T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pixiv.py:446- Finding
OAuth Bearer Token May Be Disclosed to an Unvalidated Download Host
- Content
View full analysis
- Remediation
View remediation
Security audit
pixiv-skill
Security checks for vulnerabilities and agentic risk
Overview
This Pixiv skill is broadly aligned with Pixiv automation, but its account credential handling is inconsistent and includes a real risk of exposing OAuth tokens during image downloads.
Review before installing. Do not put Pixiv cookies or OAuth tokens in a shared repository or broad workspace, treat config.yaml as a secret file, and avoid download/like/follow/monitor commands unless you are comfortable with authenticated Pixiv account actions. The publisher should align the authentication model, remove or fix disabled login paths, avoid sending bearer tokens to image hosts, pin dependencies, and add explicit confirmation guidance for account-changing actions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_rank.py:15- Finding
Pixiv Session Cookie Is Stored and Read from a Plaintext Configuration File
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unpinned and Unnecessary Dependencies Increase Supply-Chain Exposure
- Content
View full analysis
=2.31.0 PyYAML>=6.0 beautifulsoup4>=4.12.2 tqdm>=4.65.0 Pillow>=10.0.0 fake-useragent>=1.4.0 aiohttp>=3.8.6 asyncio>=3.4.3 pycryptodome>=3.19.0 qrcode>=7.4.2 ``` ### Technical Analysis Every dependency uses a lower-bound-only version constraint. This permits package managers to install any future release, including versions that have not been reviewed with this project. No lock file or package hashes are provided, so installations are not reproducible and package integrity is not pinned to reviewed artifacts. The audited scripts import only a subset of the listed packages. Unused dependencies unnecessarily increase the number of publishers, package releases, build scripts, and transitive dependencies trusted during installation. The explicit `asyncio` dependency is particularly unnecessary for supported Python 3 versions because `asyncio` is part of the Python standard library. Installing a third-party package with the same name increases ambiguity and avoidable supply-chain exposure. This finding does not establish that any listed package is currently malicious. The risk arises from unconstrained future resolution and installation of components not required by the audited implementation. ### Attack Path 1. A user installs the project dependencies with `pip install -r requirements.txt`. 2. The package resolver selects the latest versions satisfying the lower-bound constraints. 3. A future release, compromised maintainer account, malicious distribution artifact, or vulnerable transitive dependency enters the permitted version range. 4. The unreviewed package is downloaded and installed. 5. Malicious installation hooks or imported runtime code execute with the privileges of the user performing the installation or running the Skill. # ...[truncated 453 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented security model says the skill uses only Cookie authentication and does not perform automatic login, while the referenced behavior reportedly uses OAuth bearer tokens and token-refresh/login scaffolding for authenticated actions. This mismatch is dangerous because operators may trust a narrower credential model than what the code actually exercises, leading to accidental exposure of more powerful tokens, unexpected account actions, and weakened review of the real auth path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to store a live Pixiv authentication cookie directly in a local config file, but does not warn that the cookie is a sensitive credential equivalent to an authenticated session token. This increases the risk of accidental disclosure through source control, logs, backups, screenshots, or file sharing, which could allow unauthorized account access and misuse of Pixiv actions such as viewing, downloading, liking, bookmarking, or following on behalf of the user.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 81% confidence
- Finding
The skill documentation exposes capabilities that imply file access, shell execution, and network operations, but it does not declare any tool scope restrictions such as allowed-tools or permissions. In an agent environment, that omission weakens containment and can let the skill be invoked with broader capabilities than users or orchestrators expect, increasing the chance of unintended file/system/network actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to place a live Pixiv cookie in config.yaml but does not explicitly warn that this is a sensitive credential equivalent to account access. In agent or shared workspace contexts, such credentials can be exposed via logs, repository commits, backups, or broader file-read permissions, enabling account takeover or unauthorized use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation describes like/follow actions without clearly warning that they mutate the user's Pixiv account state. In an agent setting, insufficient disclosure can cause accidental or unauthorized social/account actions, creating privacy, trust, and account-integrity risks even if the API calls are otherwise legitimate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest-style configuration file uses Chinese-only natural-language comments and labels throughout, such as the title and inline field explanations. Because the file does not offer a language choice or document that the skill is intended only for a Chinese-speaking or region-specific audience, it appears to impose a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The client headers hard-code "Accept-Language": "zh-cn", which enforces a specific language/locale choice for requests. The file does not offer a user-selectable locale or document why Chinese is required, so this is a natural-language policy violation under the locale-choice rule.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata and disabled login commands tell users to authenticate via a Cookie in config.yaml, but the actual API implementation uses OAuth bearer and refresh tokens from pixiv.auth. This discrepancy can cause operators to place long-lived secrets into config files unnecessarily, misunderstand what credentials are active, and mishandle authentication data in ways that increase secret exposure risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The application request headers again hard-code "Accept-Language": "zh-cn" for normal API calls. Because the skill does not present a locale option or clearly justify a China-specific restriction, it violates the language/locale policy criterion.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The command registrations advertise working login capabilities such as "交互式 OAuth 登录", "浏览器自动登录并自动提取回调", and "生成 OAuth 授权链接 / 提交授权回调". However, the corresponding handlers at L657-L676 immediately raise an error saying these login flows were removed and instruct the user to use cookies manually, which directly contradicts the documented command intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The user-facing skill documentation is presented in Chinese throughout, with no indication that the language is optional or that the skill is intentionally region- or locale-specific. This can violate language or locale policy when a skill forces a specific language without user opt-in.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency specifier uses a lower bound only, so builds may resolve to different versions over time, including versions with newly introduced bugs or supply-chain compromises. In a skill that performs authenticated network actions using Pixiv cookies, dependency drift increases the chance of pulling a vulnerable HTTP client or parser into a privileged workflow.
