Digen Ai Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.3.0

Overview

The skill’s media-generation purpose is recognizable, but it ships privileged service credentials and unsafe API-key distribution code that users should review before installing.

Do not install this skill in a sensitive environment unless the publisher removes and rotates the exposed bot/master credentials, separates key provisioning from the generation client, fixes secret delivery/storage, restores TLS verification, and makes TinyURL shortening opt-in with clear disclosure.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/run-discord.sh:3
• Finding: Hardcoded Discord, Telegram, and Master API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `assets/run-discord.sh:3-4`, `assets/run-telegram-bot.sh:2-3`, `assets/run-tg.sh:3-4`, `assets/discord-bot.py:29-30`, `assets/telegram-bot.py:30-31` **Vulnerability Type**: Hardcoded authentication credentials **Risk Level**: Critical ### Vulnerable Code ```bash # assets/run-discord.sh export DISCORD_BOT_TOKEN="MTQ5MTcyMzg5NjA5MTcwOTQ4MA.GsDWKB.41EEu1ILpYUd1HNEfTrL1sN_Z2saG8fBls4lxk" export MASTER_API_KEY="ak_2f81a7774dc7445a9244d3f61d5a9a989c25dbfef09dfb4c868c372260722f93" ``` ```bash # assets/run-telegram-bot.sh and assets/run-tg.sh export TELEGRAM_BOT_TOKEN="8697590926:AAHH6uQ2Zioj3kUFNd23B5C5q0L6wUIt7f4" export MASTER_API_KEY="ak_2f81a7774dc7445a9244d3f61d5a9a989c25dbfef09dfb4c868c372260722f93" ``` ```python # assets/discord-bot.py API_BASE = "https://api.cowork.digen.ai" MASTER_API_KEY = os.getenv( "MASTER_API_KEY", "ak_2f81a7774dc7445a9244d3f61d5a9a989c25dbfef09dfb4c868c372260722f93" ) ``` ```python # assets/telegram-bot.py API_BASE = "https://api.cowork.digen.ai" MASTER_API_KEY = os.getenv( "MASTER_API_KEY", "ak_2f81a7774dc7445a9244d3f61d5a9a989c25dbfef09dfb4c868c372260722f93" ) ``` ### Technical Analysis The package contains usable-looking Discord and Telegram bot tokens and a privileged master API key. The master key remains exposed even when the launch scripts are not used because both bot implementations define it as the default value when `MASTER_API_KEY` is absent. These secrets are available to every person or automated system that can download or inspect the Skill. Environment-variable support does not mitigate the issue when a working secret is also embedded as a fallback. The bots use the master key as a Bearer credential for: ```python r = requests.post( f"{API_BASE}/b/v1/api-key/create", headers={"Authorization": f"Bearer {MASTER_API_KEY}"}, timeout=30 ) ``` Consequently, compromise of the master key may grant the ability to create additional user API ...[truncated 954 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed Discord token, Telegram token, and master API key. 2. Review provider-side access and issuance logs for use of the exposed credentials. 3. Remove all credentials from the current files and repository history. 4. Remove hardcoded fallback values: ```python MASTER_API_KEY = os.getenv("MASTER_API_KEY") if not MASTER_API_KEY: raise RuntimeError("MASTER_API_KEY is required") ``` 5. Obtain production secrets from a dedicated secret manager or protected runtime environment. 6. Ensure launch scripts reference environment variables without assigning secret values. 7. Add secret scanning to development and release pipelines. 8. Restrict the master key to only the key-creation permission, impose issuance quotas, and support rapid revocation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: assets/discord-bot.py:32
