T09 · Insecure Skill Coding Practices
Error
- Location
main.py:58- Finding
Arbitrary File Creation Through an Unsanitized Keyword
- Content
View full analysis
- Remediation
View remediation
Security audit
short-video-ecommerce
Security checks for vulnerabilities and agentic risk
Overview
This package is presented as a YouTube Shorts generator, but its code and manifest actually implement a Chinese ecommerce product-selection and listing workflow with unsafe file and network handling.
Review this skill carefully before installing. Do not provide marketplace credentials or sensitive product data unless the publisher aligns the user-facing description, manifest, and code, adds explicit approval gates for any publishing/listing action, and fixes the unsafe file and image-download handling. Treat any generated compliance or success result as advisory only until the workflow performs real checks and verifies real outputs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
utils.py:49- Finding
Server-Side Request Forgery Through Unrestricted Image URLs
- Content
View full analysis
bool: if product.image_url: filename = generate_product_filename(len(self.products) + 1, product.name) save_path = self.output_dir / filename if download_image(product.image_url, save_path): product.local_image_path = save_path ``` The downloader performs the request without validating the destination: ```python def download_image(url: str, save_path: Path) -> bool: try: headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" } response = requests.get(url, headers=headers, timeout=30) response.raise_for_status() with open(save_path, "wb") as f: f.write(response.content) ``` ### Technical Analysis `product.image_url` is caller-controlled and is passed to `requests.get()` without controls for: - Allowed URL schemes. - Approved hostnames. - Loopback, private, link-local, multicast, or reserved IP addresses. - DNS rebinding. - Redirect destinations. - Cloud instance metadata addresses. - Expected response media types. The request is issued from the skill's execution environment, so an attacker can use it as a network proxy to reach services that are not directly accessible from the attacker's network position. Redirects accepted by the HTTP client can also lead from an initially acceptable hostname to an internal destination. Although the response is written to disk rather than returned directly, the request can still trigger state-changing internal endpoints. Retrieved content may also become observable through local files, logs, later processing, or ot ...[truncated 1162 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
utils.py:49- Finding
Unbounded Download Buffering and Missing Image Content Validation
- Content
View full analysis
bool: try: headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" } response = requests.get(url, headers=headers, timeout=30) response.raise_for_status() with open(save_path, "wb") as f: f.write(response.content) if save_path.stat().st_size < 1024: save_path.unlink(missing_ok=True) return False return True except Exception: return False ``` ### Technical Analysis Accessing `response.content` causes the HTTP client to buffer the entire response body in memory before it is written. The implementation imposes no maximum response size, download quota, or streaming limit. The only content check is a minimum file-size test. The code does not verify: - `Content-Type`. - Image signatures or format. - Whether an image decoder can parse the body. - Decompressed image dimensions. - Maximum file size. - Available disk capacity. Consequently, an attacker-controlled endpoint can return a very large body to consume process memory and disk space. It can also return arbitrary non-image content that will be accepted and stored with a `.jpg` extension. ### Attack Path 1. An attacker supplies an image URL under their control. 2. The endpoint returns a very large response or a continuous body. 3. `requests.get()` downloads the response, and `response.content` buffers it in memory. 4. The complete body is written to the output directory. 5. Repeated requests or a sufficiently large response exhaust memory or disk resources. 6. Alternatively, a non-image payload larger than one kilobyte is retained as if it were an image. ### Imp ...[truncated 434 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:198- Finding
Compliance Workflow Unconditionally Approves Unexamined Content
- Content
View full analysis
dict: result = { "has_logo": False, "needs_processing": False, "note": "" } return result ``` ```python def check_video(self, video_path) -> dict: return { "success": True, "passed": True, "note": "Video format check passed" } ``` ### Technical Analysis The workflow treats compliance as a security and policy gate, but the image and video checks do not inspect their inputs. The main workflow additionally sets `self.compliance_passed` to `True` regardless of whether an item is explicitly pending. This is a fail-open design: unavailable or unimplemented validation is represented as successful validation. Downstream automation or users may therefore rely on a false assurance that content has passed logo, sensitive-content, platform-rule, authorization, and video checks. The independent text checker only uses a small substring list and does not compensate for the unconditional pass in the main workflow. ### Attack Path 1. A user or upstream component supplies unreviewed text, imagery, or video. 2. The workflow invokes its compliance stage. 3. Image and vid ...[truncated 851 chars]- Remediation
View remediation
other
Warning
- Location
steps/publish.py:34- Finding
Generation and Publishing Functions Return Fabricated Success Results
