music video mv 制作

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent OhYesAI music-video generator, but users should understand that it sends their audio to OhYesAI and uses an API key in request URLs.

Install this only if you are comfortable sending the selected audio file to OhYesAI for processing. Avoid private or rights-sensitive audio unless you accept OhYesAI's handling of it, and prefer a limited/rotatable API key because the documented requests put the key in the URL query string.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

API Key Exposed in URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31, 36, and 48
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

text

- **URL**: `POST https://ohyesai.com/ohyesai-next/api/vio/skill/upload?apikey={{OHEYSAI_API_KEY}}`

text

- **URL**: `POST https://ohyesai.com/ohyesai-next/api/vio/skill/mv-submit?apikey={{OHEYSAI_API_KEY}}`

text

- **URL**: `GET https://ohyesai.com/ohyesai-next/api/vio/skill/mv-query?apikey={{OHEYSAI_API_KEY}}&taskId={{taskId}}`

Technical Analysis

The skill instructs the agent to include OHEYSAI_API_KEY in the query string for upload, task submission, and task-status requests. Although HTTPS encrypts requests in transit, query strings may still be retained by web servers, reverse proxies, API gateways, observability platforms, request histories, and diagnostic or error logs.

This design unnecessarily expands the number of systems and personnel that may gain access to the credential. URL redaction is also less consistently enforced than redaction of recognized authentication headers.

Attack Path

1. The agent reads OHEYSAI_API_KEY from its environment.
2. It interpolates the secret into one of the documented API URLs.
3. A server, proxy, gateway, monitoring service, or debugging component records the complete request URL.
4. An attacker or unauthorized operator with access to those records extracts the apikey value.
5. The exposed key is replayed against the OhYesAI API to make unauthorized requests.

Impact Assessment

Successful exploitation could permit unauthorized API calls under the victim's account or quota. Depending on the server-side authorization model, an attacker may be able to upload content, submit resource-consuming MV-generation jobs, query task information, or otherwise use API functionality authorized by the compromised key.

The finding does not de ...[truncated 137 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace query-string authentication with a dedicated request header, preferably:

   http

   Authorization: Bearer ${OHEYSAI_API_KEY}
   

   Alternatively, use a service-specific secret header if bearer authentication is unsupported.

2. Update all three documented endpoints so neither the API key nor any other credential appears in a URL.

3. Ensure commands, application logs, errors, progress messages, and user-visible output never print the credential or an authenticated URL.

4. Configure API gateways, reverse proxies, and observability systems to redact authentication headers and any legacy apikey query parameter.

5. Rotate keys that may previously have been transmitted in query strings, because historical logs may retain them.

6. Apply least-privilege scopes, usage limits, expiration, and anomaly monitoring to API credentials where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The operational instructions and user-facing prompts are presented in Chinese, which can impose a language requirement on users or operators without opt-in. The file does not state that the skill is region-specific or offer an alternative language option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to upload a user-provided audio file to an external service but does not clearly warn the user that their content will be transmitted to a third party for processing. This creates a real privacy and consent issue, especially because audio may contain copyrighted, personal, or sensitive material and the API endpoints explicitly send it off-platform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.