T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_common.py:74- Finding
Unvalidated Network Destinations Permit Credential Disclosure, SSRF, and Unbounded Downloads
- Content
View full analysis
- Remediation
View remediation
Security audit
Free Media Gen（免费生图生视频）
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly a third-party media generator, but it reuses local API keys and contacts external services with weak network and download safeguards, so it should be reviewed before installation.
Install only if you intentionally want prompts sent to the listed third-party providers using keys from ~/.workbuddy/models.json and are comfortable with watermark-free output. Review and harden URL allowlisting, credential selection, download size/type checks, and confirmation prompts before using it with sensitive prompts or valuable API keys.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a media-generation skill whose core function is invoking third-party image/video models. The supplied code chunk does not implement any media generation or model invocation logic. Instead, it resolves local paths from environment variables, current working directory, and script location; constructs paths to models.json, outputs, generated-images, and memory directories; and checks whether certain files/directories exist. This is materially different from the declared primary purpose. While path resolution could be a supporting utility for a larger media-generation skill, this chunk itself does not match the advertised behavior and mainly performs filesystem/config discovery.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The description presents a broader skill: free text-to-image and text-to-video across multiple third-party providers, explicitly including bypass of Hunyuan ImageGen. The supplied code chunk only implements Agnes image generation via an images/generations endpoint. Its behavior is limited to text-to-image/image retrieval and local file saving. There is no video API usage, no logic for SenseNova or Kolors in this chunk, and no evidence of any Hunyuan bypass mechanism. The local saving/downloading is a supporting implementation detail, not itself a mismatch. Overall, the code only partially matches the declared purpose and omits several central claimed capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The description claims a broad skill covering free text-to-image and text-to-video across several third-party providers. However, this code only handles Agnes video generation workflows via Agnes-specific endpoints. Its primary purpose is submitting and polling Agnes video tasks and downloading resulting MP4 files. There is no image-generation logic in this chunk, no integration with SenseNova or SiliconFlow Kolors, and no visible mechanism related to bypassing Hunyuan ImageGen. Therefore the supplied code does not accurately represent the full declared behavior and is materially narrower/different than described.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents an end-user generation skill for free text-to-image/text-to-video using specific third-party models. The supplied code instead is an internal auditing script. Its main tasks are to inspect configured providers, fetch /models catalogs, filter media candidates, optionally run a tiny image live test ('a red circle'), update config.json with newly discovered models as unverified, and generate a dated markdown audit report. While it touches the same provider ecosystem, that is only for discovery and validation, not for fulfilling media generation requests. It also explicitly avoids asserting that models are free and sets watermark_removable to false, which conflicts with the declared 'free' and 'no watermark' claims. Therefore the description does not accurately represent the actual behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README explicitly states that prompts are sent directly to third-party model endpoints and that the command can write dated Markdown audit reports, but it does not clearly warn users that their prompts and possibly sensitive content will leave the platform boundary or that local files will be created. In this skill’s context, the deliberate bypass of the built-in platform flow and watermarking makes the missing disclosure more concerning because users may reasonably assume normal platform protections and data handling still apply.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### Who it is for Designed for WorkBuddy's custom-models registry (`models.json`). On other OpenClaw clients, write each platform's API key into `~/.workbuddy/models.json` using the same shape (`id` / `url` / `apiKey`) and the whole flow is reusable.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to read configuration files, inspect the workspace, write reports/config, access environment variables, and call external networks, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: a host may permit broader capabilities than users expect, enabling filesystem and network actions without clear least-privilege boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly routes prompts to third-party providers and reuses configured API credentials from local models.json, but it does not provide a clear upfront warning that user prompts and credential-backed requests will be sent to external services. This undermines informed consent and can expose sensitive prompts, workspace-derived content, or billing-linked credentials to external processors.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrases include broad natural-language expressions like references to free image/video generation or removing watermark, which can cause unintended invocation from ordinary conversation. Accidental activation is risky here because the skill may inspect local configuration, read keys from models.json, and initiate outbound requests to third-party services without the user meaning to launch the workflow.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md 按后端选择脚本，`--out` 默认落到 `{{OUTPUTS}}` 或 `generated_images`： | 二级命令关键词 | 脚本 | | --------- | ---------------------------------------------------------------------------------------- | | Agnes 生图 | `scripts/agnes_image.py --model agnes-image-2.1-flash --prompt "..." [--size 1024x1024]` | | Agnes 生视频 | `scripts/agnes_video.py --model agnes-video-v2.0 --prompt "..." [--timeout 300]` |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description advertises broad capabilities such as direct calls to multiple third-party media-generation providers, bypassing a default ImageGen path, and producing unwatermarked output, but it does not define clear trigger constraints, safety boundaries, or user-consent expectations. In this context, the underspecified wording increases the risk of deceptive activation, policy evasion, or unexpected transmission of user prompts to external services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON file contains operational instructions and descriptions in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This configuration directs user prompts and generated media requests to a third-party endpoint at api.agnes-ai.cn, creating an external data transmission path. In the context of a skill explicitly designed to bypass the platform's native ImageGen path and remove watermarks, user content and associated API credentials may be routed outside expected trust boundaries without clear consent or governance.
