Jiuma AI Video Generation (Free)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.8

Overview

This appears to be a real Jiuma media-generation helper, but it needs Review because its upload command can send any readable local file to Jiuma without built-in limits or confirmation.

Install only if you trust the publisher and Jiuma with the media you choose to upload. Use explicit media file paths, do not let prompts or copied commands point the upload tool at secrets, configuration files, SSH keys, browser profiles, or private documents, and prefer running it in a limited workspace with a native OS keyring. Treat the embedded identification_code example as non-reusable sample data and avoid pasting real authorization values into shared logs or prompts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_file.py:27

Finding

Unrestricted Local File Upload to an External Service

Content

View full analysis

Vulnerability Details

File Location: scripts/upload_file.py:27-38
Vulnerability Type: Unrestricted file access and external upload
Risk Level: Medium

Vulnerable Code

python

def upload_file_with_token(file_path):
    """使用token上传文件"""
    url = f"{API_BASE_URL}{UPLOAD_ENDPOINT}"
    
    # 获取token
    token = get_token()
    headers = {
        "Authorization": f"Bearer {token}"
    }
    with open(os.path.expanduser(file_path), 'rb') as f:
        files = {'file': f}
        response = requests.post(url, files=files, headers=headers, timeout=60)

Technical Analysis

The function accepts an arbitrary filesystem path, expands home-directory notation, opens the referenced file with the current process's permissions, and transmits its complete contents to https://api.jiuma.com/console/aiApp/uploadOneFile.

Uploading user-selected media is necessary for the Skill's declared functionality. However, the implementation does not restrict access to expected media directories or file types. It also lacks canonical-path validation, symbolic-link checks, MIME validation, file-size limits, sensitive-directory denial rules, and a separate confirmation before external transmission.

Consequently, the script's filesystem access exceeds the minimum privileges needed to upload media. Any file readable by the user running the Skill can potentially be selected, including configuration files, API credentials, SSH keys, environment files, private documents, or Agent state.

Attack Path

1. An attacker supplies a malicious instruction, task parameter, or social-engineering request that identifies a sensitive local path.
2. The Agent invokes upload_file.py with that path, for example through --file_path=~/.ssh/id_rsa.
3. os.path.expanduser() resolves the path to the user's home directory.
4. open(..., 'rb') reads the file using the current user's privileges.
5. requests.post() sends ...[truncated 909 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict uploads to explicitly approved workspace or media directories.
2. Resolve the canonical path with Path.resolve() and verify that it remains beneath an approved root directory.
3. Reject symbolic links and paths targeting sensitive locations such as .ssh, .aws, .config, keyring storage, browser profiles, and Agent configuration directories.
4. Allowlist supported media extensions and verify actual content using MIME detection or file signatures rather than trusting the extension alone.
5. Enforce maximum file-size limits before opening or transmitting a file.
6. Require explicit user confirmation that displays the canonical path, destination domain, file type, and file size before upload.
7. Check that a valid token exists before constructing and sending the authorization header.
8. Document that selected files are transmitted to and handled by an external service.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:130

Finding

Unpinned Dependency Installation and Potentially Weak Credential-Storage Backend

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:130-134
Vulnerability Type: Insecure dependency and credential-storage guidance
Risk Level: Low

Vulnerable Code

markdown

## Installation
``` cmd
pip install keyring
pip install keyrings.alt

text

### Technical Analysis

The installation instructions retrieve mutable, unpinned versions of `keyring` and `keyrings.alt` from the user's configured Python package index. No reviewed version constraints, integrity hashes, lock file, or trusted index requirement is provided.

This creates supply-chain exposure because future package versions or a compromised package index could deliver code different from the version reviewed with this Skill. Python package installation can execute build or installation logic with the privileges of the account running `pip`.

In addition, `keyrings.alt` provides alternative keyring backends for systems without a supported native backend. Depending on environment and backend selection, these alternatives may offer weaker protection than an operating-system credential vault. This is relevant because `scripts/auth.py` stores the Jiuma bearer token through `keyring.set_password()`.

The audit found no evidence that the named packages are malicious. The risk arises from mutable dependency resolution and the possibility of selecting a weak fallback secret-storage backend.

### Attack Path

A dependency-based exploitation path is conditional:

1. A user follows the documented installation commands.
2. `pip` resolves the latest available package versions from its configured index.
3. If the index, package account, distribution artifact, or dependency chain has been compromised, malicious installation or runtime code is downloaded.
4. That code executes with the privileges of the user running `pip` or importing the installed package.
5. It may access files, process data, or credentials available to that account.

A credential
...[truncated 1049 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace ad hoc installation commands with a reviewed requirements or lock file.
2. Pin exact dependency versions and include cryptographic hashes, using a command such as pip install --require-hashes -r requirements.txt.
3. Periodically review and update pinned versions for known vulnerabilities.
4. Document the expected trusted Python package index and avoid untrusted extra indexes.
5. Do not install keyrings.alt by default. Prefer native operating-system credential stores such as Windows Credential Manager, macOS Keychain, or Secret Service on Linux.
6. Detect the active keyring backend before storing a token and fail closed if it does not meet the required security standard.
7. Clearly warn users if only a fallback backend is available and require explicit opt-in before using it.
8. Use short-lived, revocable, narrowly scoped API tokens to reduce the impact of local token disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (55)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documentation includes arbitrary local file upload to an external platform and local credential access via keyring, but the headline description focuses on generation features rather than these sensitive operations. Upload capability is especially important to disclose because it can exfiltrate user-selected local content to a remote service.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documentation includes arbitrary local file upload to an external platform and local credential access via keyring, but the headline description focuses on generation features rather than these sensitive operations. Upload capability is especially important to disclose because it can exfiltrate user-selected local content to a remote service.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documentation includes arbitrary local file upload to an external platform and local credential access via keyring, but the headline description focuses on generation features rather than these sensitive operations. Upload capability is especially important to disclose because it can exfiltrate user-selected local content to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Using a concrete identification code in examples without warning against reuse normalizes exposing credential-like values in documentation, shells, and logs. If the value is real or patterned after real data, it can enable unauthorized account association, replay attempts, or accidental disclosure.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 3)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 26)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 28)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 34)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 37)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_auth_status.py (reported line 2)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_auth_status.py (reported line 11)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_auth_status.py (reported line 14)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit_generation_task.py (reported line 3)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit_generation_task.py (reported line 27)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit_generation_task.py (reported line 29)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit_generation_task.py (reported line 35)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/task_result.py (reported line 5)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/task_result.py (reported line 19)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/upload_file.py (reported line 4)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/upload_file.py (reported line 18)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/upload_file.py (reported line 21)May include surrounding context.

python

import sys
import keyring
import requests

API_BASE_URL = "https://api.jiuma.com/"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 28)May include surrounding context.

python

token = keyring.get_password("jiuma_ai", "authorized_token")
        if token and len(token) > 20:  # 基本验证token长度
            return token
    except (keyring.errors.KeyringError, FileNotFoundError):
        pass
    return None

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 37)May include surrounding context.

python

token = keyring.get_password("jiuma_ai", "authorized_token")
        if token and len(token) > 20:  # 基本验证token长度
            return token
    except (keyring.errors.KeyringError, FileNotFoundError):
        pass
    return None

Static analysis

No suspicious patterns detected.