T09 · Insecure Skill Coding Practices
Error
- Location
scripts/local_run.sh:58- Finding
Shell Command Injection Through eval-Based Command Construction
- Content
View full analysis
- Remediation
View remediation
Security audit
Meme Token Analyzer
Security checks for vulnerabilities and agentic risk
Overview
The skill’s stated meme-token analysis purpose is legitimate, but the package has material review concerns from an opaque remote MCP backend and bundled executable code that contradicts the published architecture and can expose unauthenticated paid AI/search/image workflows if run.
Review before installing or running. The MCP skill may be acceptable only if you trust the publisher’s remote backend, but the package should clarify which implementation is authoritative, document the MCP API surface, remove or fix the stale Python/Coze implementation, add authentication before exposing any local server, stop logging full request bodies, avoid eval-based shell execution, and use a locked, hash-verified dependency install path.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/main.py:244- Finding
Unauthenticated Network Access to Paid Workflow and Node Integrations
- Content
View full analysis
Dict[str, Any]: global result raw_body = await request.body() try: body_text = raw_body.decode("utf-8") except Exception as e: body_text = str(raw_body) raise HTTPException(status_code=400, detail=f"Invalid JSON format: {body_text}, traceback: {traceback.format_exc()}, error: {e}") ctx = new_context(method="run", headers=request.headers) upstream_run_id = request.headers.get(HEADER_X_RUN_ID) if upstream_run_id: ctx.run_id = upstream_run_id run_id = ctx.run_id request_context.set(ctx) logger.info( f"Received request for /run: " f"run_id={run_id}, " f"query={dict(request.query_params)}, " f"body={body_text}" ) try: payload = await request.json() ``` Individual graph nodes and OpenAI-compatible processing are also exposed without access control: ```python @app.post(path="/node_run/{node_id}") async def http_node_run(node_id: str, request: Request): ``` ```python @app.post("/v1/chat/completions") async def openai_chat_completions(request: Request): """OpenAI Chat Completions API 兼容接口""" ctx = new_context(method="openai_chat", headers=request.headers) request_context.set(ctx) logger.info(f"Received request for /v1/chat/completions: run_id={ctx.run_id}") try: payload = await request.json() return await openai_handler.handle(payload, ctx) ``` The server listens on every network interface: ```python def start_http_server(port): workers = 1 reload = ...[truncated 2658 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
src/graphs/nodes/clean_data_node.py:37- Finding
Indirect Prompt Injection Through Untrusted Search Results
- Content
View full analysis
0: years_found.append(year) ``` The external search summary is also retained verbatim and combined with those snippets: ```python if state.search_summary: cleaned_text = f"=== AI Summary ===\n{state.search_summary}\n\n=== Detailed Information ===\n\n" + "\n---\n".join(snippets) else: cleaned_text = "\n---\n".join(snippets) cleaned_text += stale_data_warning ``` The resulting untrusted text is inserted directly into the model prompt: ```python up_tpl = Template(up) user_prompt_content = up_tpl.render({ "token": state.token_name, "sentiment_data": state.cleaned_text }) ``` It is then sent as part of the LLM's human message: ```python if state.generated_image_url: human_content = [ { "type": "text", "text": user_prompt_content }, { "type": "image_url", "image_url": { "url": state.generated_image_url } } ] else: logger.warning("No image URL available, falling back to text-only analysis") human_content = [ { "type": "text", "text": user_prompt_content + "\n\n[Note: Image generation was unavailable. Please perform text-only analysis based on the sentiment data above.]" } ] messages = [ SystemMessage(content=sp) ...[truncated 1942 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
pyproject.toml:150- Finding
Dependency Installation Uses an Unverified Third-Party Mirror Without Artifact Hashes
- Content
View full analysis
/dev/null && [ -f "pyproject.toml" ]; then # uv 模式 if [ -n "$PIP_TARGET" ]; then echo "[setup] Deploy mode (uv): installing to PIP_TARGET=$PIP_TARGET" uv export --frozen --no-hashes --no-dev | uv pip install --no-cache --target "$PIP_TARGET" -r - else echo "[setup] Devbox mode (uv): installing to .venv" if [ -f "uv.lock" ]; then uv sync --frozen || uv sync else uv sync fi touch .venv/.uv_ready fi else if [ -f "requirements.txt" ]; then echo "[setup] Fallback mode (pip): installing from requirements.txt" pip install -r requirements.txt else echo "[setup] Warning: no pyproject.toml or requirements.txt found, skipping install" fi fi ``` ### Technical Analysis Although the dependency versions are pinned, version pinning alone does not authenticate package artifacts. The reviewed project tree does not contain a `uv.lock` file, and deployment mode explicitly exports dependencies with `--no-hashes`. Consequently, installation trusts whichever artifact the configured package mirror serves for a requested package and version. A compromised mirror, package publisher account, or substituted artifact could introduce modified code while retaining the expected package name and version. The dependency list is also substantially larger than the core workflow requires, increasing the number of trusted maintainers, package artifacts, native components, and transitive attack paths. ### Attack Path 1. A user runs `scripts/setup. ...[truncated 994 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/main.py:244- Finding
Complete HTTP Request Bodies Are Persisted in Application Logs
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
README.md:19- Finding
Published Architecture and Data-Processing Claims Do Not Match the Bundled Executable Implementation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (114)
Known Vulnerable Dependency: cryptography==46.0.5 — 11 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2026-69247 (cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle th); CVE-2026-69249 (python-cryptography: Duplicate self-signed intermediates can cause exponential p) +8 more
Critical
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Pinning cryptography==46.0.5 with multiple critical advisories is a serious security issue because cryptographic libraries are foundational to TLS, token handling, and secret protection. Exploitable flaws here can undermine confidentiality, integrity, or availability across authentication, encrypted transport, and signed data workflows.
