a deceptive interface-to-implementation mismatch that can cause unsafe delegation, incorrect review assumptions, and abuse of user trust in a platform-specific marketing workflow.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill enables implicit invocation while exposing a very broad commerce/marketing-oriented capability surface. This increases the chance the agent will auto-select the skill for loosely related requests, causing unanticipated execution paths, external API use, or content-generation actions without clear user consent or tight triggering boundaries.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The default prompt hard-codes Chinese output regardless of the user's language preference, which can override user intent and reduce transparency about what the agent is doing. While not directly a code-execution issue, it can mislead users, impair review of generated instructions, and increase the risk of accidental misuse in multilingual environments.

Static analysis

No suspicious patterns detected.