• Finding: Issued API Keys Stored in a Plaintext JSON File<![CDATA[ ## Vulnerability Details **File Location**: `assets/discord-bot.py:32-46, 123-129`; `assets/telegram-bot.py:33-47, 118-124` **Vulnerability Type**: Plaintext sensitive-data storage with no enforced access controls **Risk Level**: High ### Vulnerable Code ```python # assets/discord-bot.py KEYS_FILE = Path(__file__).parent / "user_keys.json" def load_user_keys() -> dict: """Load user key mapping from file""" if KEYS_FILE.exists(): try: return json.loads(KEYS_FILE.read_text()) except: return {} return {} def save_user_keys(keys: dict): """Save user key mapping to file""" KEYS_FILE.write_text(json.dumps(keys, indent=2)) ``` ```python user_keys[user_id] = { "api_key": api_key, "discord_name": user_name, "created_at": str(discord.utils.utcnow()) } save_user_keys(user_keys) ``` The Telegram bot implements the same storage pattern: ```python user_keys[user_id] = { "api_key": api_key, "telegram_name": user_name, "created_at": datetime.utcnow().isoformat() } save_user_keys(user_keys) ``` ### Technical Analysis Both bots store every issued API key together with platform user identifiers and names in `assets/user_keys.json`. The data is unencrypted, and the code does not enforce restrictive file permissions. `Path.write_text()` creates or overwrites the file according to the process umask. Depending on deployment configuration, other local accounts, container processes, backup systems, or web-accessible components may be able to read it. The implementation also performs non-atomic read-modify-write operations without file locking, allowing concurrent commands to corrupt or overwrite records. Storing retrievable API keys is necessary for the current `/mykey` and `!mykey` features, but plaintext storage in the Skill directory exceeds the minimum protection appropriate for authentication secrets. ### Attack Path 1. The bot creates `assets/user_keys.json` after issuing a k ...[truncated 752 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store secrets in a protected database or dedicated secret-management service rather than in the Skill directory. 2. Encrypt API keys at rest using a key held separately from the database. 3. If file storage must temporarily remain, create the file with mode `0600`, verify ownership, and reject insecure permissions. 4. Use atomic replacement and inter-process locking to prevent corruption during concurrent requests. 5. Minimize stored personal data and define a retention and deletion policy. 6. Prefer a key-reset or single-use retrieval workflow over indefinitely retaining retrievable plaintext keys. 7. Add key revocation and rotation capabilities for any exposed storage. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: assets/telegram-bot.py:143
• Finding: API Keys Disclosed to Public Chats When Direct Messaging Fails<![CDATA[ ## Vulnerability Details **File Location**: `assets/telegram-bot.py:143-149`; `assets/discord-bot.py:180-186` **Vulnerability Type**: Authentication-secret disclosure through insecure fallback behavior **Risk Level**: High ### Vulnerable Code ```python # assets/telegram-bot.py except Exception as e: logger.error(f"Failed to send DM: {e}") # If DM fails, send in chat but warn await msg.edit_text( f"⚠️ Could not send DM. Here's your key:\n\n" f"```\n{api_key}\n```\n\n" f"⚠️ Warning: For privacy, consider enabling DM and using /key again.", parse_mode="Markdown" ) ``` ```python # assets/discord-bot.py # Send via DM for privacy try: dm_channel = await ctx.author.create_dm() await dm_channel.send(embed=embed) await ctx.send("📬 Check your DM for your API key!") except: await ctx.send(embed=embed) ``` The Discord `embed` includes the API key: ```python embed.add_field( name="API Key", value=f"```\n{api_key}\n```", inline=False ) ``` ### Technical Analysis Both bots state that keys are sent privately, but they publish secrets into the command’s originating chat when private delivery fails. In a Telegram group or Discord server channel, that fallback message may be visible to all members, moderators, logging bots, integrations, and notification systems. Warning users after publishing a secret does not restore confidentiality. The broad exception handling also means transient platform failures can unexpectedly trigger the public disclosure path. ### Attack Path 1. A user invokes `/key` in a Telegram group or `!mykey` in a Discord server channel. 