- Content
Known Vulnerable Dependency: gitpython==3.1.45 — 16 advisory(ies): CVE-2026-78676 (GitPython: Dormant multi-line git-config values are corrupted into live injected); CVE-2026-67325 (GitPython: Command Injection via git long-option prefix abbreviation bypass of C); CVE-2026-73620 (GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagRefere) +13 more
Critical
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
gitpython==3.1.45 is flagged for multiple command injection and option-forwarding issues, which is especially dangerous in agent-like systems that may inspect repositories or process attacker-controlled Git metadata. If repository URLs, branch names, tags, or config content can be influenced externally, this could lead to arbitrary command execution or tampering.
- Content
Known Vulnerable Dependency: langchain-core==1.0.2 — 12 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa); CVE-2026-40087 (LangChain has incomplete f-string validation in prompt templates) +9 more
Critical
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
langchain-core==1.0.2 is associated with multiple severe issues including SSRF and template injection. This is especially dangerous for a web-data-driven agent skill because attacker-controlled prompts, URLs, or content from external sentiment sources may be routed through vulnerable templating or token-counting paths.
- Content
Known Vulnerable Dependency: langgraph==1.0.2 — 2 advisory(ies): CVE-2026-28277 (LangGraph checkpoint loading has unsafe msgpack deserialization); CVE-2026-28277 (LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver th)
Critical
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
langgraph==1.0.2 is flagged for unsafe deserialization in checkpoint loading, a class of issue that can lead to code execution or state corruption when untrusted checkpoint data is loaded. Agent systems frequently persist and reload state, making this particularly relevant and high impact in this skill ecosystem.
- Content
Known Vulnerable Dependency: cryptography==46.0.5 — 11 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2026-69247 (cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle th); CVE-2026-69249 (python-cryptography: Duplicate self-signed intermediates can cause exponential p) +8 more
Critical
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
cryptography==46.0.5 is associated with numerous critical advisories, including issues in bundled OpenSSL and cryptographic parsing/decryption behavior. Because this package underpins transport security, token validation, and secret handling across many Python stacks, compromise here can have broad and severe consequences.
- Content
Known Vulnerable Dependency: langchain-core==1.0.2 — 12 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa); CVE-2026-40087 (LangChain has incomplete f-string validation in prompt templates) +9 more
Critical
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
langchain-core==1.0.2 has multiple critical advisories, including SSRF and prompt/template injection issues. In an agentic application that processes user-controlled token names and potentially remote content, these flaws can allow network pivoting, data exfiltration, or unsafe execution paths through tooling.
- Content
Known Vulnerable Dependency: langgraph==1.0.2 — 2 advisory(ies): CVE-2026-28277 (LangGraph checkpoint loading has unsafe msgpack deserialization); CVE-2026-28277 (LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver th)
Critical
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
langgraph==1.0.2 is reported vulnerable to unsafe msgpack deserialization during checkpoint loading. Deserialization flaws can lead to code execution or state compromise when loading attacker-influenced checkpoints, which is especially dangerous in long-running agent systems.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 81% confidence
- Finding
The instruction to generate a token with
repofull-control scope and use it as a password is broader than necessary and may encourage users to create overly privileged credentials. In a public-facing setup guide, that increases blast radius if the token is later exposed through terminal helpers, clipboard leakage, screenshots, or accidental reuse.- Content
md ### Error: "Authentication failed" For HTTPS authentication, you need a **Personal Access Token**: 1. Go to GitHub Settings > Developer settings > Personal access tokens 2. Generate new token (classic) 3. Select scopes: `repo` (full control) 4. Copy the token and use it as your password
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - GitHub Documentation: https://docs.github.com - Git Documentation: https://git-scm.com/doc - Personal Access Tokens: https://github.com/settings/tokens ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Step 3: Push to GitHub
bash # Using HTTPS (will prompt for GitHub username and Personal Access Token) git push origin main # Or using SSH (if you have SSH keys configured)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Step 3: Push to GitHub
bash # Using HTTPS (will prompt for GitHub username and Personal Access Token) git push origin main # Or using SSH (if you have SSH keys configured)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Step 3: Push to GitHub
bash # Using HTTPS (will prompt for GitHub username and Personal Access Token) git push origin main # Or using SSH (if you have SSH keys configured)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Step 3: Push to GitHub
bash # Using HTTPS (will prompt for GitHub username and Personal Access Token) git push origin main # Or using SSH (if you have SSH keys configured)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Step 3: Push to GitHub
bash # Using HTTPS (will prompt for GitHub username and Personal Access Token) git push origin main # Or using SSH (if you have SSH keys configured)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
This section begins explicit instructions for creating a Personal Access Token and leads directly into generating a classic token with full repo access. In the context of a user-facing skill document, normalizing creation of a broadly privileged credential increases the chance users mint unnecessary high-value secrets that can be stolen, reused, or mishandled.
