视频换服装换场景换光线｜AI-HIVE

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 12:28 PM UTC
• Version: 1.0.0

Overview

This is a disclosed AI-HIVE video editing helper that uses user-provided media and API credentials, with no evidence of hidden execution or exfiltration.

Install only if you are comfortable sending selected media and prompts to AI-HIVE and using a potentially billable API key. Review generated commands before running them, use only media you are authorized to edit, and avoid storing the API key on shared machines unless the file permissions remain locked down.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises executable workflows that use environment variables, local file access, shell commands, and network calls, but it does not declare permissions or clearly constrain those capabilities. This creates a hidden-trust problem: a caller may invoke a seemingly narrow media-editing skill that can actually read/write files, access API keys, invoke ffmpeg or other shell utilities, and transmit data off-host.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented purpose is a specialized video outfit/background/lighting editing workflow, but the skill behavior appears broader, including generic text chat, generic image generation, user/model enumeration, standalone uploads, and general ffmpeg manipulation. This mismatch weakens user consent and review boundaries, because operators may approve the skill for a narrow use case while it can perform adjacent actions that expose data, increase attack surface, or incur unexpected external/API activity.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The file implements a broad-purpose AI Hive client with chat, image, video, model browsing, upload, and polling features, while the declared skill is specifically for video outfit/scene/light editing. This capability mismatch expands what the skill can do beyond user expectations and increases the chance of unintended or unauthorized use paths.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The skill includes a user-info endpoint that retrieves account information and wallet balance, which is not necessary for performing video-editing tasks. Unneeded access to billing/account metadata violates least privilege and can disclose sensitive operational information if invoked by an agent or user unexpectedly.

Context-Inappropriate Capability

Low

• Confidence: 68% confidence
• Finding: Listing the full model catalog is broader than needed for a narrowly scoped video-editing skill and reveals additional platform capabilities not intended by the manifest. This can enable misuse, confusion, or policy bypass by helping users discover unrelated text/image models.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest enables implicit invocation without any visible narrowing conditions, exclusions, or user-confirmation guardrails. Because this skill can generate runnable AI-HIVE commands for media editing workflows, broad auto-selection increases the chance it is invoked in contexts involving deceptive editing, unauthorized likeness manipulation, or language/output mismatches without explicit user intent.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The default prompt hard-codes Chinese output without indicating user choice, which can override user preferences and reduce transparency about what the agent will do. In a security-sensitive workflow, forced language can impair user review of generated commands, constraints, or policy warnings, increasing the risk of misunderstanding and accidental misuse.

Static analysis

No suspicious patterns detected.