T08 · Insecure Dependencies
Warning
- Location
SKILL.md:375- Finding
Unpinned npm CLI Packages May Be Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
MiniMax Fullstack Dev
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent full-stack development guidance skill with no executable payload or persistence, though some examples need safer production handling.
Installers should treat this as a development guide, not a hardened template. Before using its command examples, pin CLI tools or rely on locked project dependencies, confirm database targets before migrations, and strengthen the file-upload sample before production.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:712- Finding
Presigned Upload Example Trusts Client-Controlled Filename and Content Type
- Content
View full analysis
{ const { filename, type } = req.query; const key = `uploads/${crypto.randomUUID()}-${filename}`; const url = await s3.getSignedUrl('putObject', { Bucket: process.env.S3_BUCKET, Key: key, ContentType: type, Expires: 300, // 5 min }); res.json({ uploadUrl: url, fileKey: key }); }); ``` ```typescript async function uploadFile(file: File) { const { uploadUrl, fileKey } = await apiClient.get( `/api/uploads/presign?filename=${file.name}&type=${file.type}` ); await fetch(uploadUrl, { method: 'PUT', body: file, headers: { 'Content-Type': file.type } }); return apiClient.post('/api/photos', { fileKey }); } ``` ### Technical Analysis The example derives the object key and signed `Content-Type` directly from client-controlled query parameters. It does not demonstrate: - Filename normalization or rejection of unsafe characters. - Extension and MIME-type allowlists. - Upload-size restrictions. - Verification of file signatures or actual content. - Malware scanning or content disarm procedures. - Isolation of uploaded objects from executable or same-origin web content. - Safe encoding of `file.name` and `file.type` when constructing the query string. A signed `Content-Type` only binds the upload to the label supplied by the client; it does not establish that the uploaded bytes match that type. In addition, direct string interpolation without `URLSearchParams` or `encodeURIComponent` permits special characters such as `&` to alter query parsing. This is a guidance-file vulnerability rather than an active upload endpoint in the audited repository. Exploitation becomes possible if an application is generated from the example without adding the omitted c ...[truncated 1499 chars]- Remediation
View remediation
( `/api/uploads/presign?${params.toString()}` ); ``` - Validate request parameters with a strict schema and reject arrays, missing values, unexpected fields, control characters, path separators, and oversized values. - Allowlist acceptable extensions and MIME types according to the application's actual requirements. - Do not trust the browser-provided MIME type. Verify magic bytes or parse the file with a suitable hardened library after upload. - Enforce maximum object sizes through signed upload conditions or a storage-triggered validation process. - Keep the bucket private and provide files through controlled download endpoints or short-lived download URLs. - Serve user content from a separate, untrusted origin with restrictive `Content-Disposition`, `Content-Type`, and Content Security Policy headers. - Quarantine new objects until antivirus scanning and content validation succeed. - Delete rejected or abandoned objects and apply storage lifecycle policies. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
port: int = 3000 # optional with default db_pool_size: int = 10 class Config: env_file = ".env"
settings = Settings() # fails fast if DATABASE_URL missing
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
✅ Commit .env.example with dummy values
❌ Never hardcode secrets, URLs, or credentials ❌ Never commit .env files ❌ Never scatter process.env / os.environ throughout code
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
JWT Rules
text ✅ Short expiry access token (15min) + refresh token (server-stored) ✅ Minimal claims: userId, roles (not entire user object) ✅ Rotate signing keys periodically
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content