Security audit

真实买家评价转广告视频｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE workflow for turning authorized reviews into ad assets; it uses API keys, media uploads, and possible paid generation, but no hidden destructive or exfiltrating behavior was found.

Install only if you intend to use AI-HIVE for authorized review-to-ad production. Review media rights before uploading files, prefer environment variables for API keys if you do not want a persistent local config file, and confirm model, routing, cost, and prompt before running generation commands.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill exposes code paths that can access environment variables, the filesystem, the network, and the shell, yet it declares no permissions or capability boundaries. That creates a confused-deputy risk: an invoking agent or reviewer may treat it as low-privilege content while it can actually perform sensitive actions such as reading local files, invoking ffmpeg, or making outbound API calls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose is narrowly framed around authorized review-to-ad workflows, but the described behavior includes broader capabilities such as arbitrary text-model chat, account and wallet inspection, generic model enumeration, direct uploads, local credential storage, and general ffmpeg editing. This mismatch is dangerous because it hides a much larger attack surface than users expect, increasing the chance of unauthorized data access, billing exposure, or misuse of stored API credentials.

Description-Behavior Mismatch

High

Confidence: 91% confidence
Finding: The skill claims it should only use traceable, authorized real reviews, but the code enforces none of those constraints before generating ad assets. In this context, that omission materially increases the risk of misuse for unauthorized testimonials, fabricated social proof, or policy-violating ad content while presenting itself as compliant.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: The trigger phrases are broad enough to match many ordinary marketing or content requests, which can cause the skill to activate outside its intended niche. Over-broad activation is risky here because the skill has meaningful code capabilities and external API interactions, so accidental invocation could expose users to unnecessary data handling, file/network actions, or billable operations.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables implicit invocation with no trigger constraints, so it may activate in broader contexts than intended and inject its default behavior into unrelated conversations. Because this skill can generate production-ready workflows and runnable AI-HIVE commands for ad-video creation, unintended activation could cause unauthorized processing of marketing content, language steering, or execution-oriented guidance without clear user intent.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The default prompt hard-codes Chinese output and a specific transformation workflow without user opt-in, which can override user preferences and reduce transparency about how the assistant is framing the task. In isolation this is mainly a trust and UX issue, but combined with implicit invocation it increases the chance that users receive unexpected, workflow-driving output they did not request.

Static analysis

No suspicious patterns detected.