2. Direct-message delivery fails because of privacy settings, platform errors, blocked bots, or missing private-chat initialization. 3. The exception handler publishes an embed or message containing the complete API key in the original channel. 4. Another member or automated logging integration captures the key. 5. The observer reuses ...[truncated 431 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never place an API key in a public or group-channel fallback response. 2. If private delivery fails, return only a generic message instructing the user to enable DMs or start a private conversation. 3. Restrict key-generation and key-retrieval commands to private chats where supported. 4. Consider issuing a short-lived, single-use retrieval link bound to the requesting platform account. 5. Revoke any key whose delivery status is uncertain rather than exposing it through another channel. 6. Replace broad exception handlers with specific platform exceptions and secure failure behavior. 7. Add automated tests proving that no failure path sends credential material to a group or server channel. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/digen_ai_client.py:330
• Finding: TLS Certificate Verification Disabled for Credential-Bearing API Requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/digen_ai_client.py:16, 330-336, 451-461` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) ``` ```python def _old_request(self, method: str, endpoint: str, data: Optional[Dict] = None) -> Dict: """Old API request""" url = f"{OLD_API_BASE}{endpoint}" try: if method.upper() == "GET": resp = requests.get( url, headers=self._old_headers(), params=data or {}, timeout=30, verify=False ) else: resp = requests.post( url, headers=self._old_headers(), json=data or {}, timeout=60, verify=False ) return resp.json() ``` The headers contain both legacy credentials: ```python def _old_headers(self) -> Dict[str, str]: return { "Content-Type": "application/json", "DIGEN-Token": self.old_token, "DIGEN-SessionID": self.old_session, "Referer": "https://digen.ai/", "Origin": "https://digen.ai", } ``` The same weakness exists in the status-check helper: ```python resp = requests.post( f"{OLD_API_BASE}/v6/video/get_task_v2", headers={ "DIGEN-Token": token, "DIGEN-SessionID": session_id, "Referer": "https://digen.ai/", "Origin": "https://digen.ai", "Content-Type": "application/json", }, json={"jobID": "test"}, timeout=10, verify=False ) ``` ### Technical Analysis `verify=False` disables validation of the remote server’s TLS certificate. The client still encrypts traffic, but it no longer establishes that it is communicating with the legitimate `api.digen.ai` server. Suppressing `InsecureRequestWarning` conceals the unsafe conf ...[truncated 1215 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every `verify=False` argument and use Requests' default certificate validation. 2. Remove global suppression of `InsecureRequestWarning`. 3. If the service uses a private certificate authority, configure a narrowly scoped and securely distributed CA bundle instead of disabling validation. 4. Consider certificate or public-key pinning only if the service has a safe pin-rotation process. 5. Rotate legacy tokens and session IDs that may have traversed untrusted networks. 6. Add tests that fail when production API requests disable certificate verification. 7. Document proxy and CA configuration rather than encouraging insecure TLS bypasses. ]]>