- Content
json "id": "agnes-image-2.1-flash", "provider": "agnes", "modality": "image", "endpoint": "https://api.agnes-ai.cn/v1/images/generations", "api_key_ref": "models.json:agnes-2.5-flash", "free": true, "needs_vpn": false,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This entry configures video-generation traffic to api.agnes-ai.cn, which means prompts, reference media, and task metadata are transmitted to an external service. Because the skill's stated purpose is to bypass first-party media generation controls and obtain unwatermarked output, this transmission is more sensitive than ordinary SaaS usage and may evade expected safety, compliance, or retention controls.
- Content
json "id": "agnes-video-v2.0", "provider": "agnes", "modality": "video", "endpoint": "https://api.agnes-ai.cn/v1/videos", "api_key_ref": "models.json:agnes-2.5-flash", "free": true, "needs_vpn": false,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This endpoint sends requests for another Agnes video model to an external domain, again establishing off-platform transmission of prompts and generation metadata. The surrounding config emphasizes free access, bypass behavior, and watermark removal, which increases concern that the integration is intended to circumvent normal platform restrictions rather than operate within approved boundaries.
- Content
json "id": "agnes-video-2.5-flash", "provider": "agnes", "modality": "video", "endpoint": "https://api.agnes-ai.cn/v1/videos", "api_key_ref": "models.json:agnes-2.5-flash", "free": true, "needs_vpn": false,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The nested submit endpoint duplicates the same external transmission path and defines required request fields such as prompt and mode, confirming that user-generated content will be posted to a third-party API. This is risky because it operationalizes the external exfiltration path directly in configuration and may cause users or administrators to underestimate where content is being sent.
- Content
json "default_size": "1280x720", "async_fetch": true, "submit": { "endpoint": "https://api.agnes-ai.cn/v1/videos", "required": [ "model", "prompt",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This configuration sends image-generation requests to SiliconFlow, another external provider, which exposes prompt data and possibly account metadata outside the host platform. The risk is amplified by the skill description advertising bypass of native generation and watermark-free output, suggesting intentional circumvention of governance rather than a transparent, approved integration.
- Content
json "id": "Kwai-Kolors/Kolors", "provider": "siliconflow", "modality": "image", "endpoint": "https://api.siliconflow.cn/v1/images/generations", "api_key_ref": "models.json:Qwen/Qwen3-8B", "free": true, "needs_vpn": false,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This Agnes image endpoint creates yet another outbound channel for user prompt data and generated content to leave the local trust boundary. In a skill marketed around bypassing first-party controls and removing watermarks, these transmissions are more security-relevant because they may undermine platform policy, provenance expectations, and privacy assumptions.
- Content
json "id": "agnes-image-2.5-flash", "provider": "agnes", "modality": "image", "endpoint": "https://api.agnes-ai.cn/v1/images/generations", "api_key_ref": "models.json:agnes-2.5-flash", "free": true, "needs_vpn": false,
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill reference is written in Chinese and does not indicate that other languages are supported or that the language choice is optional. Under the policy rule, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly states that SenseNova requests can set
watermark=falseto remove provenance labeling from generated images. In the context of a skill marketed as bypassing other platform controls and producing 'no watermark' media, this meaningfully increases misuse risk by enabling unlabeled synthetic content and evasion of platform safety or disclosure expectations.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script deliberately discovers and prints the user's configuration root and models.json path, and its own comments acknowledge that this file contains platform API keys. Even though it does not read the file contents, exposing credential-bearing locations expands the skill's access scope beyond media generation and can facilitate later credential targeting or chaining with other components.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This helper resolves and returns API keys from the user's shared models.json, including a fallback that selects credentials by provider hostname rather than an exact user-approved mapping. In the context of a skill explicitly designed to call third-party free model providers and bypass built-in services, this creates a real risk of silent credential reuse and unintended transmission of user secrets to external services without clear consent boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The HTTP helper is a generic network primitive that can send arbitrary JSON payloads and headers to remote endpoints, enabling external data transmission with no user notification, allowlist enforcement, or destination validation in this file. Given the skill's stated purpose of directly connecting to third-party providers and bypassing first-party image generation, this materially increases the chance of covert prompt, metadata, or credential-bearing requests leaving the local environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This function downloads arbitrary remote content and writes it to disk without validating content type, size, origin, or safe destination beyond creating parent directories. In a media-generation skill that fetches outputs from external providers, this can lead to untrusted files being silently persisted locally, increasing the risk of storing malicious or unexpected content and creating files the user did not knowingly approve.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md GET {root}/agnesapi?video_id={video_id}&model_name={model} -> metadata.url 即 MP4 直链（**必须带 model_name**，否则该字段不返回） base = https://api.agnes-ai.cn/v1 ；root = https://api.agnes-ai.cn 凭证经 _common 从 models.json 解析；不硬编码绝对路径。 用法:
Static analysis
No suspicious patterns detected.