Security audit

ous-upload

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can upload any readable local file to a caller-supplied storage domain with a token, without enough built-in scoping or confirmation safeguards.

Install only if you trust the workflow and will use it with explicit, user-chosen files and known OUS domains. Treat ousToken as a secret, avoid sensitive files such as keys, env files, credentials, or private configs, and confirm the exact path and destination before any upload.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:19
Finding: Unvalidated Upload Destination and Unrestricted Local File Selection
Content: View full analysis
` ``` ### Technical Analysis The workflow accepts both an absolute local file path and a caller-supplied `globalDomain`. It does not require the destination to use HTTPS, belong to an approved domain allowlist, or remain approved after redirects. It also does not restrict the selected file to an authorized workspace, resolve and validate symbolic links, reject sensitive file types, or require confirmation before reading and uploading the file. Consequently, an attacker who can influence the skill inputs may direct the agent to read any file available under the agent process's existing permissions and transmit its contents to an attacker-controlled upload service. The `ous-token-v2` credential would also be sent to that destination, potentially exposing both local data and an active service token. This issue does not independently grant operating-system privileges beyond those already held by the agent. Its severity arises from crossing two insufficiently validated trust boundaries: the local filesystem boundary and the outbound network boundary. ### Attack Path 1. An attacker influences the skill invocation, such as through prompt injecti ...[truncated 1442 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
这个 skill 是纯 `SKILL.md` 工作流，不依赖任何预置上传脚本。执行上传时，由 agent 自己读取文件内容、分析文件大小、计算 MD5、在必要时按 `blockSize` 拆分文件、依次调用 OUS V2 接口并轮询状态；只有在上传进入成功终态后，才返回最终的 `url` 和 `uploadKey`。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is explicitly designed to upload local files to a remote object storage service and requires transmission of an authentication-bearing token, but it provides no user-facing consent, sensitivity warning, or guardrails about what kinds of local files are safe to send. In an agent setting, this increases the risk of unintended exfiltration of sensitive local data or misuse of the provided token, especially because the skill accepts arbitrary local paths and prioritizes completing the upload flow automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow instructs the agent to read the file, compute its full MD5, and potentially split it into chunks before upload, but it never tells the user that local file contents will be accessed and processed even before transmission. This matters because hashing and chunking still expose sensitive local data to the agent runtime and can violate user expectations if the path refers to confidential material.
Content: No source excerpt is available for this finding.