T09 · Insecure Skill Coding Practices
Error
- Location
guides/01-quickstart.md:19- Finding
Credential-Like StepFun API Key Exposed in Documentation
- Content
View full analysis
- Remediation
View remediation
Security audit
短视频爆款拆解（叙事式）
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent with cloud video analysis, but it has material privacy and secret-handling concerns users should review before installing.
Install only if you are comfortable sending the selected video and optional extracted audio text to StepFun. Do not use the API key shown in the quickstart; create your own key, store it carefully, and assume the published value must be revoked. Avoid sensitive or private videos unless retention and deletion behavior are acceptable, because cleanup success is not verified. Expect possible runtime failure until the missing report template is supplied.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stepfun_client.py:55- Finding
Cloud Video Deletion Failures Are Not Detected
- Content
View full analysis
None: """用完后删除云端文件，避免占用配额。失败不抛。""" try: httpx.delete( f"{BASE_URL}/files/{file_id}", headers={"Authorization": f"Bearer {_api_key()}"}, timeout=30.0, ) except Exception as e: print(f"⚠️ 清理云端文件 {file_id} 失败（可忽略）: {e}") ``` The caller subsequently reports cleanup without verifying the deletion result: ```python stepfun_client.delete_file(file_id) print(f"🧹 已清理云端文件: {file_id}") ``` ### Technical Analysis `httpx.delete()` returns a response object for HTTP error statuses and does not raise solely because the server returned a non-success status. Because the response is discarded and neither its status code nor `raise_for_status()` is checked, responses such as 401, 403, 429, and 5xx are treated as successful deletion. The caller then prints a success message unconditionally. This can lead users to believe an uploaded video has been deleted when the remote copy remains stored. Videos may contain faces, voices, private conversations, location details, or other personal information. ### Attack Path 1. A user submits a local video for analysis. 2. The Skill uploads the video to the StepFun file-storage API. 3. Analysis completes and the cleanup path calls `delete_file()`. 4. The deletion endpoint returns a non-2xx status because of authorization failure, rate limiting, service failure, or another server-side error. 5. No exception is raised because the response status is not checked. 6. The caller prints that the cloud file was cleaned up. 7. The user takes no further action while the video may remain stored remotely. This issue does not require a local privilege escalation. An external service failure or an attacker able to interfere wi ...[truncated 461 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Dependencies Are Installed Without Exact Version or Integrity Pinning
- Content
View full analysis
=1.0 httpx>=0.24 jinja2>=3.0 ``` The documented installation command resolves these unconstrained versions: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency declarations specify only minimum versions. They do not define reviewed exact versions, upper bounds, a lock file, or package hashes. Consequently, two installations performed at different times can resolve to materially different direct and transitive dependency sets. This configuration does not prove that any listed package is currently malicious. The risk is that a future compromised, malicious, or incompatible release can be selected automatically without a corresponding review of this Skill. Python package installation may execute build backend or installation-related code, and compromised dependencies can execute with the privileges of the user running the installation or the Skill. ### Attack Path 1. A maintainer account, package release process, or transitive dependency in the dependency graph is compromised, or a harmful release is otherwise published. 2. The published version still satisfies the broad `>=` constraint. 3. A user follows the quickstart and runs `pip install -r requirements.txt`. 4. The package resolver selects the new unreviewed release. 5. Malicious code may execute during build or installation, or later when the dependency is imported by the Skill. 6. The code operates with the privileges and accessible data of the installing or runtime user. ### Impact Assessment A compromised dependency could potentially read files available to the current user, access `STEP_API_KEY`, alter generated reports, send data over the network, or execute arbitrary code within the Python process. The maximum scope is the operating-system privilege level of th ...[truncated 225 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared behavior says the skill performs full short-video narrative and psychological analysis with markdown and JSON outputs, but the finding indicates the implemented behavior is materially different and mainly performs ASR plus external transmission. This mismatch is dangerous because users and downstream agents may trust the declared purpose while sensitive media content is sent off-box and promised outputs or analysis stages are not actually performed, undermining informed consent and security review.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide includes a concrete API key value and instructs users to export it directly, with no warning that credentials are secret. If the key is real, it may already be compromised; even if it is a placeholder, presenting it as a usable secret trains unsafe handling practices and can lead to accidental credential leakage in shells, dotfiles, screenshots, and logs.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Publishing a real-looking API key in setup docs is a direct secret exposure issue. Beyond possible unauthorized use of the vendor account, the example normalizes unsafe credential practices and increases the chance that users will paste genuine secrets into persistent plaintext locations.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python key = os.environ.get("STEP_API_KEY") if key: return key env_file = Path(__file__).resolve().parent.parent / ".env" if env_file.exists(): for line in env_file.read_text(encoding="utf-8").splitlines(): line = line.strip()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python key = os.environ.get("STEP_API_KEY") if key: return key env_file = Path(__file__).resolve().parent.parent / ".env" if env_file.exists(): for line in env_file.read_text(encoding="utf-8").splitlines(): line = line.strip()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if k.strip() == "STEP_API_KEY": return v.strip().strip('"').strip("'") raise RuntimeError( "STEP_API_KEY 未设置。先 `export STEP_API_KEY=sk-xxx` 或写到 skill 根目录的 .env 文件里，" "key 从 https://platform.stepfun.com 拿。" )
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The listed trigger phrases include common expressions such as "分析这条视频" and "卡点在哪", which are broad enough to overlap with ordinary conversation about videos. The README does not provide exclusion conditions or narrow context constraints to clarify when the skill should or should not activate.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly states that uploaded video files are sent to a third-party cloud API for analysis and then deleted afterward, which materially changes the skill’s data flow from a local file processor to an external data transfer workflow. If the manifest does not clearly declare this external transmission, users and orchestrators may unknowingly expose sensitive video content, creating a confidentiality and consent risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises capabilities that include environment access, file read/write, network access, and shell execution, but it does not declare any explicit tool scope or permissions boundaries. In an agent framework, this creates unnecessary ambient authority and makes misuse or overreach harder to audit, especially because the skill processes user-supplied local file paths and can exfiltrate content over the network.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad everyday expressions about analyzing videos, which increases the chance the skill is invoked unintentionally during normal conversation. In an agent setting, accidental invocation matters because this skill reads local files and may upload media to an external API, so over-broad dispatch can turn casual requests into unexpected data handling.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill explicitly transmits video/audio-derived content to an external StepFun API. External transmission is not inherently malicious, but it is security-relevant because local media may contain sensitive audio, faces, locations, or other personal data, and the risk is elevated in this context because the skill ingests local files rather than public URLs.
