商品链接转TikTok带货视频｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 24, 2026 · 2:09 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI-HIVE workflow for creating ecommerce/TikTok marketing media, with expected API use, local media handling, and credential setup.

Install only if you intend to use AI-HIVE for ecommerce media generation. Review prompts, routing, costs, and uploaded files before running generation commands, and remove or rotate the API key if you no longer want it stored at ~/.ai-hive/config.json.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill exposes operational capabilities including environment-variable access, file read/write, network access, and shell execution without declaring permissions or narrowing them to the minimum needed. This weakens reviewability and consent boundaries: users or orchestrators may invoke a skill that can access local files, secrets, and external services beyond what its manifest signals.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented purpose is a narrowly scoped product-link-to-TikTok workflow, but the described behavior includes broader AI-HIVE client operations, local config/API-key handling, and general ffmpeg/media processing. This mismatch increases the risk of capability smuggling, where a reviewer or user authorizes a marketing workflow but the skill can perform materially broader local and network actions, including handling secrets and arbitrary media files.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a specialized product-URL-to-TikTok-video tool, but the implementation is a generic AI Hive client with broad chat, image, video, upload, and account features. This mismatch is dangerous because it expands the skill’s effective capability surface beyond what users, reviewers, and policy controls would reasonably expect, enabling misuse under a narrower marketing label.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: These commands expose unrelated generic functions such as text chat, image generation, model enumeration, user-info, and arbitrary media upload, none of which are necessary for a narrowly scoped product-link video skill. Overbroad command exposure increases attack surface and creates a capability smuggling risk, where a caller can invoke functions outside the stated business purpose.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The file-level documentation describes a general AI capability invocation tool while the skill metadata claims a specialized ecommerce video transformation skill. Contradictory identity and purpose make security review, user consent, and policy enforcement less reliable, which can conceal risky behavior behind misleading packaging.

Context-Inappropriate Capability

Low

• Confidence: 91% confidence
• Finding: Exposing user-info and wallet balance inspection is outside the stated purpose of converting product materials into TikTok videos. Even if not directly destructive, it reveals account and billing information that is unnecessary for the workflow and violates least-privilege design.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill enables implicit invocation without any visible trigger constraints, exclusions, or narrowing conditions. Because this skill can generate runnable AI-HIVE commands and production-ready workflows for ad/video creation from product URLs, broad auto-activation increases the chance it is invoked in unintended contexts, causing unreviewed third-party API actions, content generation, or policy-sensitive marketing outputs.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The default prompt hard-codes Chinese output regardless of user preference or locale. This can create consent and transparency issues by changing the interaction mode unexpectedly, and in security-relevant or compliance-heavy marketing workflows it may cause users to misunderstand generated instructions, review steps, or policy constraints.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The init flow writes a long-lived API key to a predictable local file path, but does not clearly warn the user that a sensitive credential will be persisted on disk. Even though file permissions are tightened to 0600, users on shared, backed-up, synced, or compromised systems may unknowingly leave reusable credentials stored locally where they can later be recovered.

Static analysis

No suspicious patterns detected.