Security audit

GLM-V-Grounding

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real GLM-V grounding helper, but it needs review because its media upload path can send any readable local file to an external API and its API-key setup uses weak secret handling.

Install only if you are comfortable sending selected images or videos to Zhipu's GLM-V API. Do not let the agent pass sensitive local paths as image/video inputs, avoid using the documented --api-key command-line form, restrict .env permissions, and prefer running the skill in a workspace or sandbox that cannot read unrelated secrets.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/glm_grounding_cli.py:174
Finding: Arbitrary Local Files Can Be Uploaded to an External API
Content: View full analysis
tuple[str, str]: """ Encode a local file to base64 data URI. Returns: tuple of (data_uri, error_message) On success, error_message is empty. """ path = Path(file_path) if not path.exists(): return "", f"File not found: {file_path}" if not path.is_file(): return "", f"Not a regular file: {file_path}" # Guess MIME type, fallback to application/octet-stream mime, _ = mimetypes.guess_type(str(path)) if not mime: mime = "application/octet-stream" try: data = path.read_bytes() b64 = base64.b64encode(data).decode("ascii") return f"data:{mime};base64,{b64}", "" except Exception as e: return "", f"Failed to read file: {e}" ``` ```python if image: if not _is_url(image): encoded_image, encode_err = _encode_file(image) if encode_err: return _error("INPUT_ERROR", encode_err, source) image_for_api = encoded_image else: image_for_api = image mm_content.append({"type": "image_url", "image_url": {"url": image_for_api}}) elif video is not None: # video if not _is_url(video): encoded_video, encode_err = _encode_file(video) if encode_err: return _error("INPUT_ERROR", encode_err, source) video_for_api = encoded_video else: video_for_api = video mm_content.append({"type": "video_url", "video_url": {"url": video_for_api}}) content = [*mm_content, *content] messages = [{"role": "user", "content": content}] payload = { "model": model, "messages": messages, } try: raw_result = _make_api_request(api_url, api_key, payload) except RuntimeError as e: return _error ...[truncated 2262 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/glm_grounding_cli.py:143
Finding: Public URL Validation Is Bypassable and Is Not Applied to API Media URLs
Content: View full analysis
tuple[bool, str]: """Validate URL is http/https and not localhost/private network target.""" try: parsed = urlparse(url) if parsed.scheme not in ("http", "https") or not parsed.netloc: return False, "Only http/https URLs are supported" host = parsed.hostname if not host: return False, "Invalid URL host" host_l = host.lower() if host_l in {"localhost", "127.0.0.1", "::1"}: return False, "Localhost URLs are not allowed" # Resolve and block private/link-local/loopback/reserved addresses. infos = socket.getaddrinfo(host, None) for info in infos: ip_str = info[4][0] ip = ipaddress.ip_address(ip_str) if ( ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_multicast or ip.is_reserved or ip.is_unspecified ): return False, f"URL resolves to non-public IP: {ip}" return True, "" except Exception as e: return False, f"URL validation failed: {e}" ``` ```python def load_media_bytes(source: str): """Get bytes for a media URL or local file path.""" if _is_url(source): ok, reason = _is_public_url(source) if not ok: return None, f"Rejected URL for security reasons: {reason}" try: resp = requests.get(source, timeout=10) resp.raise_for_status() return resp.content, "" except Exception as e: return None, f"Failed to download image: {e}" ``` ```python if image: if not _is ...[truncated 3158 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/config_setup.py:58
Finding: API Key Setup Exposes Secrets Through Terminal Input, Process Arguments, and Weak File Permissions
Content: View full analysis
None: """ Write environment variables to .env file Args: env_vars: Dictionary of environment variables to write skill_root: Skill root directory path """ env_path = _get_env_path(skill_root) with open(env_path, "w", encoding="utf-8") as f: # Write header f.write("# GLM-V API Configuration\n") f.write("# Auto-generated by config_setup.py\n") f.write("# DO NOT commit this file to version control\n\n") # Write environment variables for key, value in env_vars.items(): f.write(f"{key}={value}\n") ``` ```python current_key = existing.get("ZHIPU_API_KEY", "") if current_key: print(f"Current API Key: {current_key[:8]}...{current_key[-4:]}") api_key = input( f"Enter GLM-V API Key{' (press Enter to keep current)' if current_key else ''}: " ).strip() ``` ```python setup_parser.add_argument("--api-key", "-k", help="GLM-V API key") ... if args.command == "setup": if args.api_key: env_vars = _setup_from_args(args.api_key) elif args.non_interactive: print("Error: --api-key is required in non-interactive mode") sys.exit(1) else: env_vars = _setup_interactive() if not _validate_config(env_vars): sys.exit(1) _write_env_file(env_vars, skill_root) ``` The documented setup command in `SKILL.md:52-55` is: ```bash python scripts/config_setup.py setup --api-key YOUR_KEY ``` ### Technical Analysis Interactive secret collection uses `input()`, which echoes the API key to the terminal. The alternative documented workflow passes the secret through a command-line argument. Command-line values can ...[truncated 1892 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/requirements.txt:1
Finding: Runtime Dependencies Are Unpinned and Lack Integrity Verification
Content: View full analysis
=2.31.0 Pillow>=10.0.0 opencv-python>=4.8.0 numpy>=1.24.0 matplotlib>=3.7.0 decord>=0.6.0 ``` The installation instruction in `SKILL.md` is: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended lower bound. Installation can therefore select versions that did not exist when the Skill was reviewed. No lock file, artifact hash, or approved package index is specified. The listed package names appear legitimate; the audit found no evidence of typosquatting, dependency confusion, or a currently malicious package. The risk arises from mutable future resolution and the absence of integrity verification. A compromised upstream release, package-index account, or incompatible future version could be installed automatically. Python packages can execute code during installation and whenever imported. Since these dependencies are imported by the Skill, compromise of an accepted artifact can lead to code execution with the agent process's privileges. ### Attack Path 1. A user follows the documented `pip install -r scripts/requirements.txt` command. 2. The resolver selects the latest versions satisfying the lower bounds. 3. A selected package or transitive dependency has been compromised, replaced, or contains a newly introduced malicious installation/import payload. 4. Package code executes during installation or when the Skill imports it. 5. The malicious dependency gains the same filesystem, network, and environment access as the agent process. This is a supply-chain hardening weakness rather than evidence that the currently named packages are malicious. ### Impact Assessment A compromised dependency could execute arbitrary code with the privileges of the installing user or Skill runt ...[truncated 300 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (55)

