T08 · Insecure Dependencies
Warning
- Location
SKILL.md:76- Finding
Unpinned PonyFlash SDK Installation Creates a Mutable Supply-Chain Boundary
- Content
View full analysis
- Remediation
View remediation
Security audit
PonyFlash - Media Generation Router
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent media-generation and FFmpeg-editing helper, but it handles API keys and runtime downloads in ways users should review before installing.
Before installing, treat this as a review-required integration: configure the PonyFlash API key through a secret manager or local terminal rather than chat, use an isolated environment with a pinned SDK version, avoid uploading sensitive media unless you intend PonyFlash to process it, and approve overwrites, cloud file deletion, recharge actions, and font downloads deliberately.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/ensure_subtitle_fonts.sh:26- Finding
Downloaded Subtitle Font Is Consumed Without Integrity Verification
- Content
View full analysis
/dev/null 2>&1; then curl --fail --location --silent --show-error "$url" --output "$tmp_path" elif command -v wget >/dev/null 2>&1; then wget -q -O "$tmp_path" "$url" else echo "Missing downloader: need curl or wget to fetch subtitle fonts." >&2 return 2 fi mv "$tmp_path" "$font_path" } mkdir -p "$font_dir" if [[ ! -s "$font_path" ]]; then rm -f "$font_path.tmp" if ! download_font "$primary_url"; then rm -f "$font_path.tmp" download_font "$fallback_url" fi fi ``` The environment variable used for the primary source permits an arbitrary URL: ```bash primary_url="${PONYFLASH_NOTO_FONT_URL:-https://mirrors.aliyun.com/CTAN/fonts/notocjksc/NotoSansCJKsc-Regular.otf}" ``` ### Technical Analysis The script downloads a binary OpenType font and accepts it based only on a successful transfer and a non-empty resulting file. It does not verify: - A cryptographic digest or digital signature. - The expected font format or internal font identity. - An expected maximum size. - The final redirected host. - Whether an environment-supplied override uses HTTPS or a trusted domain. The downloaded font is subsequently parsed by Pillow and/or the native font-processing components used by FFmpeg and libass. Binary font parsers have historically represented a significant native-code attack surface. Even without parser exploitation, substituted content can manipulate subtitle appearance or cause de ...[truncated 1600 chars]- Remediation
View remediation
&2 return 1 fi ``` 2. Maintain separate approved digests if multiple versioned sources intentionally provide different artifacts. 3. Restrict `PONYFLASH_NOTO_FONT_URL` overrides to HTTPS and an explicit allowlist, or require a matching user-supplied digest whenever a custom URL is used. 4. Limit redirects or validate the final redirect host before accepting the response. 5. Apply a download size limit, timeout, and retry policy, for example with curl's `--max-filesize`, `--connect-timeout`, and `--max-time`. 6. Validate the downloaded file using an appropriate font inspection utility before processing it. 7. Prefer bundling a license-compatible, versioned font artifact or retrieving it from a release whose signature and digest are independently verified. 8. Run font parsing and FFmpeg rendering in a sandbox with minimal filesystem and network access. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:60- Finding
Skill Directs Users to Paste an API Key into Conversation History
- Content
View full analysis
") balance = pony_flash.account.credits() print(f"Balance: {balance.balance} {balance.currency}") ``` ### Technical Analysis The Skill explicitly directs the user to transmit an API credential through the conversation. Chat content may be retained in platform history, telemetry, agent traces, support exports, or third-party integrations. It may also remain available to later tools or participants with access to the conversation. Generating a literal shell command or Python source containing the received key creates additional exposure risks. Depending on how commands are executed, the credential can enter shell history, command transcripts, process logs, saved scripts, or debugging output. The problem is not a hardcoded credential in the repository; it is an insecure credential-handling workflow that unnecessarily expands the secret's exposure surface. ### Attack Path 1. The user follows the Skill instruction and pastes a valid `rk_` API key into the chat. 2. The platform stores the key in conversation history, execution traces, logs, or an integra ...[truncated 1040 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (31)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Contributing 1. Fork this repo 2. Add or update skill content 3. Follow the [Agent Skills specification](https://agentskills.io/specification) 4. Submit a PR
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code partially matches the declared purpose because it does use the PonyFlash SDK to generate image, video, speech, and music. However, the description also claims substantial FFmpeg-based local media editing functionality—clip, concat, transcode, audio extraction, frame capture, subtitle checks, and ASS subtitle prep—which is absent from this code chunk. In addition, the code includes undeclared account-oriented capabilities such as checking credit balance, listing models, and obtaining a recharge URL. Since the actual code's behavior differs materially from the full declared description and includes extra capabilities not mentioned, this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code chunk’s primary purpose is environment/capability validation for FFmpeg, not media generation or media editing itself. While the description mentions subtitle capability checks, that is only one small part of the declared functionality, and the actual code does nothing else from the broader description. This is a materially different primary behavior: a dependency checker rather than a media creation/editing skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code partially matches the declared FFmpeg/local media editing portion: clip, concat, extract-audio, transcode, frame capture, subtitle preparation/burning, and subtitle capability checking are all represented. However, the description prominently states AI media generation using the PonyFlash Python SDK for images, videos, speech, and music, and none of those capabilities appear in this code chunk. The script is focused on local shell-based FFmpeg workflows plus subtitle/font handling, not SDK-based generative media creation. Because the declared description includes substantial capabilities absent from the actual code, this is a description-behavior mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Local media editing | `scripts/media_ops.sh` | Clip, concat, transcode, extract audio, frame capture |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh list_file="" cleanup() { [[ -n "$list_file" && -f "$list_file" ]] && rm -f "$list_file" } trap cleanup EXIT