- Content
text requests>=2.31.0 PyYAML>=6.0 beautifulsoup4>=4.12.2 tqdm>=4.65.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
requests has multiple known advisories, and because the manifest does not pin an exact version, it is impossible to verify whether deployments avoid affected releases. In this skill, requests would likely carry authenticated Pixiv traffic and cookies, so a vulnerable version could expose credentials, mishandle redirects, or weaken transport assumptions.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
PyYAML is unpinned, so installations may pull different releases depending on time and environment, making security posture non-reproducible. Because this skill explicitly relies on config.yaml for cookie-based authentication, an unsafe or vulnerable YAML parser version is especially relevant to handling sensitive local configuration.
- Content
text requests>=2.31.0 PyYAML>=6.0 beautifulsoup4>=4.12.2 tqdm>=4.65.0 Pillow>=10.0.0
Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
PyYAML has a history of unsafe deserialization and parsing flaws, and the unpinned manifest prevents verification that a safe version is installed. Since the skill depends on config.yaml for cookie-based authentication, any vulnerable YAML handling directly increases the risk to local secrets and execution safety.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
beautifulsoup4 is specified with a minimum version only, which makes installs non-deterministic and can introduce vulnerable or incompatible releases later. While this library is lower risk than auth or crypto components, it still processes remote content and should be controlled in a network-scraping skill.
- Content
text requests>=2.31.0 PyYAML>=6.0 beautifulsoup4>=4.12.2 tqdm>=4.65.0 Pillow>=10.0.0 fake-useragent>=1.4.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
tqdm is unpinned, so future installs may select versions with known CLI or packaging-related issues. Although its direct security criticality is lower, unpinned tooling still weakens reproducibility and can expand supply-chain exposure.
- Content
text requests>=2.31.0 PyYAML>=6.0 beautifulsoup4>=4.12.2 tqdm>=4.65.0 Pillow>=10.0.0 fake-useragent>=1.4.0 aiohttp>=3.8.6
Unverifiable Dependency: tqdm has 4 known advisory(ies) (CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2016-10075 (TDQM Arbitrary Code Execution); CVE-2016-10075 (The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to e) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
tqdm has published advisories, and without exact pinning there is no assurance that the installed version is unaffected. The practical danger here is lower than for parser or network libraries, but unverifiable versions still weaken supply-chain hygiene.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Pillow is unpinned even though image libraries have a long history of parsing vulnerabilities and resource-consumption issues. Since this skill downloads and processes artwork on demand, dependency drift in an image parser materially increases the attack surface from untrusted remote files.
- Content
text PyYAML>=6.0 beautifulsoup4>=4.12.2 tqdm>=4.65.0 Pillow>=10.0.0 fake-useragent>=1.4.0 aiohttp>=3.8.6 asyncio>=3.4.3
Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Pillow has many historical vulnerabilities including parsing bugs and resource exhaustion issues, and the unpinned requirement means affected versions cannot be ruled out. Because this skill downloads and handles images from external sources, a vulnerable Pillow release materially increases risk from malicious or malformed image files.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
fake-useragent is unpinned, which can lead to non-reproducible builds and supply-chain risk from future releases. The direct exploit impact is lower than core network or parser libraries, but it still introduces avoidable uncertainty in a scraping-oriented skill.
- Content
text beautifulsoup4>=4.12.2 tqdm>=4.65.0 Pillow>=10.0.0 fake-useragent>=1.4.0 aiohttp>=3.8.6 asyncio>=3.4.3 pycryptodome>=3.19.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
aiohttp is unpinned, allowing future installations to resolve to different versions that may contain security flaws in HTTP handling, cookies, or request parsing. Because the skill performs authenticated network requests and likely handles session state, instability in an async HTTP client is security-relevant.
- Content
text tqdm>=4.65.0 Pillow>=10.0.0 fake-useragent>=1.4.0 aiohttp>=3.8.6 asyncio>=3.4.3 pycryptodome>=3.19.0 qrcode>=7.4.2
Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
aiohttp has multiple advisories and the manifest does not establish a known-safe version, leaving the deployed security state unverifiable. In a skill that performs authenticated HTTP operations and may manage cookies or redirects, this uncertainty is operationally dangerous.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 50% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
text Pillow>=10.0.0 fake-useragent>=1.4.0 aiohttp>=3.8.6 asyncio>=3.4.3 pycryptodome>=3.19.0 qrcode>=7.4.2
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
pycryptodome is unpinned, so deployments may pull different cryptographic library versions with varying security properties and bug exposure. In a skill that includes authenticated operations and potentially token/cookie handling, uncontrolled crypto dependency changes are high-risk from a supply-chain perspective.
- Content
text fake-useragent>=1.4.0 aiohttp>=3.8.6 asyncio>=3.4.3 pycryptodome>=3.19.0 qrcode>=7.4.2