other

Warning

• Location: scripts/digen_ai_client.py:103
• Finding: Generated Video URLs Automatically Disclosed to TinyURL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/digen_ai_client.py:103-112, 296` **Vulnerability Type**: Unnecessary third-party disclosure of generated-media URLs **Risk Level**: Medium ### Vulnerable Code ```python def _shorten_url(self, url: str) -> Optional[str]: """Convert a long URL to a short URL (TinyURL)""" if not url: return None try: resp = requests.get( f"https://tinyurl.com/api-create.php?url={requests.utils.quote(url)}", timeout=10 ) if resp.status_code == 200 and resp.text.startswith("https://"): return resp.text return url except Exception: return url ``` The method is invoked automatically when a completed video status is processed: ```python return { "success": True, "id": result.get("id"), "status": result.get("status"), "progress": result.get("progress", 0), "video_url": result.get("output", {}).get("video_url"), "video_url_short": self._shorten_url( result.get("output", {}).get("video_url") ), "thumbnail_url": result.get("output", {}).get("thumbnail_url"), "error": result.get("error"), "created_at": result.get("created_at"), "completed_at": result.get("completed_at"), } ``` ### Technical Analysis Checking video status automatically sends the complete generated-video URL to `tinyurl.com`. URL shortening is not required to generate a video or retrieve its status, and `SKILL.md` does not disclose that generated-media URLs are shared with this additional third party. Generated URLs may identify private content or contain signed query parameters, object identifiers, expiration data, or bearer-like access values. Submitting them to a shortening provider gives that provider the complete destination URL along with client IP and request timing metadata. ### Attack Path 1. A user submits a video-generation task. 2. DigenAI returns a completed task containing a video URL. 3. `get ...[truncated 730 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic URL shortening from `get_video_status()`. 2. Return only the original service URL by default. 3. If shortening is retained, make it an explicit opt-in operation that clearly names the external provider. 4. Warn users that the destination URL and related metadata will be disclosed to a third party. 5. Reject shortening for URLs containing signed query strings, credentials, private hostnames, or other sensitive parameters. 6. Prefer a first-party shortening service with documented retention controls if short URLs are operationally necessary. 7. Document the behavior and applicable privacy policy in `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/batch_generate.py:14
• Finding: Legacy API Credentials Passed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/batch_generate.py:14-15`; `scripts/wait_batch.py:15-16` **Vulnerability Type**: Sensitive information exposed through process arguments **Risk Level**: Medium ### Vulnerable Code ```python # scripts/batch_generate.py parser = argparse.ArgumentParser(description="DigenAI batch generation tool") parser.add_argument("token", help="DIGEN_TOKEN") parser.add_argument("session_id", help="DIGEN_SESSION_ID") ``` ```python args = parser.parse_args() client = DigenAIClient(token=args.token, session_id=args.session_id) ``` ```python # scripts/wait_batch.py parser = argparse.ArgumentParser(description="DigenAI batch result polling") parser.add_argument("token", help="DIGEN_TOKEN") parser.add_argument("session_id", help="DIGEN_SESSION_ID") parser.add_argument("input", help="Task file generated by batch_generate.py") ``` ```python args = parser.parse_args() client = DigenAIClient(token=args.token, session_id=args.session_id) ``` ### Technical Analysis The batch tools require authentication credentials as positional command-line arguments. Command arguments commonly appear in shell history, process listings, job-control interfaces, audit logs, crash reports, CI logs, and monitoring telemetry. On systems where process arguments are visible to other users or containers, an attacker can recover the token and session ID while the script is running. Even after execution, shell history or orchestration logs may preserve them. ### Attack Path 1. A user runs a command such as: ```bash python batch_generate.py TOKEN SESSION_ID --prompts "example" ``` 2. The shell records the command, or the operating system exposes it through process inspection. 3. Another local user, monitoring agent, CI operator, or log reader retrieves the arguments. 4. The observer extracts the token and session ID. 5. The observer uses the credentials to authenticate to the legacy DigenAI API. ### Impact Assessment An attacker may o ...[truncated 344 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Read `DIGEN_TOKEN` and `DIGEN_SESSION_ID` from protected environment variables or a secret manager. 2. Alternatively, request credentials using `getpass.getpass()` when interactive input is appropriate. 3. Remove credential positional arguments from both command-line interfaces. 4. Ensure error messages and debug output never print secret values. 5. Configure CI/CD systems to inject masked secrets and prevent command echoing. 6. Rotate credentials previously used in command lines if shell history or job logs may have retained them. 7. Update documentation and examples to use secure credential injection. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (59)

Tainted flow: 'MASTER_API_KEY' from os.getenv (line 30, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def create_api_key() -> str:
    """Create a new API key using master key"""
    try:
        r = requests.post(
            f"{API_BASE}/b/v1/api-key/create",
            headers={"Authorization": f"Bearer {MASTER_API_KEY}"},
            timeout=30

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'MASTER_API_KEY' from os.getenv (line 31, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def create_api_key() -> str:
    """Create a new API key using master key"""
    try:
        r = requests.post(
            f"{API_BASE}/b/v1/api-key/create",
            headers={"Authorization": f"Bearer {MASTER_API_KEY}"},
            timeout=30

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'api_key' from os.getenv (line 520, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

GET /b/v1/api-key
    """
    try:
        resp = requests.get(
            f"{NEW_API_BASE}/b/v1/api-key",
            headers={"Authorization": f"Bearer {api_key}"},
            timeout=10

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file's stated purpose is API-key distribution via Discord, which materially differs from the skill metadata claiming image/video generation functionality. That mismatch is dangerous because it introduces credential brokerage behavior not justified by the declared skill purpose, increasing the chance of unauthorized key issuance, abuse of paid backend resources, and deceptive installation expectations.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: If DM delivery fails in `mykey`, the exception handler sends the embed containing the full API key back to the invoking channel, which may be public. That can immediately expose a user's credential to other channel members, enabling misuse of their quota or impersonation against the upstream API.