Tainted flow: 'timeout' from os.getenv (line 245, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/glm_grounding_cli.py (reported line 248)May include surrounding context.
python
timeout = float(os.getenv("GLM_GROUNDING_TIMEOUT", str(DEFAULT_TIMEOUT))) try: resp = requests.post(api_url, json=payload, headers=headers, timeout=timeout) except requests.Timeout: raise RuntimeError(f"API request timed out after {timeout}s") except requests.RequestException as e:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is grounding and visualization, but the skill also handles API credential setup, environment configuration, and stored configuration display/validation. This mismatch is dangerous because users and policy systems may approve the skill for image/video processing while overlooking sensitive secret-handling and configuration behavior that expands attack surface and could expose credentials or enable unsafe writes.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
pip install -r scripts/requirements.txt

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 4)May include surrounding context.
python
#!/usr/bin/env python3 """ Environment Variable Configuration Setup Helps users set up their .env file for GLM-Grounding skill """ import sys

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 20)May include surrounding context.
python
#!/usr/bin/env python3 """ Environment Variable Configuration Setup Helps users set up their .env file for GLM-Grounding skill """ import sys

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 27)May include surrounding context.
python
#!/usr/bin/env python3 """ Environment Variable Configuration Setup Helps users set up their .env file for GLM-Grounding skill """ import sys

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 164)May include surrounding context.
python
#!/usr/bin/env python3 """ Environment Variable Configuration Setup Helps users set up their .env file for GLM-Grounding skill """ import sys

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 170)May include surrounding context.
python
#!/usr/bin/env python3 """ Environment Variable Configuration Setup Helps users set up their .env file for GLM-Grounding skill """ import sys