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh list_file="" cleanup() { [[ -n "$list_file" && -f "$list_file" ]] && rm -f "$list_file" } trap cleanup EXIT
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh list_file="" cleanup() { [[ -n "$list_file" && -f "$list_file" ]] && rm -f "$list_file" } trap cleanup EXIT
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill clearly instructs the agent to read repository files and execute shell commands, but it does not declare any explicit tool scope such as allowed-tools or permissions. This makes the effective capability boundary ambiguous and increases the risk of overbroad tool use or accidental privilege expansion when the skill is activated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger language is very broad, matching common verbs like create, produce, edit, trim, merge, and render. Overbroad activation increases the chance that the skill runs in contexts where shell access, file operations, or external API behaviors are unnecessary, expanding exposure and making accidental misuse more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly asks users to paste an API key into chat, then proposes placing that secret into an environment variable. Requesting secrets through ordinary conversation channels increases the risk of credential leakage through chat logs, transcript retention, or accidental reuse by other tools and steps.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill tells the agent to export a user-supplied API key into the shell environment and run
pip install ponyflashon the host. Host environment modification and package installation exceed a narrow media-task boundary and can introduce credential exposure, persistence, supply-chain risk, and uncontrolled system changes.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text If verification fails: - **Key invalid or missing** → direct user to https://api.ponyflash.com/api-key - **Balance is zero** → direct user to https://api.ponyflash.com/usage to top up credits ## Step 1B: Local Dependency Setup for FFmpeg Tasks
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text If verification fails: - **Key invalid or missing** → direct user to https://api.ponyflash.com/api-key - **Balance is zero** → direct user to https://api.ponyflash.com/usage to top up credits ## Step 1B: Local Dependency Setup for FFmpeg Tasks
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text If verification fails: - **Key invalid or missing** → direct user to https://api.ponyflash.com/api-key - **Balance is zero** → direct user to https://api.ponyflash.com/usage to top up credits ## Step 1B: Local Dependency Setup for FFmpeg Tasks
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text If verification fails: - **Key invalid or missing** → direct user to https://api.ponyflash.com/api-key - **Balance is zero** → direct user to https://api.ponyflash.com/usage to top up credits ## Step 1B: Local Dependency Setup for FFmpeg Tasks
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill authorizes local shell script execution and, if needed, fallback to raw
ffmpegcommands. Even though the use case is media editing, granting general subprocess execution without tight argument validation or command allowlisting materially increases the risk of command injection, unsafe file access, and execution beyond the intended task.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to create new markdown files and update
playbooks/INDEX.mdin the repository on user request. Repository write capability is broader than simple media generation/editing and can be abused for unauthorized content modification, prompt persistence, or planting misleading operational guidance for future runs.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These examples read local image, audio, and video files and pass them directly to remote generation APIs, but the documentation does not warn that the media will leave the local device and be transmitted to an external service. Users may unknowingly upload sensitive photos, voice recordings, or videos, creating privacy, confidentiality, and compliance risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The reference-audio example opens a local song file and submits it to a music generation API without disclosing that the audio is sent off-device. This can expose private, copyrighted, or unreleased audio content to an external provider without the user's informed awareness.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code hard-codes
voice="English_Graceful_Lady", which imposes an English-language output setting in natural-language behavior. Under the policy, forcing a specific language or locale without user opt-in is a violation unless the constraint is clearly justified or optional.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The playbook hard-codes 'all written communication' to English, which overrides or ignores user language preferences and can cause unsafe misunderstandings in a multilingual creative workflow. In this media-production context, users may supply requirements, approvals, or legal/brand constraints in other languages, so forcing English can reduce clarity and informed consent at key checkpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The overwrite example demonstrates destructive file replacement with
--overwritebut does not instruct the agent to confirm with the user before replacing existing outputs. In an automation context, this can cause unintended data loss or clobber important files if output paths are reused or influenced by prior workflow state.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples add a font-download workflow via
ensure_subtitle_fonts.sh, which expands the skill from local media processing into network retrieval of executable-adjacent assets. Even if fonts are not code, introducing downloads increases supply-chain and data-exfiltration surface, especially because the manifest emphasizes local editing/generation and the examples normalize fetching remote resources without clearly constraining source, integrity, or user consent.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation states that Google web and image search are enabled by default for this image-generation model, but it does not warn that prompts and potentially user-provided context may be transmitted to external Google services. In a media-generation skill, users may submit sensitive prompts or reference-image-derived context, so silent default external search/grounding creates a meaningful privacy and data-governance risk.
- Content
Static analysis
No suspicious patterns detected.