T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:31- Finding
Shell Command Injection Through User-Controlled Music Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
音乐生成
Security checks for vulnerabilities and agentic risk
Overview
This music-generation skill is purpose-aligned, but it asks the agent to run shell commands with user-provided song parameters in a way that can enable command injection and leaks the API key through URLs.
Review this skill before installing. Use it only in a restricted workspace, avoid sensitive prompts, rotate the OhYesAI key if it may have been logged, and do not let an agent paste user text directly into the provided shell templates; a safer implementation should build JSON with a serializer and download to unique, user-approved filenames.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:36- Finding
API Credential Exposed in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The setup and usage flow require sending an API key to a third-party service but do not warn that credentials and user prompts are being transmitted externally. This creates a privacy and secret-handling risk, especially in agent environments where users may not realize their inputs and tokens are leaving the local system.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The skill explicitly transmits user-supplied content and an API credential to an external service. This is expected for the feature, but it remains a real security concern because prompts may contain sensitive data and the API key is embedded in the request URL, which is more likely to leak via logs, proxies, or telemetry.
- Content
1. 提交任务 (Submit Task)
收集完参数后，使用
curl调用 submit 接口提交任务：bash curl -s --location --request POST "https://ohyesai.com/ohyesai-next/api/vio/skill/music-submit?apikey=$OHEYSAI_API_KEY" \ --header 'Content-Type: application/json' \ --data-raw '{ "title": "晚安",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to download remote MP3 content directly into the current working directory using a fixed local filename, without any guardrails around overwrite, path safety, or file provenance. In an agent setting, this can clobber existing files, persist untrusted content locally, and increase the chance of later misuse if the returned URL or filename is manipulated.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The operational instructions and required user-facing reply text are all in Chinese, which can impose a specific language on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.
- Content
Static analysis
No suspicious patterns detected.