Hidden Instructions

High

• Category: Prompt Injection

Content

</style>
</head>
<body>
    <!-- Nav -->
    <nav class="nav">
        <a href="#" class="nav-brand">
            <div class="nav-logo">⚡</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
    </section>

    <!-- Commands -->
    <section class="commands" id="commands">
        <div class="section-header">
            <h2 data-i18n="commands.title">Supported Commands</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script hardcodes and exports a Discord bot token and a master API key directly in plaintext. Anyone with access to the repository, skill package, logs, or copied script can extract these credentials and use them to impersonate the bot, access associated services, or consume privileged APIs without authorization. In this skill context, the danger is heightened because the keys appear to grant access to external messaging and generation infrastructure, which could enable account takeover, abuse of paid services, spam, or further compromise.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes and exports a Telegram bot token and a master API key, then launches a Telegram bot from within the skill bundle. This creates immediate credential exposure and introduces remote bot-control functionality unrelated to the declared image/video generation purpose, which materially increases the likelihood of unauthorized access, account abuse, and covert command-and-control behavior.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Exporting sensitive credentials directly in a shipped shell script exposes them to anyone with file access and to child processes, with no warning to the user. In this skill's context, the undisclosed presence of operational secrets is especially dangerous because users would not expect credentialed external-service access to be embedded in a local helper script.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script directly exports a Telegram bot token and a master API key in plaintext, exposing highly sensitive credentials to anyone with file access and to downstream processes. Hard-coded secrets are easily leaked through source control, logs, process inspection, or redistribution of the skill package, enabling account takeover and abuse of external services.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a Telegram bot for API-key distribution, while the skill metadata describes an image/video generation capability. This mismatch is dangerous because it introduces credential-issuance behavior into a skill context where users may not expect account provisioning or secret handling, increasing the risk of abuse and undisclosed data flows.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A hardcoded fallback master API key is embedded directly in source code. Anyone with access to the repository, package, logs, or deployed artifact could extract it and mint arbitrary user keys, resulting in full compromise of the associated API account and potentially unbounded abuse.

Tainted flow: 'data' from open (line 385, file read) → requests.get (network output)

High

• Category: Data Flow

Content

timeout=60
                )
            elif method.upper() == "GET":
                resp = requests.get(url, headers=self._new_headers(),
                                    params=data or {}, timeout=30)
            else:
                resp = requests.request(method, url,

• Confidence: 80% confidence
• Finding: File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Tainted flow: 'data' from open (line 385, file read) → requests.get (network output)

High

• Category: Data Flow

Content

url = f"{OLD_API_BASE}{endpoint}"
        try:
            if method.upper() == "GET":
                resp = requests.get(url, headers=self._old_headers(),
                                   params=data or {}, timeout=30, verify=False)
            else:
                resp = requests.post(url, headers=self._old_headers(),

• Confidence: 80% confidence
• Finding: File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Tainted flow: 'data' from open (line 385, file read) → requests.post (network output)

High

• Category: Data Flow

Content

resp = requests.get(url, headers=self._old_headers(),
                                   params=data or {}, timeout=30, verify=False)
            else:
                resp = requests.post(url, headers=self._old_headers(),
                                    json=data or {}, timeout=60, verify=False)
            return resp.json()
        except requests.exceptions.RequestException as e:

• Confidence: 80% confidence
• Finding: File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence
• Finding: The skill advertises code-capable components and external scripts that appear to require environment access, file operations, network access, and possibly shell execution, yet it declares no explicit tool scope or permissions. In an agent environment, this can result in over-privileged execution and make it harder to review or constrain what the skill is allowed to do.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Broad trigger phrases like 'generate image', 'generate video', or 'Digen AI' can cause accidental or overly frequent invocation, especially in conversational systems where similar phrases arise naturally. Unintended activation can lead to surprise network calls, external data transmission, and unexpected credit consumption.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill documents image upload and remote generation against third-party APIs but does not prominently warn that prompts, images, and possibly metadata will be transmitted to external services. This is dangerous from a privacy and data-governance perspective because users may unknowingly send sensitive content off-platform.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This code implements account interaction, persistent user tracking, and API-key provisioning rather than the advertised generation capability. In skill context, unrelated credential-issuance logic is riskier because users and reviewers may not expect storage of Discord identifiers and distribution of reusable API secrets.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: assets/run-discord.sh:4

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: assets/run-telegram-bot.sh:3

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: assets/run-tg.sh:4

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:35

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/digen_ai_client.py:331