Security audit

短剧批量生产流水线｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly an AI-HIVE media-generation helper, but it handles API keys and downloaded files in ways that could expose credentials or write outside the intended output folder if endpoints or responses are manipulated.

Review this before installing if you will use a real AI-HIVE API key or proprietary media. Only run it with the official AI-HIVE endpoint, avoid untrusted AI_HIVE_BASE_URL or config changes, use a low-privilege API key, choose a non-sensitive output folder, and verify generated commands before any paid batch generation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/imagegen.py:92
Finding: Bearer API Key Disclosure Through Unrestricted Base URL Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:276
Finding: Unvalidated Server-Supplied Upload and Download URLs Enable Unintended Network Access and Data Transfer
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imagegen.py:394
Finding: Remote Task Metadata Can Escape the Output Directory Through Path Traversal
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Claiming support for scripts, episode planning, capacity/budget handling, delivery manifests, and OpenAPI-backed generation workflows without implementing them creates an integrity and governance risk. In a production media pipeline, that can result in operators trusting nonexistent authorization, provenance, pricing, or retry controls and exposing licensed assets or branded content to the wrong process.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Claiming support for scripts, episode planning, capacity/budget handling, delivery manifests, and OpenAPI-backed generation workflows without implementing them creates an integrity and governance risk. In a production media pipeline, that can result in operators trusting nonexistent authorization, provenance, pricing, or retry controls and exposing licensed assets or branded content to the wrong process.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Claiming support for scripts, episode planning, capacity/budget handling, delivery manifests, and OpenAPI-backed generation workflows without implementing them creates an integrity and governance risk. In a production media pipeline, that can result in operators trusting nonexistent authorization, provenance, pricing, or retry controls and exposing licensed assets or branded content to the wrong process.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Claiming support for scripts, episode planning, capacity/budget handling, delivery manifests, and OpenAPI-backed generation workflows without implementing them creates an integrity and governance risk. In a production media pipeline, that can result in operators trusting nonexistent authorization, provenance, pricing, or retry controls and exposing licensed assets or branded content to the wrong process.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
python3 scripts/imagegen.py init --skill-name short-drama-batch-production-ai-hive

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
python3 scripts/imagegen.py init --skill-name short-drama-batch-production-ai-hive

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises runnable scripts that use environment variables, filesystem access, network calls, and shell-adjacent local tooling, but it does not declare any explicit tool scope or allowed-tools boundary. That omission weakens least-privilege controls and can cause the host agent to expose broader capabilities than intended, increasing risk of unintended file access, secret handling, or outbound requests if the skill is invoked automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The description and invocation guidance are entirely framed in Chinese trigger phrases and Chinese-language usage, but the file does not state that the skill is intentionally limited to Chinese-speaking users or provide an opt-in language choice. This can violate language/locale policy when a skill implicitly forces a specific language without user choice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Broad trigger phrases like '多集视频' and '内容工厂' can cause the skill to activate in overly general contexts, routing unrelated user requests into a capability that includes external generation workflows and scriptable examples. Misrouting is a security concern because it increases the chance of unnecessary tool exposure, accidental data sharing, or use of the wrong compliance guardrails.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The default prompt explicitly instructs the skill to produce a 'production-ready Chinese workflow,' which imposes a specific language choice regardless of the user's preference. This is a natural-language policy concern because it forces a locale/language without offering the user a choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill enables implicit invocation without any scoped trigger constraints, exclusions, or authorization gating. In this context, the skill can generate production workflows and runnable AI-HIVE commands for bulk media generation, so accidental or overly broad activation could cause unintended execution paths, budget-consuming API use, or unsafe assistance in sensitive marketing/content-production scenarios.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/edit_video.py (reported line 20)May include surrounding context.
python
def run(args: list[str]) -> None: print(" ".join(args)) subprocess.run(args, check=True) def main() -> None:

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file is branded and wrapped as a specialized short-drama batch-production image skill, but it embeds a broader generic AI client supporting chat, video, model enumeration, account lookup, and media upload. This capability mismatch violates least privilege and increases the chance that downstream tooling, reviewers, or users invoke functionality that was not disclosed or expected from the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and user-facing instructions are written entirely in Chinese, and the CLI later emits only Chinese prompts/messages. For a general-purpose skill, this imposes a specific language/locale on users without opt-in or an alternative language path, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Exposing user-info and wallet-balance queries is unnecessary for the stated content-production purpose and grants access to account metadata beyond what the skill needs to perform image generation. In a skill ecosystem, this kind of overbroad read capability can leak sensitive operational or billing information to callers or logs and signals excessive privilege.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The unrestricted text-chat endpoint materially expands the skill from a narrow batch-production media tool into a general-purpose LLM interface. That makes policy bypass, unreviewed prompt handling, and unintended data flow more likely because consumers may use the skill for arbitrary conversations outside the declared and reviewed use case.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code exposes general video-generation operations even though the concrete skill wrapper is configured as an image-generation skill. This hidden capability broadens the operational surface, can incur unexpected cost or content risk, and undermines trust in the declared behavior of the skill package.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file is presented as a specialized short-drama batch-production skill, but the implementation exposes a broad generic AI client with chat, image generation, model enumeration, uploads, and account inspection. This violates least-privilege and creates capability mismatch: a caller or wrapper expecting narrowly scoped video-production behavior may inadvertently grant access to unrelated functions and data flows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring explicitly markets the file as a generic AI capability tool, contradicting the declared identity of a specialized short-drama production skill. This kind of misrepresentation is dangerous in agent ecosystems because routing, trust, and permission decisions may rely on the skill description, while the actual code exposes materially broader functionality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring is entirely in Chinese and presents the tool as a general-purpose skill, while later CLI help and prompts are also predominantly Chinese. For a broadly scoped skill, this imposes a specific language/locale by default rather than offering a user choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generic text chat function is outside the skill's stated narrow purpose and can be repurposed for arbitrary model interactions. In an agent environment, this broadens the skill from a bounded video pipeline into a general LLM access path, undermining policy scoping, auditability, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The image generation endpoint similarly exceeds the declared short-drama batch video scope and provides an unnecessary extra content-generation primitive. This increases the attack surface and allows consumers to use the skill for unadvertised workflows, including generating assets or content outside intended governance controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file embeds Chinese-only natural-language identifiers in the module docstring, CLI description, and generated skill metadata. This imposes a specific language/locale presentation without offering user opt-in, fallback, or documenting that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The module-level documentation advertises a generic multi-capability AI tool while the packaged skill presents itself as a specialized short-drama image skill. This inconsistency is a security-relevant transparency problem because it can mislead reviewers and operators about what the code is capable of doing, reducing effective oversight.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The user-info capability lets the skill retrieve account metadata and wallet/balance information that is not necessary for short-drama batch video generation. Even if not directly destructive, it expands data exposure and can leak sensitive operational or billing information to users or higher-level agents that should not access it.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.