ClawHub
Back to skill

Security audit

Shopee 电商视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

The skill is purpose-aligned for Shopee video generation, with the main user consideration being that it stores an AI Hive API key and uploads selected media to AI Hive.

Install only if you are comfortable providing an AI Hive API key and uploading selected product images, videos, or audio to the AI Hive service. Review the stored key at ~/.ai-hive/config.json if you use init, and use --no-download or --output-dir when you want tighter control over generated outputs.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill exposes shell, network, file read/write, and environment access via documented runtime commands, but no explicit permissions are declared. This creates a trust and containment gap: users may invoke a skill believing it is limited to video generation while it can access local files, networked services, and environment-backed credentials. In a skill ecosystem, undeclared capabilities increase the risk of accidental data exposure or broader-than-expected execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is Shopee-focused video generation/editing, but the associated behavior reportedly includes generic chat/image APIs, account and wallet retrieval, model inspection, generic upload tooling, and general AI Hive initialization. That mismatch is dangerous because it expands the attack surface beyond the user’s reasonable expectations and can expose sensitive account metadata or enable unrelated operations under the guise of a narrowly scoped media skill. In security review, undeclared or weakly justified extra capabilities are a strong indicator of overprivilege.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The file bundles a broad AI Hive client that exposes text chat, image generation, model enumeration, media upload, and generic task operations, while the advertised skill is specifically for Shopee video generation/editing. In an agent-skill context, this overbroad capability materially expands what the skill can do beyond user expectations and least privilege, creating an unnecessary attack surface if an agent or downstream caller invokes unrelated endpoints.

Context-Inappropriate Capability

Low
Confidence
89% confidence
Finding
The skill exposes a user-info endpoint that can inspect account details and wallet/balance information, which is unrelated to Shopee video creation/editing. While not inherently malicious, it grants agents an unnecessary account-inspection capability that may disclose sensitive billing or profile data if called inappropriately.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.