T09 · Insecure Skill Coding Practices
Error
- Location
scripts/upload_file.py:25- Finding
Arbitrary Local File Disclosure Through Fail-Open Media Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
libtv-skill
Security checks for vulnerabilities and agentic risk
Overview
This media-generation skill is coherent, but needs Review because it can upload local files and write downloads while using weak validation and unvalidated network destinations.
Review this skill before installing if you handle confidential files, private prompts, paid API keys, or restricted networks. Only use trusted HTTPS API endpoints, avoid giving it sensitive local file paths, confirm where files will be uploaded or downloaded, and use a confined output directory with non-sensitive test credentials first.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sora_query_video.py:80- Finding
Bearer Credentials and User Content Sent to Unvalidated API Destinations
- Content
View full analysis
dict: url = f"{base_url.rstrip('/')}/v1/videos" req = urllib.request.Request( url, data=body, method="POST", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": f"multipart/form- ...[truncated 4106 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/download_results.py:58- Finding
Unrestricted URL Download Enables Server-Side Request Forgery and Local Resource Access
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/download_results.py:119- Finding
Path Traversal Through Unsanitized Output Filename Prefixes
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (34)
Tainted flow: 'req' from os.environ.get (line 66, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers=_headers(), ) try: with urllib.request.urlopen(req, timeout=30) as resp: status = resp.status raw = resp.read().decode("utf-8") if not raw.strip():
Tainted flow: 'req' from os.environ.get (line 66, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers=_headers(), ) try: with urllib.request.urlopen(req, timeout=30) as resp: status = resp.status raw = resp.read().decode("utf-8") if not raw.strip():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 复制环境变量模板：
bash cp .env.example .env- 填入你的 API Key（至少配置
LIBTV_ACCESS_KEY）。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: libtv-skill description: >- agent-im 会话技能 - 通过 liblib.tv 的 AI 能力生成和编辑图片/视频，兼容 Gemini 文生图、Sora/Veo/Grok/豆包/Vidu 视频直连。
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest trigger-word list includes broad, ambiguous terms and platform references that are insufficiently precise for safe invocation. Because the skill can upload files, call external APIs, and download outputs, weak activation boundaries increase the chance of unintended execution and data transfer.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill states that any request involving image/video creation or editing 'must' trigger the skill, and the examples include very generic phrases. This creates overbroad activation that can capture normal conversation and route users into networked generation, upload, polling, and download flows without sufficiently specific user intent.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return default def resolve_env_file_from_argv(argv, env_var_name: str = "SORA_ENV_FILE", default_env_file: str = ".env") -> str: """Pre-parse --env-file so defaults can use loaded env values.""" for i, arg in enumerate(argv): if arg == "--env-file" and i + 1 < len(argv):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return default def resolve_env_file_from_argv(argv, env_var_name: str = "SORA_ENV_FILE", default_env_file: str = ".env") -> str: """Pre-parse --env-file so defaults can use loaded env values.""" for i, arg in enumerate(argv): if arg == "--env-file" and i + 1 < len(argv):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return default def resolve_env_file_from_argv(argv, env_var_name: str = "SORA_ENV_FILE", default_env_file: str = ".env") -> str: """Pre-parse --env-file so defaults can use loaded env values.""" for i, arg in enumerate(argv): if arg == "--env-file" and i + 1 < len(argv):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return default def resolve_env_file_from_argv(argv, env_var_name: str = "SORA_ENV_FILE", default_env_file: str = ".env") -> str: """Pre-parse --env-file so defaults can use loaded env values.""" for i, arg in enumerate(argv): if arg == "--env-file" and i + 1 < len(argv):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_env_file(env_file: str) -> str: """Load KEY=VALUE .env file without overriding existing process env.""" if not env_file: return ""
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_env_file(env_file: str) -> str: """Load KEY=VALUE .env file without overriding existing process env.""" if not env_file: return ""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file documents required credentials and a remote API gateway, indicating the skill will send user-provided content to external services. While it notes not to commit keys, it does not warn users that prompts or generated media requests may be transmitted to third-party providers, which is a user-facing privacy and safety disclosure gap under the markdown criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README describes sending prompts, images, and videos to LibTV and multiple third-party generation services, but it does not warn users that their content may be transmitted to external providers and processed under those providers' retention, privacy, and policy regimes. This can lead to accidental disclosure of sensitive prompts or uploaded files, especially in an agent context where users may not realize data leaves the local environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs bulk downloading of generated images/videos to local disk and even naming/output-directory behavior, but it does not prominently warn users up front that local file writes will occur. In a skill that handles externally sourced URLs and generated media, silent or under-disclosed disk writes raise consent, storage, and malware-adjacent safety concerns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The smoke-test instructions direct users to run provider-specific commands that will contact external services, but they do not clearly warn that prompts, task identifiers, and possibly other request metadata will be transmitted off-host. In a repo context, this can cause unintentional disclosure of test data, unexpected billing, or use of real credentials during routine validation.
- Content
Ae2
Medium
- Category
- analysis-evasion
- Confidence
- 90% confidence
- Finding
Artifact content does not match its filename extension
- Content
Ae2
Medium
- Category
- analysis-evasion
- Confidence
- 90% confidence
- Finding
Artifact content does not match its filename extension
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file presents the output-format instructions only in Chinese, starting from the title and introductory description. Under the stated policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage guide instructs users to send prompts, local reference images, and remote image URLs to third-party provider APIs, but it does not warn that this content will leave the local environment and may contain sensitive data. In a skill that handles image/video generation across multiple external providers, this omission can lead users to unintentionally transmit proprietary, personal, or regulated content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow explicitly instructs automatic downloading of generated files to a local directory without requiring user confirmation or warning that local files will be written. In an agent setting, this can cause unexpected filesystem side effects, overwrite risks, storage abuse, or silent placement of untrusted content on disk, especially because the behavior is framed as mandatory after task completion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow tells the agent to upload user-supplied images or videos to an OSS endpoint as a default step, but provides no notice, consent check, or data-handling warning. This creates a real privacy and data-exfiltration risk because potentially sensitive local files are transmitted to external storage automatically as part of normal operation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits user-facing validation errors exclusively in Chinese, such as at L19, L21, L33, L42, L44, L50, and L54. That creates a language policy issue because the skill enforces a specific locale without offering a user choice or documenting that it is intentionally Chinese-only.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains all user-facing natural-language strings in Chinese, including the module docstring, function docstrings, argument descriptions, and usage examples. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's docstring, CLI description, help text, and examples are entirely in Chinese, which imposes a specific language on users without any opt-in or stated regional justification. Under the language/locale policy, hardcoding a single language for user-facing interaction can be a policy violation when no choice or constraint is explained.
- Content
Static analysis
No suspicious patterns detected.