- Content
md ## Option 3: Create Personal Access Token (if needed) If you don't have a Personal Access Token: 1. Go to: https://github.com/settings/tokens 2. Click "Generate new token (classic)"
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Unlike the other TP4 variants, this one aligns with visible context: the skill points to a remote MCP server over streamable HTTP and exposes only a high-level tool name, while the actual server-side behavior is opaque. That creates a real description-to-behavior risk because a generic remote endpoint can change behavior or expose broader workflow and chat capabilities than the narrow meme-token-analysis description suggests, reducing reviewability and increasing the chance of covert capability expansion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Unlike the other TP4 variants, this one aligns with visible context: the skill points to a remote MCP server over streamable HTTP and exposes only a high-level tool name, while the actual server-side behavior is opaque. That creates a real description-to-behavior risk because a generic remote endpoint can change behavior or expose broader workflow and chat capabilities than the narrow meme-token-analysis description suggests, reducing reviewability and increasing the chance of covert capability expansion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Unlike the other TP4 variants, this one aligns with visible context: the skill points to a remote MCP server over streamable HTTP and exposes only a high-level tool name, while the actual server-side behavior is opaque. That creates a real description-to-behavior risk because a generic remote endpoint can change behavior or expose broader workflow and chat capabilities than the narrow meme-token-analysis description suggests, reducing reviewability and increasing the chance of covert capability expansion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Unlike the other TP4 variants, this one aligns with visible context: the skill points to a remote MCP server over streamable HTTP and exposes only a high-level tool name, while the actual server-side behavior is opaque. That creates a real description-to-behavior risk because a generic remote endpoint can change behavior or expose broader workflow and chat capabilities than the narrow meme-token-analysis description suggests, reducing reviewability and increasing the chance of covert capability expansion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Unlike the other TP4 variants, this one aligns with visible context: the skill points to a remote MCP server over streamable HTTP and exposes only a high-level tool name, while the actual server-side behavior is opaque. That creates a real description-to-behavior risk because a generic remote endpoint can change behavior or expose broader workflow and chat capabilities than the narrow meme-token-analysis description suggests, reducing reviewability and increasing the chance of covert capability expansion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Unlike the other TP4 variants, this one aligns with visible context: the skill points to a remote MCP server over streamable HTTP and exposes only a high-level tool name, while the actual server-side behavior is opaque. That creates a real description-to-behavior risk because a generic remote endpoint can change behavior or expose broader workflow and chat capabilities than the narrow meme-token-analysis description suggests, reducing reviewability and increasing the chance of covert capability expansion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Unlike the other TP4 variants, this one aligns with visible context: the skill points to a remote MCP server over streamable HTTP and exposes only a high-level tool name, while the actual server-side behavior is opaque. That creates a real description-to-behavior risk because a generic remote endpoint can change behavior or expose broader workflow and chat capabilities than the narrow meme-token-analysis description suggests, reducing reviewability and increasing the chance of covert capability expansion.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Unlike the other TP4 variants, this one aligns with visible context: the skill points to a remote MCP server over streamable HTTP and exposes only a high-level tool name, while the actual server-side behavior is opaque. That creates a real description-to-behavior risk because a generic remote endpoint can change behavior or expose broader workflow and chat capabilities than the narrow meme-token-analysis description suggests, reducing reviewability and increasing the chance of covert capability expansion.
- Content
Known Vulnerable Dependency: authlib==1.6.9 — 6 advisory(ies): CVE-2026-41425 (Authlib: Cross-site request forging when using cache); CVE-2026-44681 (Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect); CVE-2026-41479 (Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-co) +3 more
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The project pins authlib==1.6.9 despite multiple cited advisories affecting authorization and redirect handling. If this skill uses OAuth/OIDC flows, those flaws could enable account compromise, token theft, CSRF, or redirect abuse against users or connected services.
- Content
Known Vulnerable Dependency: click==8.3.1 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)
High
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The dependency click==8.3.1 is flagged with a command injection advisory, which is significant if any user-controlled input reaches CLI invocation paths or wrappers built on Click. Even if the skill is not primarily CLI-facing, retaining a pinned vulnerable version creates avoidable risk in tooling, jobs, or maintenance scripts.
- Content