ClawHub
Back to skill

Security audit

Token Hub 成本路由中心｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI-HIVE routing and media-generation helper with expected API, upload, download, and local processing behavior, though users should be careful with API keys and billable generation tasks.

Install only if you intend to use AI-HIVE for model routing and media generation. Do not paste real API keys into chats or logs, review all prompts, reference files, routing mode, model, and estimated cost before running generation commands, and only upload media you are authorized to use.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises executable workflows that use environment variables, local file access, shell utilities, and network calls, but it does not declare permissions or clearly constrain those capabilities. This creates a trust gap: a caller may invoke the skill expecting planning-only behavior while the skill can drive file, network, and shell-adjacent operations that could expose secrets, alter local data, or trigger billable external actions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented purpose is cost-routing and strategy generation, but the skill also exposes materially broader operational behavior: local ffmpeg processing, general API access, credential setup/storage, media upload, task polling, and artifact download. That mismatch is dangerous because users and orchestrators may grant or invoke the skill under a narrower trust model than its real capabilities, enabling unexpected local changes, data exfiltration, or unintended paid API usage.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The trigger conditions are broad enough to match many ordinary business or content requests, increasing the chance this higher-capability skill is selected in contexts that do not actually require it. Over-selection raises risk because a skill with network, file, and external-generation behaviors may be invoked unnecessarily, widening exposure to secret handling, copyrighted material ingestion, and unintended external submissions.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The default_prompt hardcodes 'production-ready Chinese workflow' regardless of user preference, which can override user intent and create unsafe prompt steering at invocation time. While this is not a direct code-execution issue, it can degrade reliability, cause unintended language behavior, and make downstream outputs less aligned with user requirements or policy expectations.

Static analysis

No suspicious patterns detected.