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/glm_grounding_cli.py (reported line 66)May include surrounding context.
python
#!/usr/bin/env python3 """ Environment Variable Configuration Setup Helps users set up their .env file for GLM-Grounding skill """ import sys

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 23)May include surrounding context.
python
"""Get the path to the .env file""" if skill_root is None: skill_root = _get_skill_root() return skill_root / ".env" def _env_exists(skill_root: Optional[Path] = None) -> bool:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 264)May include surrounding context.
python
"""Get the path to the .env file""" if skill_root is None: skill_root = _get_skill_root() return skill_root / ".env" def _env_exists(skill_root: Optional[Path] = None) -> bool:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/glm_grounding_cli.py (reported line 71)May include surrounding context.
python
"""Get the path to the .env file""" if skill_root is None: skill_root = _get_skill_root() return skill_root / ".env" def _env_exists(skill_root: Optional[Path] = None) -> bool:

Credential Access

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: This function reads secrets from a local .env file into memory, which is expected for configuration, but it increases secret exposure surface inside the skill. In this file, the read values are later displayed in masked form, reducing severity, and there is no evidence of network exfiltration or logging of full secrets.
Content: Scanner excerpt · scripts/config_setup.py (reported line 33)May include surrounding context.
python
def _read_env_file(skill_root: Optional[Path] = None) -> dict: """ Read existing .env file and return as dictionary Returns: Dictionary of environment variables

Credential Access

High

Category: Privilege Escalation
Confidence: 79% confidence
Finding: This function writes API credentials to a plaintext .env file in the skill directory. While common in developer tooling, storing secrets unencrypted on disk can expose them to local users, backups, accidental commits, or other processes with filesystem access.
Content: Scanner excerpt · scripts/config_setup.py (reported line 60)May include surrounding context.
python
def _write_env_file(env_vars: dict, skill_root: Optional[Path] = None) -> None: """ Write environment variables to .env file Args: env_vars: Dictionary of environment variables to write

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/config_setup.py (reported line 63)May include surrounding context.
python
Write environment variables to .env file Args: env_vars: Dictionary of environment variables to write skill_root: Skill root directory path """ env_path = _get_env_path(skill_root)

Credential Access

High

Category: Privilege Escalation
Confidence: 81% confidence
Finding: This call persists the API key to a plaintext .env file, which carries the same local secret exposure risk as the write helper itself. The skill context makes this somewhat expected for configuration setup, but it remains a security weakness if the host environment is shared or the repository is mishandled.
Content: Scanner excerpt · scripts/config_setup.py (reported line 252)May include surrounding context.
python
if not _validate_config(env_vars): sys.exit(1) # Write to .env _write_env_file(env_vars, skill_root) print()

