AnthroVision Telegram Body Scan

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:33 PM UTC
• Version: 1.0.4

Overview

The skill is a narrowly scoped Telegram body-scan workflow that discloses video processing and requires consent, though users should be cautious with sensitive body videos and external URLs.

Install only if you are comfortable sending body-scan videos and related measurements to the AnthroVision bridge. Prefer Telegram attachments over arbitrary external video URLs, and avoid submitting videos of other people unless they have clearly consented.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14

Finding

Incomplete URL Validation May Permit Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-20
Vulnerability Type: Incomplete validation of user-controlled remote URLs
Risk Level: Medium

markdown

- `video` attachment (or downloadable `https://` video URL)
- `phone_model` (for example `iPhone 13 Pro Max`)

## Workflow

1. Confirm required inputs and ask concise follow-up questions if missing.
2. Ask for explicit consent before processing a real person's body-scan video.
3. Never ask users for local file paths (`/Users/...`, `file://...`, `./...`).
4. Reject private/local URLs (`localhost`, `127.0.0.1`, RFC1918/private subnets).
5. Call `anthrovision_bridge_submit_scan`.

Technical Analysis

The skill permits a user to provide a downloadable HTTPS video URL and then passes the scan request to anthrovision_bridge_submit_scan. Its documented validation rejects only localhost, 127.0.0.1, and RFC1918/private subnets.

This denylist is incomplete. It does not explicitly cover:

• IPv4 link-local addresses such as 169.254.0.0/16.
• IPv6 loopback, unique-local, and link-local addresses.
• Alternative numeric representations of IP addresses.
• Hostnames that resolve to restricted addresses.
• DNS rebinding between validation and connection.
• HTTP redirects whose destination is a restricted address.
• URL parser discrepancies or embedded credentials.
• Reserved, unspecified, multicast, and other non-public address ranges.

If the bridge downloads the supplied URL without stronger server-side controls, this creates a server-side request forgery boundary. Instruction-level validation by the Agent is not a reliable replacement for validation and network restrictions in the component that performs the request.

Attack Path

1. An attacker submits the required body-scan fields and supplies a crafted HTTPS video URL.
2. The URL uses an address form not covered by the documented denylist, a public hostname resolving to a restricted address, or a redirect to an internal des ...[truncated 1331 chars]

Remediation

View remediation

Remediation Suggestions

• Enforce URL validation inside the AnthroVision bridge or downloader rather than relying solely on natural-language Agent instructions.
• Prefer Telegram attachment identifiers and trusted platform-hosted media over arbitrary external URLs.
• If external URLs are required, allow only HTTPS with explicitly permitted ports and reject URL-embedded credentials.
• Resolve the hostname before connecting and reject every loopback, private, link-local, reserved, multicast, unspecified, and otherwise non-public IPv4 or IPv6 address.
• Validate the actual connected IP address to prevent DNS rebinding and time-of-check/time-of-use bypasses.
• Disable redirects where possible. If redirects are necessary, apply the full validation process to every redirect target and enforce a small redirect limit.
• Use a single standards-compliant URL parser and normalize hosts before validation to prevent alternate numeric-address and parser-confusion bypasses.
• Apply network-level egress controls that prevent the downloader from connecting to internal and metadata networks.
• Restrict accepted content types, maximum response size, download duration, and number of bytes read.
• Verify that downloaded content is a supported video before submitting it for processing.
• Avoid returning raw upstream response bodies, internal error details, or sensitive headers to the user.
• Add automated tests for IPv4, IPv6, DNS resolution, redirect, link-local, alternate-address, and oversized-download bypass cases.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

1. Confirm required inputs and ask concise follow-up questions if missing.
2. Ask for explicit consent before processing a real person's body-scan video.
3. Never ask users for local file paths (`/Users/...`, `file://...`, `./...`).
4. Reject private/local URLs (`localhost`, `127.0.0.1`, RFC1918/private subnets).
5. Call `anthrovision_bridge_submit_scan`.
6. Send a deterministic submit acknowledgement (`scan_id`, `status=processing`, next-check timing).

Static analysis

No suspicious patterns detected.