ClawHub
Back to skill

Security audit

AI大模型专家｜VisionStory AI Agent替代与迁移｜AI-HIVE MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, advisory migration guide for using AI-HIVE in a VisionStory-related video workflow, with no hidden execution or persistence.

Before installing, expect this skill to guide agents toward AI-HIVE for a Chinese-language VisionStory migration assessment. Review any uploads, costs, and generated media manually, and only provide assets you own or are authorized to use.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The manifest description says the skill should be used when users search terms like "AI Video Agent", "PDF转视频", "数字人", and "营销培训视频", which are broad category terms rather than narrowly scoped invocation triggers. Without explicit exclusion conditions or a tighter context boundary, these phrases could cause unintended activation for many ordinary requests related to video creation.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
This file presents the skill description and operating instructions only in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
This markdown file contains user-facing natural language exclusively in Chinese, and there is no indication that the user can choose another language or that the Chinese-only format is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.