Security audit

微信小店电商视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real AI Hive video-generation tool, but it needs Review because its bearer API key can be sent to an unvalidated custom API endpoint.

Install only if you trust AI Hive and keep the API endpoint on the default trusted HTTPS host. Avoid running it with untrusted environment variables or config files, use a virtual environment for dependencies, and treat uploaded media, prompts, generated results, API usage, and account credits as sensitive.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:91
Finding: Bearer API credentials may be transmitted to an arbitrary configured endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:68
Finding: Runtime installation uses an unpinned third-party dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese across the substantive changelog entries. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill includes executable shell commands and a Python script workflow that can install packages, access environment variables, read/write files, and use the network, but it does not declare any tool scope or permission boundaries. This increases the risk that an agent may invoke the skill with broader capabilities than intended, enabling unintended package installation, data access, or outbound requests without explicit user awareness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description says "Use this skill for" followed by a wide range of common ecommerce and social-content scenarios, but it does not define specific activation phrases, exclusions, or boundaries for when the skill should not be invoked. This breadth makes the trigger scope ambiguous for a markdown/manifest file and could cause unintended activation in ordinary discussions about WeChat ecommerce content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file is framed as a generic AI Hive client with chat, image, video, model enumeration, upload, and account-related operations, while the declared skill is narrowly scoped to WeChat e-commerce video generation/editing. This scope mismatch increases the attack surface and can let downstream agents invoke unintended capabilities that were not disclosed or expected for this skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring explicitly advertises a generic AI capability tool, which conflicts with the claimed identity of a specific WeChat e-commerce video skill. This kind of misrepresentation is dangerous in agent ecosystems because trust and allowlisting decisions are often based on metadata and descriptions; misleading labeling can cause overbroad capabilities to be approved inadvertently.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: A text-chat capability is unrelated to the declared video-editing purpose and gives callers a general-purpose LLM interface under the same credentials and trust boundary. In an agent setting, hidden extra capabilities are dangerous because prompts or orchestrators may invoke them unexpectedly, enabling policy bypass, data handling beyond intended scope, or unreviewed spend.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Standalone image generation is broader than the declared video-focused purpose and introduces an additional generation path not disclosed by the skill identity. This expands attack surface, complicates policy review, and may let agents use the skill for unrelated content creation or cost-incurring actions outside expected scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The file strongly frames the skill around Chinese-language WeChat commerce use cases and includes Chinese instructional content, but it does not explicitly offer the user a language or locale choice. This can amount to a locale/language policy concern when the skill appears to assume a specific language context without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example API key value includes Chinese-only instructional text ('请替换为你的APIKey'), which imposes a specific language in user-facing natural language content. The file does not offer an alternative language or indicate that this locale choice is optional or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module docstring presents the skill's purpose and usage only in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy for natural-language violations applies to all file types, including code string literals and docstrings.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: User-facing messages, prompts, and argparse help throughout the script are written in Chinese only, requiring users to interact in that locale by default. There is no documented language choice or justification for restricting the interface to Chinese.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The presence of user-info and wallet-balance retrieval is outside the stated purpose of video generation/editing and exposes unnecessary account metadata to any caller able to run the skill. While not directly destructive, it broadens accessible sensitive information and violates least privilege for a narrowly scoped media skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.