Security audit

creative-media

Security checks for vulnerabilities and agentic risk

Overview

This media skill needs review because it directs agents to upload troubleshooting commands without a clear user approval or privacy check.

Require approval before submitting feedback and remove private prompts, URLs, paths, and secrets. Consider pinned dependency versions and workspace-scoped installation. Inputs and results use Luxin hosting. All packaged content was inspected, and scanner coverage was complete for the single stub; upstream documentation was checked, but the external executable and hosted service implementations were not audited.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code's sole action is installing another skill. It does not implement or invoke the described signup, create/edit operations, credit accounting, media delivery, job retrieval, or receipts. Although installation could support a media runtime, no subsequent runtime behavior is supplied here, so the visible code has a materially different primary purpose. The contents and behavior of the remotely installed skill cannot be established from this command alone.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The only executable behavior shown is installing an external skill. Installation could support a media runtime, but this chunk neither invokes nor implements the advertised runtime; its immediate purpose is modifying the agent's installed skills. The installed skill might provide the declared capabilities, but its contents are not supplied and cannot be verified here. This assessment does not imply that the installer is malicious.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The revision variable could be a supporting implementation detail, but the only substantive command performs a skill update. Nothing in the supplied chunk implements or invokes the declared signup, media creation/editing, job retrieval, or receipt functionality. The update may bootstrap other code, but that code and its behavior are not supplied and cannot be assumed.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y luxin-cli'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Although this is a CLI rather than an MCP server, the command executes the mutable luxin-cli@latest package with automatic confirmation. A compromised or malicious future release could execute code with the agent's permissions; the advertised no-spend guide does not limit local code execution.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y luxin-cli'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The model-listing command downloads and executes luxin-cli@latest rather than a fixed, reviewed release. Listing models is a legitimate operation, but its read-only purpose does not prevent a substituted package from accessing local files or credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The installer invokes an unversioned npm package and selects repository-hosted skill content without an immutable revision. Compromise of either dependency could execute code or introduce persistent malicious instructions into the global agent skill configuration.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The alternative canonical-skill installation also executes an unversioned skills package and retrieves skill content without a fixed repository revision. Its global target increases the potential reach of a compromised installer or malicious skill update beyond the current media task.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The writable-home fallback repeats the unpinned installer and mutable repository dependency. Redirecting HOME changes the installation destination but does not sandbox the downloaded executable or prevent it from accessing other resources available to the process.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y luxin-cli'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Retrieving guidance executes luxin-cli@latest, making a mutable external package part of the agent's instruction-loading path. A compromised release could execute arbitrary code and supply malicious guidance; the local skill revision marker does not pin or authenticate that package.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The explicit update command still invokes an unversioned skills executable and can replace installed agent instructions with newer upstream content. Requiring an explicit update reduces silent-change risk but does not protect against a compromised package or upstream revision.
Content: No source excerpt is available for this finding.

The fallback workflow sends command and diagnostic details to hosted feedback without a privacy warning or redaction guidance.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The fallback instructs the agent to submit attempted commands and diagnostic details to hosted feedback without requiring redaction or approval. Media commands can contain private prompts, asset URLs, local paths, or credentials embedded in arguments, so this can disclose information beyond what the generation task requires.
Content: No source excerpt is available for this finding.