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 265)May include surrounding context.
python
with open(gitignore_path, "r") as f: gitignore_content = f.read() if ".env" not in gitignore_content: print("Tip: Add '.env' to your .gitignore to keep API keys secure") else: print("Tip: Create a .gitignore file with '.env' to keep API keys secure")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/config_setup.py (reported line 267)May include surrounding context.
python
with open(gitignore_path, "r") as f: gitignore_content = f.read() if ".env" not in gitignore_content: print("Tip: Add '.env' to your .gitignore to keep API keys secure") else: print("Tip: Create a .gitignore file with '.env' to keep API keys secure")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation indicates access to environment variables, local files, networking, shell execution, and file writes, but it does not declare any explicit tool scope or allowed-tools policy. That creates an authorization gap where an agent may invoke broader capabilities than users expect, increasing the blast radius if the skill is misused or prompt-injected through user-supplied URLs, files, or prompts.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
md
## Utility function quick reference | Function | Purpose | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `parse_coordinates_from_response(response_str, coords_type='bbox', init_context_window=2000, max_context_window=-1)` | Parse and extract all coordinate results from model responses (supports 2D bbox, point, polygon) | | `parse_3d_boxes_from_response(response_str, max_context_window=-1)` | Parse and extract all 3D boxes and labels from model responses (strict and loose matching) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
md
## Utility function quick reference | Function | Purpose | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `parse_coordinates_from_response(response_str, coords_type='bbox', init_context_window=2000, max_context_window=-1)` | Parse and extract all coordinate results from model responses (supports 2D bbox, point, polygon) | | `parse_3d_boxes_from_response(response_str, max_context_window=-1)` | Parse and extract all 3D boxes and labels from model responses (strict and loose matching) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
| Function | Purpose | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `parse_coordinates_from_response(response_str, coords_type='bbox', init_context_window=2000, max_context_window=-1)` | Parse and extract all coordinate results from model responses (supports 2D bbox, point, polygon) | | `parse_3d_boxes_from_response(response_str, max_context_window=-1)` | Parse and extract all 3D boxes and labels from model responses (strict and loose matching) | | `parse_detection_from_response(response_str, max_context_window=-1)` | Parse and extract all 2D detection results from model responses (Objects Detection JSON format) | | `parse_mot_from_response(response_str, max_context_window=-1)` | Parse and extract all video object tracking results from model responses (Video Objects Tracking JSON format) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
md
| Function | Purpose | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `parse_coordinates_from_response(response_str, coords_type='bbox', init_context_window=2000, max_context_window=-1)` | Parse and extract all coordinate results from model responses (supports 2D bbox, point, polygon) | | `parse_3d_boxes_from_response(response_str, max_context_window=-1)` | Parse and extract all 3D boxes and labels from model responses (strict and loose matching) | | `parse_detection_from_response(response_str, max_context_window=-1)` | Parse and extract all 2D detection results from model responses (Objects Detection JSON format) | | `parse_mot_from_response(response_str, max_context_window=-1)` | Parse and extract all video object tracking results from model responses (Video Objects Tracking JSON format) | | `visualize_boxes(img_path=None, img_bytes=None, boxes=[], labels=None, renormalize=False, save_path=No ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
md
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `parse_coordinates_from_response(response_str, coords_type='bbox', init_context_window=2000, max_context_window=-1)` | Parse and extract all coordinate results from model responses (supports 2D bbox, point, polygon) | | `parse_3d_boxes_from_response(response_str, max_context_window=-1)` | Parse and extract all 3D boxes and labels from model responses (strict and loose matching) | | `parse_detection_from_response(response_str, max_context_window=-1)` | Parse and extract all 2D detection results from model responses (Objects Detection JSON format) | | `parse_mot_from_response(response_str, max_context_window=-1)` | Parse and extract all video object tracking results from model responses (Video Objects Tracking JSON format) | | `visualize_boxes(img_path=None, img_bytes=None, boxes=[], labels=None, renormalize=False, save_path=None, return_b64=False, save_optimized=True, **kwargs)` | Draw 2D boxes on images with labels, custom colors, and line thickness | | `visualize_points(img_path=None, img_bytes=None, points=[], labels=None, renormalize=False, diameters= ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
| `parse_coordinates_from_response(response_str, coords_type='bbox', init_context_window=2000, max_context_window=-1)` | Parse and extract all coordinate results from model responses (supports 2D bbox, point, polygon) | | `parse_3d_boxes_from_response(response_str, max_context_window=-1)` | Parse and extract all 3D boxes and labels from model responses (strict and loose matching) | | `parse_detection_from_response(response_str, max_context_window=-1)` | Parse and extract all 2D detection results from model responses (Objects Detection JSON format) | | `parse_mot_from_response(response_str, max_context_window=-1)` | Parse and extract all video object tracking results from model responses (Video Objects Tracking JSON format) | | `visualize_boxes(img_path=None, img_bytes=None, boxes=[], labels=None, renormalize=False, save_path=None, return_b64=False, save_optimized=True, **kwargs)` | Draw 2D boxes on images with labels, custom colors, and line thickness | | `visualize_points(img_path=None, img_bytes=None, points=[], labels=None, renormalize=False, diameters=None, save_path=None, return_b64=False, save_optimized=True, distinct_colors=False, colors=None)` | Draw points on images with labels, custom size, and colors | | `visualize_3d_boxes_glmv_simple(image_path, cam_params, bbox_3d_list, image_bytes=None, coord_format=' ...[truncated 25 chars]

Static analysis

No suspicious patterns detected.