Security audit

neodomain-ai

Security checks for vulnerabilities and agentic risk

Overview

The skill matches an AI media-generation purpose, but it handles account tokens and uploaded local media in ways users should review carefully before installing.

Install only if you trust the Neodomain service and are comfortable with prompts, reference URLs, selected local media, and generated outputs being sent through its API/OSS workflow. Avoid putting tokens directly in commands or shell startup files, treat printed tokens as sensitive, and do not upload private media unless you understand where it will be stored and how it can be removed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/login.py:68
Finding: Access Token and One-Time Verification Code Exposed Through Process Arguments and Console Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/upload_oss.py:57
Finding: Uploaded Media Is Assigned a Low-Entropy Object Name and Returned Through a Direct OSS URL Without Cleanup Controls
Content: View full analysis
/<8-hex-character-id>`. ### Technical Analysis The upload helper accepts any user-selected local file and transfers its entire contents to Alibaba OSS using temporary credentials obtained from Neodomain. Uploading media is necessary for the documented image-to-video workflow when the upstream service requires a remotely accessible URL. However, the implementation does not enforce that the selected file is an expected image/video type, does not set an explicit private object ACL, does not generate a signed expiring retrieval URL, and does not delete the temporary object after processing. The object identifier is truncated to eight hexadecimal characters, providing only 32 bits of randomness. The current date and path prefix are predictable. A direct bucket URL is constructed and printed, indicating that the workflow expects the object to be retrievable through that URL. If the bucket or prefix permits anonymous reads, anyone who obtains or discovers the URL can retrieve the uploaded content. The repository does not contain the bucket policy, so anonymous accessibility cannot be proven solely fr ...[truncated 1450 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_video.py:82
Finding: Unvalidated Server-Supplied URLs Are Fetched From the Local Execution Environment
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior includes access to local files and cloud/object-storage upload flows that are not apparent from the high-level skill purpose. Hidden or under-disclosed file exfiltration paths are dangerous because user-supplied files or local data could be transmitted to third-party storage without adequate user understanding or policy restriction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes access to local files and cloud/object-storage upload flows that are not apparent from the high-level skill purpose. Hidden or under-disclosed file exfiltration paths are dangerous because user-supplied files or local data could be transmitted to third-party storage without adequate user understanding or policy restriction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes access to local files and cloud/object-storage upload flows that are not apparent from the high-level skill purpose. Hidden or under-disclosed file exfiltration paths are dangerous because user-supplied files or local data could be transmitted to third-party storage without adequate user understanding or policy restriction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior includes access to local files and cloud/object-storage upload flows that are not apparent from the high-level skill purpose. Hidden or under-disclosed file exfiltration paths are dangerous because user-supplied files or local data could be transmitted to third-party storage without adequate user understanding or policy restriction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes access to local files and cloud/object-storage upload flows that are not apparent from the high-level skill purpose. Hidden or under-disclosed file exfiltration paths are dangerous because user-supplied files or local data could be transmitted to third-party storage without adequate user understanding or policy restriction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes access to local files and cloud/object-storage upload flows that are not apparent from the high-level skill purpose. Hidden or under-disclosed file exfiltration paths are dangerous because user-supplied files or local data could be transmitted to third-party storage without adequate user understanding or policy restriction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes access to local files and cloud/object-storage upload flows that are not apparent from the high-level skill purpose. Hidden or under-disclosed file exfiltration paths are dangerous because user-supplied files or local data could be transmitted to third-party storage without adequate user understanding or policy restriction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes access to local files and cloud/object-storage upload flows that are not apparent from the high-level skill purpose. Hidden or under-disclosed file exfiltration paths are dangerous because user-supplied files or local data could be transmitted to third-party storage without adequate user understanding or policy restriction.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: The skill instructs the agent to dynamically ask for a user's phone number or email to obtain an access token, introducing direct collection of sensitive identifiers and an authentication workflow inside the skill. In agent contexts, this is dangerous because it can normalize credential/PII solicitation and create opportunities for phishing, mishandling of verification codes, or unauthorized account access.
Content: Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

重要: 每次 token 过期或首次使用时，动态询问用户登录账号（手机号/邮箱），不要硬编码保存。

If you need to obtain an access token:

bash
# 1. 发送验证码 (询问用户手机号或邮箱)

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The login workflow states that the script will output an access token that can then be stored for future use. Emitting bearer tokens in plaintext to the terminal or agent output creates a significant exposure risk because logs, transcripts, or other tools may capture and reuse the credential.
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
python3 {baseDir}/scripts/login.py --login --contact "用户手机号或邮箱" --code "验证码"

text
The login script will output an access token that you can store in `NEODOMAIN_ACCESS_TOKEN`. ## Workflow

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · INSTALL.md (reported line 62)May include surrounding context.
md
#!/usr/bin/env python3 """ Neodomain AI - Authentication Script Send verification code and login to get access token. """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
#!/usr/bin/env python3 """ Neodomain AI - Authentication Script Send verification code and login to get access token. """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.
md
#!/usr/bin/env python3 """ Neodomain AI - Authentication Script Send verification code and login to get access token. """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/login.py (reported line 4)May include surrounding context.
python
#!/usr/bin/env python3 """ Neodomain AI - Authentication Script Send verification code and login to get access token. """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/login.py (reported line 38)May include surrounding context.
python
#!/usr/bin/env python3 """ Neodomain AI - Authentication Script Send verification code and login to get access token. """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The script prints the access token and an export command containing the token directly to stdout. In an agent or automation context, stdout may be captured by logs, chat transcripts, shell history, telemetry, or other tools, causing credential disclosure and enabling unauthorized reuse of the bearer token.
Content: Scanner excerpt · scripts/login.py (reported line 91)May include surrounding context.
python
result = login(args.contact, args.code, args.invitation_code) print("\n✅ Login successful!") print(f"\nAccess Token:") print(result.get("authorization")) print(f"\nUser Info:") print(f" User ID: {result.get('userId')}")

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · INSTALL.md (reported line 113)May include surrounding context.
md
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/batch_video.py (reported line 132)May include surrounding context.
python
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/batch_video.py (reported line 142)May include surrounding context.
python
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 102)May include surrounding context.
python
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image.py (reported line 111)May include surrounding context.
python
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image_ref.py (reported line 102)May include surrounding context.
python
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_image_ref.py (reported line 111)May include surrounding context.
python
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_video.py (reported line 128)May include surrounding context.
python
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate_video.py (reported line 137)May include surrounding context.
python
parser = argparse.ArgumentParser(description="Get available video generation models") parser.add_argument("--request-type", type=int, default=2, help="Request type: 1-视频工具, 2-画布") parser.add_argument("--token", "--access-token", dest="token", help="Access token") args = parser.parse_args()