- Content
md - `manifest.json` 已声明 `entry / inputs / outputs / triggers / models`，可被 StepClaw Agent 直接 dispatch - 默认 `STEP_API_KEY` 走环境变量或 skill 根目录的 `.env` - 输出路径 `output/{video_stem}-{report.md, analysis.json}` 是固定 schema，下游 Agent 可直接读取 - ASR 与 vision 模型都走 `https://api.stepfun.com/v1`，不需要额外 endpoint ## 限制
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The entire quickstart is written only in Chinese, with no indication that the skill is China-specific or that users can choose another language. The policy requires flagging language or locale constraints when a specific language is effectively imposed without opt-in or clear justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow description shows both cloud upload of the video and ASR processing of audio/transcript content, but the skill description does not clearly warn that user media and derived text are sent to a third-party service. In the context of user-supplied social video files, this can expose personal, copyrighted, or confidential content without informed consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The quickstart explicitly shows the video being uploaded to StepFun cloud and later deleted remotely, which contradicts the higher-level description implying a local-file input and local report outputs. This is dangerous because users may supply sensitive videos under the assumption that processing is local, creating an undisclosed third-party data exposure risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire guide is written in Chinese and assumes Chinese-language operation, including examples and recommended prompt text, without indicating that users may choose another language or locale. Under the policy rule for language/locale, this is a natural-language policy violation because it imposes a specific language experience without opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest references cloud-side file retention via the keep-upload flag, which strongly implies local video content may be uploaded to remote services, but it does not clearly disclose that default analysis may involve cloud transfer. Because the input is a local MP4 path, users may reasonably assume local-only processing; undisclosed upload of personal or sensitive video content creates a meaningful privacy and data-handling risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are generic, conversational requests that can easily match normal user intent outside a deliberate tool invocation. In an agent environment, this raises the risk of accidental activation on unrelated chats, which could cause unintended processing of local video files and associated uploads or analysis actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s instructions are entirely in Chinese and direct the model to produce output in that language, but there is no user opt-in or alternative locale option. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt is written entirely in Chinese and directs the model into a Chinese-language analyst role, with no indication that the user may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless the constraint is clearly justified as region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill sends a user-supplied local MP4 to a third-party cloud service (StepFun) for analysis, but the skill metadata describes input as a local file path and output as local report artifacts, which can reasonably imply local processing. This creates a data exfiltration/privacy risk because users may provide sensitive videos without clear notice that the content is uploaded off-device; the optional --keep-upload flag increases retention risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The hardcoded external ASR endpoint confirms that media-derived content leaves the local environment for cloud processing. Given the manifest's omission of third-party transmission, this is a meaningful privacy and trust issue, and the skill context makes it more dangerous because users may provide personal or proprietary videos expecting local-only analysis.
- Content
python import httpx ASR_ENDPOINT = "https://api.stepfun.com/v1/audio/asr/sse" MODEL = "stepaudio-2.5-asr" ASR_TIMEOUT_SEC = 600.0
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The helper silently loads an API key from the environment or a local .env file in support of uploading media-derived content to a third-party ASR service. In the context of a skill described as taking a local MP4 and producing local reports, undeclared credential use and cloud dependency create a transparency and data-governance issue, especially if users assume all processing is local.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-acodec", "pcm_s16le", str(out_path), ] proc = subprocess.run(cmd, capture_output=True, text=True) if proc.returncode != 0: raise RuntimeError( f"ffmpeg 抽音失败 (returncode={proc.returncode}):\n{proc.stderr[-1500:]}"
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-acodec", "pcm_s16le", str(out_path), ] proc = subprocess.run(cmd, capture_output=True, text=True) if proc.returncode != 0: raise RuntimeError( f"ffmpeg 抽音失败 (returncode={proc.returncode}):\n{proc.stderr[-1500:]}"
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code base64-encodes extracted audio from the user's video and transmits it to https://api.stepfun.com for transcription, but the manifest only mentions local file input and local output generation. This mismatch is dangerous because users may unknowingly send sensitive voice content, copyrighted media, or personal information to an external service without informed consent.
- Content