T09 · Insecure Skill Coding Practices
Error
- Location
assets/run-discord.sh:3- Finding
Hardcoded Discord, Telegram, and Master API Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Digen Ai Free
Security checks for vulnerabilities and agentic risk
Overview
The skill’s media-generation purpose is recognizable, but it ships privileged service credentials and unsafe API-key distribution code that users should review before installing.
Do not install this skill in a sensitive environment unless the publisher removes and rotates the exposed bot/master credentials, separates key provisioning from the generation client, fixes secret delivery/storage, restores TLS verification, and makes TinyURL shortening opt-in with clear disclosure.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
assets/discord-bot.py:32- Finding
Issued API Keys Stored in a Plaintext JSON File
- Content
View full analysis
dict: """Load user key mapping from file""" if KEYS_FILE.exists(): try: return json.loads(KEYS_FILE.read_text()) except: return {} return {} def save_user_keys(keys: dict): """Save user key mapping to file""" KEYS_FILE.write_text(json.dumps(keys, indent=2)) ``` ```python user_keys[user_id] = { "api_key": api_key, "discord_name": user_name, "created_at": str(discord.utils.utcnow()) } save_user_keys(user_keys) ``` The Telegram bot implements the same storage pattern: ```python user_keys[user_id] = { "api_key": api_key, "telegram_name": user_name, "created_at": datetime.utcnow().isoformat() } save_user_keys(user_keys) ``` ### Technical Analysis Both bots store every issued API key together with platform user identifiers and names in `assets/user_keys.json`. The data is unencrypted, and the code does not enforce restrictive file permissions. `Path.write_text()` creates or overwrites the file according to the process umask. Depending on deployment configuration, other local accounts, container processes, backup systems, or web-accessible components may be able to read it. The implementation also performs non-atomic read-modify-write operations without file locking, allowing concurrent commands to corrupt or overwrite records. Storing retrievable API keys is necessary for the current `/mykey` and `!mykey` features, but plaintext storage in the Skill directory exceeds the minimum protection appropriate for authentication secrets. ### Attack Path 1. The bot creates `assets/user_keys.json` after issuing a k ...[truncated 752 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
assets/telegram-bot.py:143- Finding
API Keys Disclosed to Public Chats When Direct Messaging Fails
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/digen_ai_client.py:330- Finding
TLS Certificate Verification Disabled for Credential-Bearing API Requests
- Content
View full analysis
Dict: """Old API request""" url = f"{OLD_API_BASE}{endpoint}" try: if method.upper() == "GET": resp = requests.get( url, headers=self._old_headers(), params=data or {}, timeout=30, verify=False ) else: resp = requests.post( url, headers=self._old_headers(), json=data or {}, timeout=60, verify=False ) return resp.json() ``` The headers contain both legacy credentials: ```python def _old_headers(self) -> Dict[str, str]: return { "Content-Type": "application/json", "DIGEN-Token": self.old_token, "DIGEN-SessionID": self.old_session, "Referer": "https://digen.ai/", "Origin": "https://digen.ai", } ``` The same weakness exists in the status-check helper: ```python resp = requests.post( f"{OLD_API_BASE}/v6/video/get_task_v2", headers={ "DIGEN-Token": token, "DIGEN-SessionID": session_id, "Referer": "https://digen.ai/", "Origin": "https://digen.ai", "Content-Type": "application/json", }, json={"jobID": "test"}, timeout=10, verify=False ) ``` ### Technical Analysis `verify=False` disables validation of the remote server’s TLS certificate. The client still encrypts traffic, but it no longer establishes that it is communicating with the legitimate `api.digen.ai` server. Suppressing `InsecureRequestWarning` conceals the unsafe conf ...[truncated 1215 chars]- Remediation
View remediation
other
Warning
- Location
scripts/digen_ai_client.py:103- Finding
Generated Video URLs Automatically Disclosed to TinyURL
- Content
View full analysis
Optional[str]: """Convert a long URL to a short URL (TinyURL)""" if not url: return None try: resp = requests.get( f"https://tinyurl.com/api-create.php?url={requests.utils.quote(url)}", timeout=10 ) if resp.status_code == 200 and resp.text.startswith("https://"): return resp.text return url except Exception: return url ``` The method is invoked automatically when a completed video status is processed: ```python return { "success": True, "id": result.get("id"), "status": result.get("status"), "progress": result.get("progress", 0), "video_url": result.get("output", {}).get("video_url"), "video_url_short": self._shorten_url( result.get("output", {}).get("video_url") ), "thumbnail_url": result.get("output", {}).get("thumbnail_url"), "error": result.get("error"), "created_at": result.get("created_at"), "completed_at": result.get("completed_at"), } ``` ### Technical Analysis Checking video status automatically sends the complete generated-video URL to `tinyurl.com`. URL shortening is not required to generate a video or retrieve its status, and `SKILL.md` does not disclose that generated-media URLs are shared with this additional third party. Generated URLs may identify private content or contain signed query parameters, object identifiers, expiration data, or bearer-like access values. Submitting them to a shortening provider gives that provider the complete destination URL along with client IP and request timing metadata. ### Attack Path 1. A user submits a video-generation task. 2. DigenAI returns a completed task containing a video URL. 3. `get ...[truncated 730 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/batch_generate.py:14- Finding
Legacy API Credentials Passed Through Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (59)
Tainted flow: 'MASTER_API_KEY' from os.getenv (line 30, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def create_api_key() -> str: """Create a new API key using master key""" try: r = requests.post( f"{API_BASE}/b/v1/api-key/create", headers={"Authorization": f"Bearer {MASTER_API_KEY}"}, timeout=30
Tainted flow: 'MASTER_API_KEY' from os.getenv (line 31, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def create_api_key() -> str: """Create a new API key using master key""" try: r = requests.post( f"{API_BASE}/b/v1/api-key/create", headers={"Authorization": f"Bearer {MASTER_API_KEY}"}, timeout=30
Tainted flow: 'api_key' from os.getenv (line 520, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python GET /b/v1/api-key """ try: resp = requests.get( f"{NEW_API_BASE}/b/v1/api-key", headers={"Authorization": f"Bearer {api_key}"}, timeout=10
