T09 · Insecure Skill Coding Practices
Error
- Location
commands/embed.md:21- Finding
Shell Command Injection Through Unsafe User-Input Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
deAPI - AI Media Generation Toolkit
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real deAPI media tool, but it needs Review because its examples send user content to a third party and include unsafe shell, URL, temporary-file, and webhook patterns.
Install only if you are comfortable sending prompts, text, media, URLs, and generated-output metadata to deAPI. Avoid secrets, regulated data, private signed URLs, and sensitive local files. Treat the provided curl and webhook snippets as examples that need hardening before use: serialize JSON safely, validate URLs, use private temporary files, and implement real webhook signature verification.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
commands/ocr.md:11- Finding
Unrestricted URL Retrieval Can Cause SSRF and Third-Party Data Disclosure
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
commands/transform-image.md:27- Finding
Predictable Shared Temporary Files Permit Symlink Attacks and Data Leakage
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
commands/deapi-setup.md:71- Finding
Generated Webhook Handlers Do Not Verify HMAC Signatures
- Content
View full analysis
{ const signature = req.headers['x-deapi-signature']; // Verify signature with your webhook secret const { event, request_id, result_url, error } = req.body; if (event === 'job.completed') { // Process result from result_url } else if (event === 'job.failed') { // Handle error } res.status(200).send('OK'); }); ``` The Python boilerplate at `commands/deapi-setup.md:89-110` has the same defect: ```python from fastapi import FastAPI, Request, Header app = FastAPI() @app.post("/webhooks/deapi") async def deapi_webhook( request: Request, x_deapi_signature: str = Header(None) ): # Verify signature with your webhook secret body = await request.json() if body["event"] == "job.completed": result_url = body["result_url"] # Process result elif body["event"] == "job.failed": error = body["error"] # Handle error return {"status": "ok"} ``` ### Technical Analysis Both examples mention signature verification but omit the actual HMAC calculation and comparison. The handlers parse and act on the request body regardless of whether the signature is missing, malformed, or forged. A comment is not a security control. Because this command is intended to generate starter code and is proactively recommended for production de ...[truncated 1449 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (39)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill routes user-provided media, URLs, prompts, and generated outputs to an external third-party service, but the description and setup text do not clearly warn users about that data transfer. This can lead users to submit sensitive content under the mistaken assumption processing is local or first-party, creating privacy, confidentiality, and compliance risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Check balance
bash curl -s "https://api.deapi.ai/api/v1/client/balance" \ -H "Authorization: Bearer $DEAPI_API_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs sending arbitrary user-provided text to a third-party embedding service but does not explicitly warn that the content will leave the local environment and be processed externally. This is risky because users may paste sensitive documents, credentials, proprietary data, or personal information into an embedding workflow without informed consent about data transmission and retention implications.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The hardcoded external endpoint identifies a third-party service that will receive user content and API-authenticated requests. Even though this is the intended functionality of the skill, the absence of contextual safeguards makes accidental disclosure of confidential input more likely.
- Content
Step 2: Send request
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/txt2embedding" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The hardcoded external endpoint identifies a third-party service that will receive user content and API-authenticated requests. Even though this is the intended functionality of the skill, the absence of contextual safeguards makes accidental disclosure of confidential input more likely.
- Content
Step 2: Send request
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/txt2embedding" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly sends user-supplied text to a third-party service for text-to-speech, but it does not warn the user that their content will leave the local environment. This is a real privacy/transparency issue because users may provide sensitive text assuming the assistant processes it locally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This command performs an outbound POST to api.deapi.ai and includes the user's text in the JSON body. In a media-generation skill this transmission is expected, but it still creates a genuine data-exposure risk if users submit confidential or regulated information without realizing it is being shared externally.
- Content
Step 2: Send request
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/txt2audio" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This command performs an outbound POST to api.deapi.ai and includes the user's text in the JSON body. In a media-generation skill this transmission is expected, but it still creates a genuine data-exposure risk if users submit confidential or regulated information without realizing it is being shared externally.
- Content
Step 2: Send request
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/txt2audio" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends the user's prompt directly to a third-party API for image generation but does not explicitly warn the user that their input will leave the local environment. Prompts can contain sensitive business, personal, or proprietary data, so undisclosed transmission creates a real privacy and data-governance risk even if the functionality is expected for the skill.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The hardcoded external endpoint indicates this skill is designed to send data and credentials to deAPI over the network. In context this is expected, but it still increases attack surface and privacy exposure because user content and API-key-authenticated requests leave the trusted boundary.
- Content
Step 2: Send request
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/txt2img" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The hardcoded external endpoint indicates this skill is designed to send data and credentials to deAPI over the network. In context this is expected, but it still increases attack surface and privacy exposure because user content and API-key-authenticated requests leave the trusted boundary.
- Content
Step 2: Send request
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/txt2img" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill transmits user-supplied prompts and image URLs to a third-party service without an explicit user-facing notice or consent step. Because prompts and URLs can contain sensitive, proprietary, or identifying information, this creates a privacy and data-governance risk even if the transmission is the feature's intended behavior.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This command sends user content to an external API endpoint using an API key, which is expected for the feature but still introduces data exfiltration and third-party handling risk. If users enter confidential text in prompts, that information leaves the local trust boundary and may be stored or processed by the provider.
- Content
For Text-to-Video:
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/txt2video" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This command sends user content to an external API endpoint using an API key, which is expected for the feature but still introduces data exfiltration and third-party handling risk. If users enter confidential text in prompts, that information leaves the local trust boundary and may be stored or processed by the provider.
- Content
For Text-to-Video:
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/txt2video" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The image-to-video flow sends a user-provided image URL to an external service without an explicit warning. While core to the skill's purpose, this can disclose private image locations, signed URLs, or internal resource references to the third party if users paste sensitive links.
- Content
For Image-to-Video (animation):
bash curl -s -X POST "https://api.deapi.ai/api/v1/client/img2video" \ -H "Authorization: Bearer $DEAPI_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Static analysis
No suspicious patterns detected.