Security audit

连载角色一致性守护｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This is not plainly malicious, but it needs review because a narrowly named continuity-QA skill ships broad AI-HIVE upload and generation helpers with broad implicit activation.

Install only if you intend to use AI-HIVE for this workflow. Treat it as a networked media-generation tool: review prompts and parameters before generation, upload only assets you are authorized to send to AI-HIVE, watch for possible billing, and be aware that init stores a local API key file.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises runnable scripts that use environment variables, local file access, shell tools, and network calls, but it declares no permissions. That creates a transparency and policy-enforcement gap: an agent or reviewer cannot reliably understand what the skill may access before invocation, increasing the chance of unintended file, credential, or network exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is a narrow continuity-QA skill, but the documented behavior includes generic chat API access, model/account queries, media upload/download, and broad ffmpeg editing operations with no actual continuity-analysis logic. This mismatch is dangerous because it can cause over-trust and over-broad invocation: users or orchestration systems may approve a specialized QA tool while actually granting a general media/network automation surface with billing, data exfiltration, and unintended content-manipulation risk.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file is packaged and described as a narrowly scoped serialized-character-consistency image skill, but it actually embeds a much broader AI-Hive client with chat, video, upload, account, and model-enumeration capabilities. This scope mismatch is dangerous because downstream systems or reviewers may grant trust, permissions, or user consent based on the advertised purpose while the code retains materially broader functionality.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Exposing user-info and wallet retrieval is not necessary for a character-consistency image skill and increases the amount of sensitive account data accessible through the skill. Even if the endpoint is legitimate, unnecessary access broadens the blast radius for misuse, accidental disclosure, or permission overreach.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The unrestricted text chat function enables arbitrary model interaction unrelated to the skill's declared image-consistency purpose. This creates hidden general-purpose capability that could be abused for unreviewed prompt flows, policy bypass attempts, or unexpected data transmission to the external service.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Implementing full video generation support inside an image-focused skill introduces materially broader capability than users and integrators would expect from the exposed interface. Hidden or dormant extra functionality is risky because it can later be invoked through code reuse, import paths, or minor wrapper changes without undergoing a purpose-specific review.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The module docstring explicitly markets the file as a general-purpose AI invocation tool while later configuration presents it as a specialized serialized-character-consistency skill. This inconsistency undermines transparency and can mislead reviewers, users, or policy engines about the true scope of the code being trusted and executed.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file is presented as a specialized serialized-character-consistency skill, but its implementation is a broad AI Hive client supporting chat, image generation, video generation, model enumeration, uploads, downloads, and task polling. This capability mismatch is dangerous because it bypasses the principle of least privilege and can be used to perform unrelated generative actions under the cover of a narrowly branded skill, making policy enforcement and user consent weaker.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code exposes text chat and image generation functions that are not necessary for a role-consistency checking skill. In this context, those extra capabilities enlarge the attack surface and enable misuse of the skill for arbitrary content generation rather than the advertised continuity-guard task.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module and CLI describe a generic AI tool, which contradicts the declared identity of a specialized continuity-guard skill. This mismatch can mislead reviewers and users about what the code actually does, increasing the chance that powerful generation features are approved or executed without appropriate scrutiny.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation conditions use broad business-context phrasing that can match many unrelated marketing, e-commerce, ad, or content-production requests. Overbroad triggers are risky because they can cause the skill to activate outside its intended scope, exposing networked generation, file handling, and shell-backed media tooling in contexts where users did not intend to invoke them.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger for 'turning a reference case into original content' is ambiguous and overlaps with ordinary creative-assistance requests. In this skill, that ambiguity is more dangerous because the skill also exposes generation and external API workflows; accidental activation could lead to unnecessary uploads, billable tasks, or use of a tool whose real behavior exceeds simple ideation support.

Static analysis

No suspicious patterns detected.