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Creating and distributing API keys, storing user-to-key mappings, and using a master API key are materially different from performing media generation. Bundling those provisioning functions into a user-facing skill increases the blast radius of compromise and could expose sensitive issuance workflows or user records to an environment that only needed generation access.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file's stated purpose is API-key distribution via Discord, which materially differs from the skill metadata claiming image/video generation functionality. That mismatch is dangerous because it introduces credential brokerage behavior not justified by the declared skill purpose, increasing the chance of unauthorized key issuance, abuse of paid backend resources, and deceptive installation expectations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
If DM delivery fails in
mykey, the exception handler sends the embed containing the full API key back to the invoking channel, which may be public. That can immediately expose a user's credential to other channel members, enabling misuse of their quota or impersonation against the upstream API.- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </style> </head> <body> <!-- Nav --> <nav class="nav"> <a href="#" class="nav-brand"> <div class="nav-logo">⚡</div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </section> <!-- Commands --> <section class="commands" id="commands"> <div class="section-header"> <h2 data-i18n="commands.title">Supported Commands</h2>
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes and exports a Discord bot token and a master API key directly in plaintext. Anyone with access to the repository, skill package, logs, or copied script can extract these credentials and use them to impersonate the bot, access associated services, or consume privileged APIs without authorization. In this skill context, the danger is heightened because the keys appear to grant access to external messaging and generation infrastructure, which could enable account takeover, abuse of paid services, spam, or further compromise.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes and exports a Telegram bot token and a master API key, then launches a Telegram bot from within the skill bundle. This creates immediate credential exposure and introduces remote bot-control functionality unrelated to the declared image/video generation purpose, which materially increases the likelihood of unauthorized access, account abuse, and covert command-and-control behavior.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Exporting sensitive credentials directly in a shipped shell script exposes them to anyone with file access and to child processes, with no warning to the user. In this skill's context, the undisclosed presence of operational secrets is especially dangerous because users would not expect credentialed external-service access to be embedded in a local helper script.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script directly exports a Telegram bot token and a master API key in plaintext, exposing highly sensitive credentials to anyone with file access and to downstream processes. Hard-coded secrets are easily leaked through source control, logs, process inspection, or redistribution of the skill package, enabling account takeover and abuse of external services.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements a Telegram bot for API-key distribution, while the skill metadata describes an image/video generation capability. This mismatch is dangerous because it introduces credential-issuance behavior into a skill context where users may not expect account provisioning or secret handling, increasing the risk of abuse and undisclosed data flows.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A hardcoded fallback master API key is embedded directly in source code. Anyone with access to the repository, package, logs, or deployed artifact could extract it and mint arbitrary user keys, resulting in full compromise of the associated API account and potentially unbounded abuse.
- Content
Tainted flow: 'data' from open (line 385, file read) → requests.get (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python timeout=60 ) elif method.upper() == "GET": resp = requests.get(url, headers=self._new_headers(), params=data or {}, timeout=30) else: resp = requests.request(method, url,
Tainted flow: 'data' from open (line 385, file read) → requests.get (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python url = f"{OLD_API_BASE}{endpoint}" try: if method.upper() == "GET": resp = requests.get(url, headers=self._old_headers(), params=data or {}, timeout=30, verify=False) else: resp = requests.post(url, headers=self._old_headers(),
Tainted flow: 'data' from open (line 385, file read) → requests.post (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python resp = requests.get(url, headers=self._old_headers(), params=data or {}, timeout=30, verify=False) else: resp = requests.post(url, headers=self._old_headers(), json=data or {}, timeout=60, verify=False) return resp.json() except requests.exceptions.RequestException as e:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 78% confidence
- Finding
The skill advertises code-capable components and external scripts that appear to require environment access, file operations, network access, and possibly shell execution, yet it declares no explicit tool scope or permissions. In an agent environment, this can result in over-privileged execution and make it harder to review or constrain what the skill is allowed to do.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Broad trigger phrases like 'generate image', 'generate video', or 'Digen AI' can cause accidental or overly frequent invocation, especially in conversational systems where similar phrases arise naturally. Unintended activation can lead to surprise network calls, external data transmission, and unexpected credit consumption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill documents image upload and remote generation against third-party APIs but does not prominently warn that prompts, images, and possibly metadata will be transmitted to external services. This is dangerous from a privacy and data-governance perspective because users may unknowingly send sensitive content off-platform.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code implements account interaction, persistent user tracking, and API-key provisioning rather than the advertised generation capability. In skill context, unrelated credential-issuance logic is riskier because users and reviewers may not expect storage of Discord identifiers and distribution of reusable API secrets.
- Content