Security audit
Security checks for vulnerabilities and agentic risk
This Manus integration is mostly coherent, but it gives an agent broad remote API powers, local prompt retention, file upload, sharing, and deletion capabilities without enough guardrails.
Install only if you intend to let this skill send prompts and selected files to Manus, create remote tasks/projects, and maintain a local session registry containing prompt text. Before using destructive, sharing, connector, or upload workflows, require explicit user confirmation with the exact task/file/webhook ID or filename, and consider editing the script to avoid storing full prompts or to redact sensitive data.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from scripts.manus_session import ManusSession
s = ManusSession() # reads .env automatically
# New session
s.send("Review auth module for vulnerabilities",
The documented delete-task endpoint is inherently destructive and irreversible, creating abuse potential if an agent invokes it from ambiguous or manipulated user input. In a skill designed to manage tasks automatically, lack of explicit safety guidance around destructive actions raises the risk of accidental or unauthorized deletion.
| `enable_shared` | boolean | Enable/disable public sharing |
| `enable_visible_in_task_list`| boolean | Show/hide in Manus webapp task list |
### DELETE /v1/tasks/{task_id} — Delete Task
Permanently deletes a task. Cannot be undone.
Deleting files can break downstream task execution and remove user-uploaded artifacts, so exposing this capability without guardrails enables harmful parameter abuse. The risk is amplified in an agent context because file IDs may be inferred from prior interactions and removed without the user understanding the consequence.
Returns details of a specific file by ID.
### DELETE /v1/files/{file_id} — Delete File
Marks file as deleted. Can no longer be used in tasks.
Webhook deletion can silently disable task notifications or integrations, affecting monitoring and automation. While the endpoint itself is legitimate, documenting it without operational safety notes or confirmation expectations creates a meaningful misuse risk for an autonomous or semi-autonomous skill.
|-------|--------|----------|------------------------|
| `url` | string | Yes | Your webhook endpoint |
### DELETE /v1/webhooks/{webhook_id} — Delete Webhook
Removes a webhook subscription.
The skill documents use of environment variables, file reads/writes, and outbound network access, but does not declare any explicit tool scope or permission boundaries. That makes the skill harder to sandbox and review, and increases the chance it is invoked with broader capabilities than necessary, especially since it can read local files, persist session data, and send content to an external API.
The trigger text is extremely broad, causing the skill to activate for many generic mentions of Manus, tasks, sessions, uploads, or delegation phrases. Over-broad invocation can route unrelated user requests into a networked skill that persists local state and may create or continue remote tasks, increasing the chance of unintended external actions and data disclosure.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Every request uses the API_KEY header (not Bearer token):
curl -H "API_KEY: $MANUS_API_KEY" https://api.manus.ai/v1/tasks
Base URL: https://api.manus.ai — all endpoints under /v1/.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Every request uses the API_KEY header (not Bearer token):
curl -H "API_KEY: $MANUS_API_KEY" https://api.manus.ai/v1/tasks
Base URL: https://api.manus.ai — all endpoints under /v1/.
The skill advertises destructive DELETE operations for tasks, files, and webhooks without requiring confirmation or warning about irreversibility. In a skill that can be triggered broadly and performs remote API actions, this creates a realistic risk of accidental or prompt-induced deletion of user resources.
The API documents createShareableLink for making chats publicly accessible but provides no privacy warning, confirmation requirement, or description of exposure scope. In an agent skill that may act on user data automatically, this increases the risk of unintentionally publishing sensitive prompts, outputs, or attachments.
The update endpoint allows enable_shared to toggle public access on existing tasks without warning that prior conversation content and outputs may become exposed. Because this can affect already-created tasks, the privacy impact is broader than a new-task share setting and could disclose historical sensitive data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Then upload:
curl -X PUT "<upload_url>" \
-H "Content-Type: application/pdf" \
--data-binary @report.pdf
The design explicitly stores first_prompt verbatim and recommends storing last_prompt, which can capture sensitive user data, secrets, internal code, credentials, or regulated information in a local registry file. In the context of a session-tracking skill for an external agent platform, this increases privacy and data-retention risk because prompts are likely to contain exactly the material being delegated to Manus.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if locale:
body["locale"] = locale
resp = requests.post(f"{BASE_URL}/v1/tasks", headers=self._headers, json=body)
resp.raise_for_status()
data = resp.json()
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def get_task(self, task_id: str, convert: Optional[str] = None) -> dict:
params = {"convert": convert} if convert else {}
resp = requests.get(
f"{BASE_URL}/v1/tasks/{task_id}", headers=self._headers, params=params
)
resp.raise_for_status()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
body["enable_shared"] = enable_shared
if enable_visible is not None:
body["enable_visible_in_task_list"] = enable_visible
resp = requests.put(f"{BASE_URL}/v1/tasks/{task_id}", headers=self._headers, json=body)
resp.raise_for_status()
return resp.json()
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
body["enable_shared"] = enable_shared
if enable_visible is not None:
body["enable_visible_in_task_list"] = enable_visible
resp = requests.put(f"{BASE_URL}/v1/tasks/{task_id}", headers=self._headers, json=body)
resp.raise_for_status()
return resp.json()
delete_task performs a destructive remote action immediately with no confirmation, dry-run, or guardrails. In an agent-integrated tool, mistaken task IDs, prompt confusion, or indirect invocation can lead to unintended loss of task history or work products.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
body = {"name": name}
if instruction:
body["instruction"] = instruction
resp = requests.post(f"{BASE_URL}/v1/projects", headers=self._headers, json=body)
resp.raise_for_status()
return resp.json()
This function transmits a user-selected local file to a remote service with no explicit warning, confirmation, or destination transparency. In an agent skill context, that increases the risk of accidental disclosure of sensitive local data because file transfer is a core capability and may be triggered implicitly by higher-level workflows.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
path = Path(filepath)
if not path.exists():
raise FileNotFoundError(f"File not found: {filepath}")
resp = requests.post(
f"{BASE_URL}/v1/files", headers=self._headers, json={"filename": path.name}
)
resp.raise_for_status()
The code blindly trusts upload_url returned by the API and then uploads local file contents to that URL. If the API, account, or network path is compromised, this becomes an arbitrary file exfiltration primitive to an attacker-controlled destination, especially dangerous because the payload is the full local file contents.
import mimetypes
mime = mimetypes.guess_type(str(path))[0] or "application/octet-stream"
with open(path, "rb") as f:
requests.put(upload_url, headers={"Content-Type": mime}, data=f).raise_for_status()
return record
def list_files(self) -> dict:
delete_file removes remote files without any user confirmation or additional verification. Because this skill manages uploads and file IDs, accidental or induced deletion could destroy data or break downstream tasks that rely on those files.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ── Webhooks ─────────────────────────────────────────────────────
def create_webhook(self, url: str) -> dict:
resp = requests.post(
f"{BASE_URL}/v1/webhooks", headers=self._headers, json={"url": url}
)
resp.raise_for_status()
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
print(f"Imported task {args.task_id} as '{args.name}' ({section})")
elif args.command == "upload":
record = s.upload_file(args.filepath)
print(f"Uploaded: {record.get('filename')} -> file_id: {record.get('id')}")
elif args.command == "create-project":
No suspicious patterns detected.