T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:91- Finding
Configurable API Origin Can Expose the Bearer API Key
- Content
View full analysis
- Remediation
View remediation
Security audit
小红书 电商视频生成与编辑
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it handles API keys and user media through a network service with weak destination and file-write controls, so it needs review before installation.
Install only if you trust the AI Hive service and publisher with your API key and uploaded commercial media. Avoid custom `--base-url` or `AI_HIVE_BASE_URL` values unless you fully trust the endpoint, use a dedicated low-privilege API key, and choose an output directory where accidental overwrites would not harm important files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:278- Finding
Unvalidated Upload Instructions Permit Arbitrary Outbound Requests and Media Disclosure
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:316- Finding
Unvalidated Task Results Permit Internal URL Fetching and Output Path Traversal
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:68- Finding
Third-Party Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The changelog states the skill will automatically upload media, poll tasks, and download results, but it does not mention what data is transferred, to which services, or what user consent and retention controls apply. In a skill handling ecommerce and brand video assets, this can lead to unanticipated transfer of potentially sensitive commercial media or metadata to third-party systems.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill includes executable shell commands and a Python script workflow that can use environment access, file reads/writes, network, and shell, yet it declares no explicit tool scope or permission boundaries. This creates an avoidable over-privilege condition where an agent may invoke powerful capabilities without transparent restriction, increasing the blast radius if the script or inputs are abused.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description says "Use this skill for" followed by a long list of generic Xiaohongshu ecommerce video tasks such as unboxing, reviews, product demos, and UGC assets. For a markdown skill file, this is a broad activation description without explicit scope limits or negative examples, which could cause unintended invocation for ordinary requests in this domain.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file presents itself as a Xiaohongshu ecommerce video skill, but it embeds a broad generic AI Hive wrapper exposing extra capabilities such as chat, image generation, model listing, uploads, and account queries. In a skill ecosystem, this is dangerous because callers may grant trust, credentials, or approval based on the narrow advertised purpose while the code can perform materially broader actions than expected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing natural-language descriptions entirely in Chinese, which effectively forces a specific language experience. The file does not indicate that the skill is China-specific or offer any user opt-in or alternative locale, which fits the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Numerous user-visible strings in errors, prompts, help text, and workflow instructions are fixed to Chinese, including initialization and runtime output. Because the skill does not offer a language option or explain a justified locale restriction, it violates the natural-language locale policy for all file types.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code can call a user-info endpoint that reveals account information and wallet balance, which is unrelated to generating Xiaohongshu videos. This expands the data-access surface beyond user expectations and could expose sensitive account metadata if the skill is invoked with a valid API key.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The standalone text chat pathway is unrelated to the advertised video-generation skill and allows the tool to act as a generic LLM client. That kind of hidden scope expansion is risky in agent environments because it enables unintended prompt handling, data transmission, and billable API use outside the reviewed use case.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code includes independent image generation capabilities beyond ecommerce video creation/editing. In context, that means the skill can be used for broader content generation than advertised, increasing misuse potential, review evasion, and unexpected consumption of user credentials or account balance.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
SQP-3 covers natural-language policy issues across all file types, including language or locale constraints imposed without user choice. This file presents the skill information only in Chinese and does not indicate that language selection is optional or that the locale is intentionally constrained for a documented regional use case.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file content is primarily Chinese, but the manifest description includes an English directive ("Use this skill for ...") without stating whether the skill should respond in the user's preferred language. This can be a natural-language policy concern when a skill appears to assume or force a particular language presentation without offering choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. There is no indication that the skill is China-specific or that users may choose another language, so this appears to violate the language/locale policy criteria.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level docstring states this is a '通用 AI 能力调用工具' that wraps chat, image generation, video generation, model querying, upload, and polling. That actively conflicts with the enclosing skill identity and manifest, which present a specialized Xiaohongshu ecommerce video-generation/editing skill rather than a generic AI utility.
- Content
Static analysis
No suspicious patterns detected.