Security audit

爆款视频黄金3秒钩子分析｜AI-HIVE

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AI-HIVE video-hook workflow that can upload user-chosen media and run generation tasks, with no hidden or destructive behavior found.

Install only if you are comfortable giving AI-HIVE an API key and uploading selected media for generation. Review prompts, routing, model choice, and expected cost before running generate commands, and use only reference material you are authorized to use.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill exposes operational capabilities including environment variable use, filesystem access, shell execution, and network calls without any declared permissions boundary. Even though the examples are framed as legitimate media workflows, this creates an under-specified trust surface where a caller may invoke code paths that read local files, use API keys from the environment, or make outbound requests without the user clearly understanding those capabilities.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented primarily as a narrow hook-analysis assistant, but the embedded behavior expands into generic chat, media generation, upload/download task management, local ffmpeg processing, and interactive initialization. That mismatch is dangerous because users or orchestrators may route sensitive inputs to the skill expecting low-risk analysis, while it actually has broad execution and exfiltration potential through networked generation, local file handling, and shell-based media processing.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The blueprint explicitly directs outputs such as '差异化复刻方案', '逐镜脚本', and '生成提示词和验收清单', which materially expands the skill from first-screen hook analysis into remake planning and production enablement. In this context, that increases the risk of facilitating unauthorized imitation, derivative content generation, or policy-evading creative replication beyond the stated constrained analyzer purpose.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file is framed and implemented as a general-purpose AI Hive client, exposing chat, model listing, uploads, image generation, and task handling far beyond the advertised narrow purpose of viral hook analysis. In a skill ecosystem, this scope expansion is dangerous because it gives callers an unexpectedly broad API surface that can be repurposed for unrelated actions, increasing the chance of policy bypass, unintended data handling, and abuse under the cover of a benign-seeming skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The user-info capability exposes account metadata and wallet/balance information unrelated to analyzing short-video hooks. Even if intended for convenience, embedding account inspection inside a narrowly branded skill violates least privilege and can leak sensitive operational or billing information to users or agents who only expected media-analysis functionality.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The generic text chat endpoint allows arbitrary prompts and optional system messages, which is much broader than a focused hook-analysis assistant. In context, this broadens the skill into a general LLM proxy that can be abused for unrelated tasks, prompt injection experiments, or data transfer outside the advertised purpose, making the mismatch materially riskier.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Image generation is not necessary for a skill described as analyzing opening hooks and producing hook matrices, and it adds a separate content-generation channel. That additional channel can be used to generate unrelated or noncompliant assets under the skill's identity, increasing abuse potential and making the actual behavior diverge from what reviewers and users expect.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The top-level documentation explicitly markets the code as a 'general AI capability tool,' which directly contradicts the manifest's narrow positioning around first-screen hook analysis. This kind of capability deception is dangerous in a skill marketplace because reviewers, orchestrators, and users may grant trust based on the manifest while the implementation exposes much broader actions.

Static analysis

No suspicious patterns detected.