Security audit

TikTok Shop 爆款带货视频拆解｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AI-HIVE video workflow helper that handles API keys, media uploads, and local files, but I found no hidden exfiltration, destructive behavior, or deceptive execution path.

Install only if you are comfortable using AI-HIVE with local media files and an API key. Before running commands, confirm which files will be uploaded, whether generation may incur cost, where outputs will be written, and whether Chinese output is appropriate for your workflow.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill includes executable examples and operational guidance that use environment variables, local files, shell commands, network access, and ffmpeg, yet no explicit permissions are declared. This weakens least-privilege boundaries and can lead to users or host agents invoking broader capabilities than expected, including handling API keys and local media files without clear consent or review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The documented behavior extends beyond the stated TikTok Shop decomposition purpose into generic chat/model-account functionality, local ffmpeg editing, browser-based API-key setup, and local credential storage. Description-behavior mismatches are dangerous because they hide effective capabilities from reviewers and users, increasing the chance of unauthorized network activity, local file manipulation, or sensitive credential handling under a narrower-looking skill label.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file presents itself as a TikTok Shop viral-video decomposition skill, but the implementation is a broad AI Hive client supporting chat, model enumeration, media upload, image/video generation, task polling, and account inspection. This capability mismatch expands what an invoking agent can do beyond the advertised purpose, increasing the risk of over-privileged or unexpected actions under a narrowly branded skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Retrieving user account and wallet information is unrelated to TikTok Shop video decomposition and exposes sensitive account metadata to the skill surface. In an agent setting, unnecessary access to billing or identity information violates least privilege and can enable profiling, balance discovery, or downstream abuse.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Model catalog browsing lets the skill discover and potentially pivot into capabilities beyond the declared decomposition use case. In a constrained skill, this broadens the operational surface and may permit use of unreviewed models or workflows inconsistent with policy and user expectations.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The documentation and CLI branding describe a generic AI tool while the skill metadata claims a specialized TikTok Shop decomposition function. This inconsistency is dangerous because reviewers, users, or orchestrators may grant trust and permissions based on the narrow description while the code actually exposes wider behavior.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger phrases are broad and match common topics like TikTok videos, UGC ads, and cross-border e-commerce, which can cause the skill to activate in conversations that only mention these subjects generally. Unintended invocation increases the risk of exposing users to networked generation flows, file operations, or commercial actions they did not request, especially given the skill's additional operational capabilities.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill is configured for implicit invocation and its description/default prompt are broad enough to trigger on a wide range of TikTok, ecommerce, advertising, and marketing requests. This can cause the agent to invoke the skill without clear user intent, leading to unexpected code-generation or workflow actions in a sensitive domain involving content production and external API operations.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The default prompt hardcodes Chinese output ('production-ready Chinese workflow') regardless of the user's requested language. In a cross-border ecommerce/compliance context, forcing a language can degrade user comprehension, increase the chance of misunderstanding legal or platform-policy constraints, and produce outputs unusable for the intended locale.

Static analysis

No suspicious patterns detected.