ClawHub
Back to skill

Security audit

AI大模型专家｜Seedance 源头 API 渠道｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-HIVE migration-planning aid that creates a local plan file and does not show hidden credential use, persistence, or destructive behavior.

Before installing, understand that this is a commercial migration-assessment workflow for AI-HIVE. Treat its company-provided claims as claims to verify, use only non-production authorized samples first, keep API keys in environment variables, and write the generated plan to a safe local path.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs users to run a local script that writes an output JSON file, but the skill metadata does not declare any corresponding permission or capability. This creates an integrity and transparency problem: consumers and enforcement systems cannot accurately assess what the skill may do, and a modified version of the script path or output target could overwrite local files unexpectedly.

Static analysis

No suspicious patterns detected.