TrendAI Vision One Threat Intelligence

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Trend Micro Vision One threat-intelligence integration, but it needs review because it handles a powerful API token and can modify suspicious-object blocking state while the HTTP client lacks redirect destination checks.

Install only with a Vision One API key limited to the permissions you need. Prefer a View-only token for lookup, feed, report, hunt, and suspicious list; use a separate Configure-capable token only when you intentionally want the agent to add blocking or logging entries. Review any request to use raw API endpoints, delete suspicious objects, or change exception lists, and consider fixing redirect validation before using high-privilege tokens.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/client.py:59

Finding

Bearer Token May Be Disclosed Through Cross-Origin HTTP Redirects

Content

View full analysis

Vulnerability Details

File Location: scripts/lib/client.py, lines 59-82
Vulnerability Type: Authenticated request redirect without destination validation
Risk Level: Medium

Vulnerable Code

python

def _headers(self):
    return {
        "Authorization": f"Bearer {self.api_key}",
        "Content-Type": "application/json;charset=utf-8",
        "User-Agent": "OpenClaw-VisionOneTI/1.0",
    }

def _request(self, method, path, params=None, body=None):
    url = f"{self.base_url}{path}"
    if params:
        # Filter out None values
        clean = {k: v for k, v in params.items() if v is not None}
        if clean:
            url += "?" + urlencode(clean)

    data = None
    if body is not None:
        data = json.dumps(body).encode("utf-8")

    req = urllib.request.Request(
        url,
        data=data,
        headers=self._headers(),
        method=method,
    )

    last_err = None
    for attempt in range(MAX_RETRIES):
        try:
            with urllib.request.urlopen(req, timeout=60) as resp:

Technical Analysis

The initial API destination is appropriately constrained through a fixed region-to-hostname mapping and HTTPS. Sending VISION_ONE_API_KEY as a Bearer token to the selected Trend Micro Vision One endpoint is necessary for the Skill’s declared functionality and does not, by itself, exceed minimum privilege requirements.

The security issue arises because urllib.request.urlopen() uses automatic HTTP redirect handling. The code does not inspect redirect responses or validate the scheme, hostname, and port of the redirect destination. Request headers may be copied to the redirected request, including the Authorization header.

Consequently, if an approved API endpoint returns a redirect to another origin, the client may forward the Vision One Bearer token to that destination. Exploitation requires control or compromise of the trusted A ...[truncated 1681 chars]

Remediation

View remediation

Remediation Suggestions

Replace unrestricted automatic redirect handling with an explicit redirect policy:

1. Disable automatic redirects or implement a custom urllib.request.HTTPRedirectHandler.
2. Parse every redirect destination with urllib.parse.urlparse.
3. Require the destination scheme to remain https.
4. Require the destination hostname to exactly match the hostname selected from the fixed REGIONS mapping.
5. Reject redirects to unapproved hosts, IP literals, nonstandard ports, embedded credentials, or downgraded HTTP destinations.
6. Remove the Authorization header whenever the origin changes, even if cross-origin redirects are permitted for another reason.
7. Set a small redirect limit and reject redirect loops.
8. Add tests covering same-origin redirects, cross-origin redirects, HTTPS-to-HTTP downgrades, hostname suffix tricks, and port changes.
9. Continue using separate least-privilege API keys: use a view-only token for read commands and a distinct configuration-capable token only when write functionality is required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a Python script, depends on an API key, and is described as performing network-backed threat intelligence queries, yet it declares no explicit tool scope such as permissions or allowed-tools. This creates an overbroad execution model where the agent may access environment data, files, and network resources without a least-privilege contract, increasing the chance of unintended secret exposure or misuse of write-capable operations like 'suspicious add'.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation exposes write/delete capabilities for suspicious object and exception lists without any explicit warning, confirmation guidance, or operational safety notes. In a security-agent context, this can lead an LLM-driven agent or user to perform blocking, allowlisting, or deletion actions that materially change protection posture, potentially causing outages, weakening detections, or removing important indicators by mistake.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/response-schemas.md (reported line 14)May include surrounding context.

"id": "bundle--uuid", "objects": [ ... ] }, "nextLink": "https://api.xdr.trendmicro.com/v3.0/threatintel/...?skipToken=...", "reportUpdatedDateTime": "2026-03-12T00:00:00Z" }

text