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises fully automated generation of AI video, TTS, editing, thumbnailing, and SEO copy with a simple trigger, but the file provides only high-level claims and dependency notes. In an agent setting, such exaggerated capability claims can socially engineer users into sharing topics, API keys, or trusting output handling without understanding that steps may be incomplete, outsourced, or manually approximated.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata advertises YouTube Shorts video automation, but the file implements a Chinese-language ecommerce product-selection and listing workflow. This scope mismatch is dangerous because users and higher-level agents may grant permissions, provide inputs, or trust outputs appropriate for video creation while the code instead drives commercial research and publication-related actions outside the declared purpose.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow includes a publication/listing phase that exceeds the declared scope of 'ready-to-upload 15-60 second vertical video' generation. Hidden or undeclared publishing capabilities materially increase operational risk because an orchestrator or user may invoke the skill expecting content generation only, while it prepares commercial posting actions and related assets.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest metadata materially conflicts with the stated skill purpose: the reviewed skill is presented as YouTube Shorts automation, but the name and description define a Chinese ecommerce short-video product-selling workflow. This kind of scope mismatch is dangerous because it can conceal undeclared capabilities, mislead reviewers and users, and enable a bait-and-switch installation of a different automation surface than expected.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The dependency set includes ecommerce and marketplace integrations such as product data, listing APIs, and Xiaohongshu platform support that are not justified by a YouTube Shorts creation workflow. Unnecessary commercial and publishing capabilities expand the attack surface and could be abused for unauthorized product research, listing, cross-platform posting, or exfiltration of business data under the cover of a media-generation skill.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file implements automated e-commerce product listing behavior even though the skill is ներկայացված as a YouTube Shorts automation workflow. That capability mismatch is dangerous because it introduces undeclared external-publishing behavior and a path to move user-supplied product/media data to third-party marketplaces under a misleading skill identity, which is a strong indicator of hidden or unauthorized functionality.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements product-market research for dropshipping goods, including planned integration with multi-platform product search, filtering for dropshipping, and returning supplier contact data, which is unrelated to the declared YouTube Shorts automation purpose. This capability mismatch is dangerous because it can hide unauthorized commerce or lead-generation behavior inside a media-creation skill, increasing the risk of deceptive scope expansion and unexpected data handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README promotes fully automated creation of upload-ready videos, thumbnails, and SEO metadata without any caution about copyright ownership of generated assets, factual accuracy of scripts, or compliance with YouTube/platform rules. In this context, users may reasonably rely on the automation as safe for direct publishing, increasing the risk of misinformation, infringing content, deceptive metadata, or policy-violating uploads at scale.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises capabilities that inherently require filesystem access, environment/API key access, and likely network calls, but it declares no explicit tool scope or permission boundaries. In an agent ecosystem, this creates an under-specified trust boundary and can allow broader-than-expected access or make review and consent ineffective.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly requires external AI video generation services and likely TTS services, yet it does not warn users that their topics, prompts, scripts, or other content may be transmitted to third parties. For a content-generation workflow, that omission is significant because users may unknowingly share proprietary, sensitive, or unpublished material with external vendors.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file docstring identifies the module as "short-video-ecommerce" and describes "短视频带货全流程自动化" (short-video e-commerce full-process automation), which conflicts with the manifest's YouTube Shorts creation workflow and the exported class name
ShortVideoEcommerceSkill. This is an active documentation-level contradiction about the skill's intended function, not merely an omitted detail.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring defines the skill name, trigger phrase, and workflow entirely in Chinese, including the activation phrase at L005, with no indication that other languages are supported. This is a natural-language policy concern because it imposes a specific language/locale on users without an explicit opt-in or alternative.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The docstring for step6_publish states that the function performs one-click publishing to an ecommerce platform. The actual code merely writes publication guidance to a text file and returns {'auto_publish': False}, which directly contradicts the documented intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill as targeting Chinese platforms and workflows, but it does not state that the skill is region-specific or offer a language/locale choice. This can violate language/locale policy because the skill appears to impose a specific language context by default rather than documenting opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and all user-facing report content are written exclusively in Chinese, indicating the skill is designed to operate in a single language. Under the policy, language-specific behavior should offer user opt-in or clearly document a justified regional constraint, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring states the step is for generating copywriting scripts entirely in Chinese, and the templates and output labels are also fixed in Chinese. This imposes a specific language/locale behavior without any indication that the user can choose another language or opt in to Chinese output.
- Content
Static analysis
No suspicious patterns detected.