magic-image-to-video

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:33 AM UTC
• Version: 1.0.1

Overview

This video-generation skill mostly matches its stated purpose, but it fetches arbitrary image URLs from the agent host and uploads local image files to remote endpoints with limited safety checks.

Install only if you are comfortable sending prompts and selected images to MagicLight. Avoid using confidential images or secrets in prompts, and treat remote image URLs cautiously because the current client may fetch arbitrary URLs from the agent environment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/media_gen_client.py:115

Finding

Unrestricted User-Controlled URL Fetch Enables Blind SSRF

Content

View full analysis

Vulnerability Details

File Location: scripts/media_gen_client.py, lines 115–117
Vulnerability Type: Server-Side Request Forgery (SSRF) and unbounded network response handling
Risk Level: Medium

Vulnerable Code

python

if args.image.startswith("http"):
    image_content = urllib.request.urlopen(args.image, context=_get_ssl_context()).read()
    image_url = args.image if image_content else None

Technical Analysis

The --image argument is user-controlled. Any value beginning with http is fetched from the Agent host using urllib.request.urlopen() without validating the destination.

The implementation does not:

• Restrict URLs to HTTPS.
• Restrict requests to approved image-hosting domains.
• Reject loopback, private, link-local, reserved, or cloud metadata addresses.
• Resolve and validate the destination IP address.
• Revalidate redirect destinations.
• Set a request timeout.
• Limit the number of bytes read.
• Verify that the response is a supported image.

Consequently, an attacker can cause the Agent host to issue HTTP requests to services that may not be reachable from the attacker's own network. Redirect handling can also allow an apparently external URL to redirect to an internal destination.

The entire response is read into memory. A large or indefinitely delayed response may therefore consume excessive memory or block execution.

The fetched response body is only checked for non-emptiness and is not directly returned to the user or uploaded by this branch. This limits direct extraction of response contents, but it does not prevent blind internal-network probing, requests to sensitive endpoints, or denial of service.

Fetching a remote image is related to the declared video-generation functionality, but unrestricted access to arbitrary network destinations exceeds the minimum network privileges required.

Attack Path

1. An attacker invokes the Skill with an image argument containing an attacker-selected HTTP U ...[truncated 1352 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept only properly parsed https:// URLs rather than using a prefix check.
2. Where practical, allowlist trusted image-hosting domains.
3. Resolve the hostname before connecting and reject all loopback, private, link-local, multicast, unspecified, reserved, and metadata-service addresses for both IPv4 and IPv6.
4. Disable automatic redirects or validate every redirect destination using the same scheme, hostname, and resolved-address rules.
5. Protect against DNS rebinding by ensuring the validated address is the address used for the connection.
6. Set strict connection and read timeouts.
7. Read the response incrementally and enforce a conservative maximum image size.
8. Require an approved image MIME type and validate the file signature rather than trusting headers alone.
9. Reject URLs containing credentials or unsupported ports, and normalize internationalized hostnames before validation.
10. Prefer having the remote media service retrieve an allowlisted public image URL, or require local image upload through the existing temporary upload mechanism, to avoid granting the Agent host arbitrary outbound-request capability.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tainted flow: 'req' from os.environ.get (line 124, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/media_gen_client.py (reported line 65)May include surrounding context.

python

req = urllib.request.Request(url, data=data, headers=all_headers, method=method.upper())
    try:
        with urllib.request.urlopen(req, timeout=timeout_s, context=_get_ssl_context()) as resp:
            raw = resp.read().decode("utf-8")
            return json.loads(raw) if raw else {}
    except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 124, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code blindly uploads local file contents to a server-provided put_url without validating the hostname, scheme, or relationship to the trusted service. If the upstream API is compromised, malicious, or intercepted, it could return an attacker-controlled upload URL and cause arbitrary local files selected by the user to be exfiltrated to an unintended destination.

Content

Scanner excerpt · scripts/media_gen_client.py (reported line 125)May include surrounding context.

python

put_url = image_put_url_resp.get("data", {}).get("put_url")
            # put_url是临时上传地址，需要上传图片到put_url
            req = urllib.request.Request(put_url, data=image_content, method="PUT")
            with urllib.request.urlopen(req, context=_get_ssl_context()) as resp:
                status = resp.getcode()
                if status != 200:
                    raise Exception(f"Failed to upload image to put_url, status: {status}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes a Python client that uses an API key and makes remote network requests, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. That weakens reviewability and policy enforcement because an agent may execute code with broader capabilities than users or orchestrators expect, especially given support for local file paths and outbound data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill sends user-provided text and images to a third-party video service, and it explicitly supports local file paths, which can cause sensitive local content to be uploaded. Without a clear privacy warning and consent language, users may unknowingly transmit private data, credentials embedded in images, or proprietary files to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This command sends user prompts and image data, including local file contents, to external services with little explicit user-facing disclosure at the point of use. In a skill that accepts local paths and remote URLs, this increases the risk of users unintentionally transmitting sensitive images or prompts off-device.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file includes natural-language comments and a docstring in Chinese, such as the SSL context docstring and upload/retry comments, without any indication that language is selectable or region-specific. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.