秦丝旺剪 - AI智能视频剪辑

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:14 PM UTC
• Version: 1.0.1

Overview

The Wangcut integration is coherent, but it needs Review because it asks for account passwords in chat and stores them as plaintext in a persistent config file.

Review before installing. Do not paste a real Wangcut password into chat unless you accept that it may appear in conversation history and local agent context. If used, prefer manual configuration in a private location, ensure config.ini is not committed or shared, restrict file permissions, keep the default Wangcut HTTPS API URL unless you fully trust a custom endpoint, and rotate the password if the config file may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wangcut_api.py:125

Finding

Reusable Account Password Stored in Plaintext

Content

View full analysis

Vulnerability Details

File Location: scripts/wangcut_api.py:125-136
Vulnerability Type: Plaintext storage of sensitive credentials
Risk Level: Medium

Vulnerable Code

python

# 更新账号配置
if not config.has_section('wangcut'):
    config.add_section('wangcut')

config.set('wangcut', 'username', username)
config.set('wangcut', 'password', password)

The function documentation also incorrectly states that the password will be transformed before storage:

python

password: 密码（明文，会自动MD5加密存储）

Technical Analysis

setup_config() writes the supplied reusable account password directly into config.ini. No encryption, operating-system credential store, or restrictive file-permission handling is used. Although the documentation claims that the password is MD5-processed before being stored, the assignment at line 136 stores the original password value unchanged.

The installation documentation advises users not to commit config.ini, but this does not protect the credential from local processes, overly broad filesystem permissions, workspace sharing, backups, or accidental repository commits.

Attack Path

1. A user provides a valid Wangcut username and password to setup_config().
2. The function writes both values into config.ini, with the password unchanged.
3. The configuration file is created using the process and environment's default permissions rather than explicit owner-only permissions.
4. Another local user or process, a shared-workspace participant, a backup collector, or a party with access to an accidentally committed file reads config.ini.
5. The exposed reusable password is used to authenticate to the victim's Wangcut account.

Exploitation requires read access to the generated configuration file or an accidental disclosure channel; this issue does not independently grant remote filesystem access.

Impact Assessment

Successful exploitation exposes the ...[truncated 455 chars]

Remediation

View remediation

Remediation Suggestions

1. Store the password in an operating-system credential manager or another dedicated secret store instead of config.ini.
2. Prefer a revocable API token or service-supported authorization flow that does not require retaining a reusable password.
3. If file-backed storage is unavoidable:
   • Create the file atomically with owner-only permissions such as 0600.
   • Reject configuration paths located in shared or repository-controlled directories.
   • Avoid copying the file into logs, backups, or source-control archives.
   • Provide explicit warnings that the file contains a reusable secret.
4. Correct the documentation so that it does not claim the stored password is MD5-processed.
5. Add config.ini to a distributed .gitignore rather than relying solely on installation instructions.
6. Where practical, migrate existing plaintext credentials out of configuration files and advise affected users to rotate passwords that may have been exposed.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wangcut_api.py:309

Finding

Unrestricted API Endpoint Can Receive Credential-Derived Authentication Material

Content

View full analysis

Vulnerability Details

File Location: scripts/wangcut_api.py:132-138, 193-196, 309-317
Vulnerability Type: Unvalidated authentication endpoint and credential disclosure
Risk Level: Medium

Vulnerable Code

The configuration function accepts and stores an unrestricted base URL:

python

config.set('wangcut', 'username', username)
config.set('wangcut', 'password', password)
config.set('wangcut', 'base_url', base_url or config.get('wangcut', 'base_url', fallback='https://cloud.qinsilk.com/aicut/api/v1'))
config.set('wangcut', 'folder_id', folder_id or config.get('wangcut', 'folder_id', fallback=''))

The client then loads that value without validating its scheme or destination:

python

self.base_url = self.config.get('wangcut', 'base_url', fallback='https://cloud.qinsilk.com/aicut/api/v1')
self.username = self.config.get('wangcut', 'username', fallback='')
self.password = self.config.get('wangcut', 'password', fallback='')
self.folder_id = self.config.get('wangcut', 'folder_id', fallback='')

