短剧人物圣经与角色一致性｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 12:11 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed AI-HIVE workflow tool for short-drama character planning and media generation, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable using AI-HIVE with your own API key, uploading selected local media to the service, and potentially incurring generation charges after you approve parameters. Prefer environment variables if you do not want the init command to store a local key, and review any generated commands, media paths, routing mode, and cost-related details before running them.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and demonstrates code paths that can read environment variables, access local files, invoke shell/ffmpeg, write files, and make network requests, yet no explicit permissions are declared. That creates a trust and enforcement gap: a host or reviewer may assume the skill is low-privilege while it can handle sensitive inputs like API keys, local media, and outbound uploads. In this context, the combination is more dangerous because the workflow explicitly asks users to export API keys and pass absolute file paths for media operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented purpose is a narrowly scoped character-bible workflow, but the described behavior extends to generic chat, model/account queries, standalone uploads, and broad video-editing utilities unrelated to that purpose. This scope creep weakens user consent and review assumptions, because a skill approved for character-consistency tasks can be used as a general-purpose networked/media-processing tool with access to wallet/account data and local files. The context makes this riskier since the skill already handles commercial assets and external API interactions, so extra capabilities increase the chance of unauthorized uploads, unexpected charges, or data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file markets itself as a narrow short-drama character-bible image skill, but actually embeds a much broader general-purpose AI client with chat, video, model enumeration, uploads, and account access. This mismatch expands the effective capability surface beyond what users and reviewers would reasonably expect, increasing the chance of unintended or policy-violating use under the cover of a specialized skill.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The included text-chat pathway is unrelated to the declared purpose of generating short-drama character-bible imagery. In a skill ecosystem, hidden extra capabilities can be abused to bypass product-level restrictions, route arbitrary prompts to external services, or surprise users who believed they were invoking only an image tool.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The video-generation flow materially exceeds the scope of the advertised specialized image skill. Extra media-generation capabilities broaden abuse potential, make policy enforcement harder, and undermine least-privilege expectations for both users and integrators.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: Conflicting identities in the same file—generic AI tool at the top, specialized skill at the bottom—create deceptive packaging even if not intentionally malicious. Security review, user consent, and runtime policy decisions may rely on the declared identity, so contradictory framing makes overbroad capabilities more dangerous in this skill context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file is marketed as a narrow short-drama character-bible consistency skill, but the implementation is a broad AI-Hive API client that can chat, enumerate models, inspect account info, upload media, and generate arbitrary image/video content. This scope mismatch is dangerous because users, reviewers, or policy gates may trust it with permissions and inputs appropriate for a limited-purpose creative tool while it actually provides a much wider capability surface.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill exposes a generic text-chat endpoint even though the declared purpose is character-bible and role-consistency support plus media generation workflows. Hidden general chat capability broadens the trust boundary and can enable unreviewed prompt handling or policy bypass through an interface not expected by consumers of this skill.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: User-info and model-listing functionality provide account inspection and capability discovery unrelated to the advertised narrow workflow. In a skill context, this can leak wallet/balance/account details and reveal broader backend capabilities to an operator who expected only a constrained content-production tool.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The embedded configuration presents the skill as a character-bible consistency tool, while the runtime CLI explicitly identifies itself as a bare video-generation skill. This inconsistency increases the risk of misclassification, inadequate review, and overbroad deployment because the actual behavior does not match the declared capability profile.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest enables implicit invocation with no visible narrowing conditions, exclusions, or consent boundaries. In a skill that can generate runnable workflows and AI-HIVE commands, this increases the chance the agent auto-invokes the skill in contexts the user did not clearly intend, causing unintended external API preparation, operational side effects, or policy-sensitive content generation.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The default prompt hard-codes Chinese output without indicating that this is optional or user-selected. While not a direct security flaw by itself, it can reduce user awareness and control, create mismatches with user expectations, and increase the risk of the agent steering interactions in ways the user did not request.

Static analysis

No suspicious patterns detected.