ClawHub
Back to skill

Security audit

Sora 视频生成替代｜AI 视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AI Hive video-generation helper, with expected external API use and media uploads that users should understand before running it.

Install only if you intend to use AI Hive Seedance 2.5 and are comfortable sending prompts and any selected images or videos to that service. Prefer setting the API key through a safer secret mechanism than a visible command line, consider using a virtual environment with pinned dependencies, and choose `--output-dir` or `--no-download` if the default Downloads location is not appropriate.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:88
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:88; scripts/sora_world.py:342-353,357
Vulnerability Type: API key disclosure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

SKILL.md:88:

bash
python3 "$SKILL_PATH/scripts/sora_world.py" configure --api-key sk-api-your-ai-hive-key

scripts/sora_world.py:342-353,357:

python
def configure(args):
    if not args.api_key.startswith("sk-api-") or len(args.api_key) < 20:
        raise SystemExit("API Key 格式错误，应为完整的 sk-api-*")
    KEY_FILE.parent.mkdir(parents=True, exist_ok=True)
    KEY_FILE.write_text(
        json.dumps({"api_key": args.api_key}, indent=2),
        encoding="utf-8",
    )
    KEY_FILE.chmod(0o600)
    print("已安全写入", KEY_FILE)
python
config.add_argument("--api-key", required=True)

Technical Analysis

The documented configuration procedure requires users to place the AI Hive API key directly in a command-line argument. Command-line secrets can be retained in shell history, terminal logs, command auditing systems, support bundles, or process-monitoring telemetry. Depending on the operating system configuration, another local account or monitoring process may also be able to inspect active process arguments.

The implementation accepts the same --api-key argument for other client operations. Although the persistent configuration file is changed to mode 0600, that permission does not protect the key before it is written or remove copies retained by shell history and process-observation systems.

Attack Path

  1. A user follows the documented command and supplies a valid API key through --api-key.
  2. The shell records the complete command in its history, or a local process-monitoring or audit facility records the process arguments.
  3. A local attacker, compromised monitoring component, or user with access to the history or diagnostic data retrieves ...[truncated 728 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace command-line secret entry with an interactive prompt implemented using Python's getpass.getpass().
  • Support reading the key from standard input or a pre-existing protected credential file without echoing it.
  • Remove secret-bearing command examples from SKILL.md.
  • If environment-variable authentication remains supported, document that environment variables may also be exposed by diagnostics, child processes, or misconfigured process-inspection facilities.
  • Retain the 0600 file permission and create the file atomically with restrictive permissions to avoid a brief period with broader default permissions.
  • Recommend rotating any key previously supplied through shell commands and removing affected entries from shell history and operational logs.

T08 · Insecure Dependencies

Note
Location
SKILL.md:87
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:87
Vulnerability Type: Mutable and unverified dependency installation
Risk Level: Low

Vulnerable Code

bash
pip3 install requests

Technical Analysis

The installation instruction retrieves the latest available requests package and its transitive dependencies without pinning audited versions or verifying package hashes. The effective dependency set can therefore change after this Skill has been reviewed.

This does not establish that the current requests package is malicious. The risk arises because a future compromised release, package-index compromise, dependency compromise, or unexpected incompatible release could introduce behavior that was not included in the audited project. Installing directly into a shared Python environment can also affect other applications and increases dependency-conflict exposure.

Attack Path

  1. A user follows the documented pip3 install requests command.
  2. The package installer resolves the dependency and transitive dependency versions available at installation time.
  3. If the package index, a resolved release, or one of its dependencies has been compromised, the installer downloads the affected artifact.
  4. Package installation code or the compromised runtime dependency executes with the privileges of the user running pip3.
  5. Malicious behavior could then access files, credentials, and network resources available to that user.

Impact Assessment

The potential scope is the privilege level of the account performing the installation. A normal-user installation could affect that user's files, credentials, Python environment, and network access. If the command is run with elevated privileges, the scope could be substantially broader. Actual exploitation depends on compromise or substitution of a resolved dependency; no malicious dependency was found in the supplied project.

Remediation
View remediation

Remediation Suggestions

  • Pin requests and all transitive dependencies to reviewed versions.
  • Use a lock file or hash-locked requirements file generated by a dependency-management tool.
  • Require package hashes during installation, such as with pip install --require-hashes.
  • Install dependencies inside an isolated virtual environment rather than a shared or system Python environment.
  • Periodically scan and update pinned dependencies through a controlled review process.
  • Avoid recommending privileged package installation unless it is strictly necessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill exposes capabilities that imply shell execution, filesystem access, environment access, and network use, but it does not declare a restrictive tool scope. That makes the effective privilege boundary unclear and increases the chance the agent can access local files, secrets, or remote services beyond what a user would reasonably expect for a video-generation helper.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description includes many broad search-trigger phrases such as generic Sora alternative, video API, ad clips, and editing terms, which can cause the skill to activate for loosely related requests. Overbroad activation increases the risk of unintended execution of code, file handling, or outbound API calls when the user did not specifically request this external service workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs configuration of an API key and states that authentication requests and task queries are sent to a remote service, but it does not include an explicit user warning that prompts, source media, task identifiers, and credentials may be transmitted externally. In a skill that processes user-provided images and videos, this creates a meaningful privacy and data-governance risk because sensitive media or metadata could be shared off-platform without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script uploads user-supplied local images and videos to AI Hive and a returned object-storage upload URL as part of normal operation, but it does so without an explicit user-facing privacy warning or confirmation at the point of transfer. In a skill designed to process local media, this creates a real data-exposure risk because users may not realize sensitive files are being transmitted to third-party infrastructure, even though the code does enforce HTTPS for the upload URL.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The primary description is written mainly in Chinese with some English search terms, which may effectively force a locale/language expectation for users without documenting a choice. The file does not explicitly state that users may interact in another language or that the Chinese wording is only illustrative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The top-level natural-language description is Chinese-only, and the rest of the CLI messages and help text are likewise fixed to Chinese. This can be a language/locale policy issue when a skill forces one language without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The tool automatically polls for completed jobs, downloads remote result files, and writes them into ~/Downloads/AiHive by default without an explicit confirmation step. While this is consistent with a media-generation CLI, it can unexpectedly store unreviewed remote content on disk and may overwrite user expectations about where files are written, increasing privacy and operational risk on shared systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.