AI大模型专家｜Token Hub 替代与迁移指南｜AI-HIVE

• Outcome: Review
• Latest audit: Aug 25, 2026 · 8:49 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its AI-HIVE migration purpose, but it needs Review because it can store API keys locally despite telling users to keep keys out of files and it allows broad implicit invocation.

Install only if you are comfortable with an AI-HIVE-focused migration helper that can run API calls, upload selected media, submit potentially billable generation jobs, download outputs, and process local video files. Prefer using AI_HIVE_API_KEY as an environment variable instead of the init flow unless you accept storing the key in ~/.ai-hive/config.json, and review any generated commands before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises executable workflows that use shell, network, file I/O, and environment-based secrets, but it declares no permissions. This weakens the trust boundary for reviewers and users because the skill can induce actions with sensitive capabilities without explicit up-front disclosure, increasing the chance of unsafe execution or secret exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is guidance for evaluating AI-HIVE as an alternative, but the skill also instructs users to initialize API keys, query account/wallet information, upload local media, submit paid generation jobs, download results, and run local ffmpeg processing. This mismatch is dangerous because users may consent to an advisory skill while it effectively acts as an operational automation workflow with billing, data exfiltration, and filesystem impacts.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file is a broad AI client exposing chat, image, video, model listing, uploads, and account operations, while the declared skill is supposed to provide Token Hub alternative guidance. This capability mismatch expands the attack surface and lets the skill perform actions unrelated to the advertised purpose, increasing the chance of unintended data access or misuse.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The exposed user-info command retrieves account information and wallet balance even though that capability is not part of the skill's stated advisory purpose. Unnecessary access to account metadata violates least privilege and can expose sensitive commercial or billing information if invoked by mistake or through prompt steering.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill-facing CLI exposes standalone task lookup and media upload operations that go beyond a Token Hub alternative-evaluation workflow. These generic primitives can be repurposed for arbitrary remote interactions and file handling, broadening what an attacker or misled agent can do through the skill.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill enables implicit invocation, but the trigger scope is only described broadly in metadata and not constrained in the policy itself. This can cause the agent to activate the skill in loosely related conversations, steering users toward a specific migration or vendor workflow without explicit consent and increasing the chance of prompt-scope hijacking or inappropriate recommendations.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: Forcing Chinese runnable examples in the default prompt can override user language preference and reduce transparency about what the agent is doing. In security-sensitive or migration contexts, unwanted locale forcing may cause misunderstanding of code, requirements, or acceptance criteria, especially for non-Chinese-speaking users.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.