Authentication material is sent to the resulting endpoint:

python

url = f"{self.base_url}/auth/login"
headers = self._get_headers(with_auth=False)
data = {
    "username": self.username,
    "password": self._md5_password(self.password)
}

try:
    response = self._session.post(url, headers=headers, json=data)

Technical Analysis

base_url may contain an arbitrary scheme, hostname, port, and path. The client does not require HTTPS or verify that the destination is the documented Wangcut API origin. When any authenticated operation triggers login(), the username and an unsalted MD5 digest of the password are posted to that configured destination.

The MD5 digest should be treated as authentication material rather than effective password protection. The audited client sends that exact representation during authentication, so a captured digest may function as a pass-th ...[truncated 2365 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the API URL to use HTTPS.
2. Allowlist the documented origin, such as the exact https://cloud.qinsilk.com hostname and expected API path.
3. Reject:
   • Plain HTTP URLs.
   • Embedded URL credentials.
   • Unexpected ports.
   • Unapproved hostnames or subdomains.
   • Redirects to unapproved origins.
4. If custom endpoints are required for development, place that capability behind an explicit development-only option and display a clear warning before transmitting credentials.
5. Configure the HTTP session to reject cross-origin redirects for authentication requests, or validate the final response URL before allowing credential-bearing redirects.
6. Use the strongest authentication protocol supported by the service. Avoid unsalted MD5 password authentication; prefer short-lived, revocable tokens obtained through a secure authorization flow.
7. Separate authentication and API origins where appropriate and independently validate each origin.
8. Add automated tests verifying that malicious schemes, lookalike domains, embedded credentials, unexpected ports, and redirect-based origin changes are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to provide an account and password directly in chat without a clear privacy or security warning and appears to persist those credentials into a local config file. This creates a significant risk of credential exposure through chat logs, prompt history, local storage, or misuse by other components with filesystem access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide instructs users to provide their Wangcut account password directly in chat (e.g. "配置旺剪账号 158xxx 密码 xxx"), which can expose credentials to the agent runtime, chat logs, telemetry, screenshots, or other plugins. In the context of an agent skill, this is especially dangerous because users may assume conversational input is a safe secret channel when it often is not.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill demonstrates both network access and file-writing behavior, but it does not declare any explicit tool scope or permissions boundary. This weakens least-privilege controls and makes it easier for the skill to be invoked with broader capabilities than users or the platform may expect, especially since it can save credentials and download files locally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are very broad and overlap with ordinary requests like creating or downloading videos, increasing the chance the skill will activate unexpectedly. Because the skill can request credentials, call external APIs, and write downloaded content to disk, accidental invocation raises both privacy and integrity risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documentation appears to force a specific language/locale for installation and usage instructions, including all user-facing examples. Under the stated policy, this is a natural-language locale constraint unless the skill offers user choice or clearly documents that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code stores the user's Wangcut username and password directly in a local config.ini file in plaintext, while also auto-discovering config files from multiple directories. This creates a realistic credential exposure risk through local file disclosure, accidental commits, backups, or access by other local users/processes, especially because the user is not explicitly warned about sensitive local storage.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/wangcut_api.py (reported line 310)May include surrounding context.

python

)

        url = f"{self.base_url}/auth/login"
        headers = self._get_headers(with_auth=False)
        data = {
            "username": self.username,
            "password": self._md5_password(self.password)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file’s natural-language comments and example values are entirely in Chinese, including placeholders like '你的手机号' and '你的密码', which imposes a specific language on users. For a general example configuration, this can violate language/locale policy when no alternative language choice or scope limitation is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The default request headers hard-code accept-language to 'zh-CN,zh;q=0.9,en;q=0.8', which imposes a specific locale preference for all requests. The file does not offer a user opt-in or configuration mechanism for locale selection, nor does it document a required region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.