Security audit

Flyworks Avatar Video

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it handles face and voice media, uploads local files to a third-party service, and uses a shared embedded API token with too little user-facing safety and privacy control.

Review this skill before installing. Only upload images and voice samples you own or have explicit permission to use, assume those files and prompts are sent to Flyworks/HiFly infrastructure, set your own API token only if you understand account and quota impact, and prefer a pinned, project-local installation in an isolated environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/hifly_client.py:10
Finding: Hardcoded Shared Bearer Token Used as an Automatic Fallback
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unpinned Python Dependency Produces Non-Reproducible and Unsafe Builds
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:16
Finding: Installation Instructions Execute an Unpinned npx Package and Install an Unpinned Repository Revision
Content: View full analysis
Remediation: View remediation
add -a claude-code ``` 2. Reference an immutable repository commit or signed release instead of a mutable repository default branch. 3. Publish expected commit identifiers or checksums and instruct users to verify them before installation. 4. Prefer project-local installation over global installation so a compromised component has a smaller persistence and exposure scope. 5. Run installation without elevated privileges and in an isolated environment where practical. 6. Review installer updates separately before changing the pinned version. 7. Consider replacing executable bootstrap instructions with a transparent manual download-and-verification process for security-sensitive environments. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior goes beyond the declared purpose by relying on an embedded default API token and persisting aliases in memory.json without clearly surfacing those behaviors as security- and privacy-relevant features. Hidden credentials can be abused for unauthorized third-party API use, and undeclared persistence can retain sensitive identifiers or user-specific data longer than expected.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 7)May include surrounding context.
md
## Features - 🎬 **Public Avatar Video**: Create videos using pre-made realistic avatars with TTS - 🖼️ **Talking Photo**: Turn any image into a talking video - 🎙️ **Voice Cloning**: Clone voices from audio samples

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes talking-photo generation and voice cloning from user-supplied images/audio but does not warn about consent, biometric/privacy sensitivity, or the risks of uploading personal media to a third-party service. In this context, the omission is meaningful because the skill is specifically designed to process highly sensitive likeness and voice data, which could lead users to misuse the feature or expose personal data without informed consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and documents capabilities that read environment variables, access local files, write to local state, and make network requests, but it does not declare any tool scope or allowed-tools boundary. That increases the chance an agent will invoke broader-than-expected capabilities without explicit operator review, especially when handling user-supplied paths, media, and remote URLs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Voice cloning is a sensitive biometric and impersonation capability, and the skill describes it as a normal feature without requiring consent or warning about privacy, fraud, or misuse risks. In this context, omission of consent and safety guidance makes accidental or abusive impersonation substantially easier.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The examples instruct users to upload custom photos and audio, including potentially sensitive personal media, to a remote service without clearly warning that data will leave the local environment. In a skill centered on avatars and voice cloning, that omission is materially risky because facial images and voice samples are highly sensitive and can enable identity misuse if mishandled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents creating talking-photo avatars from arbitrary portrait images, including remote image URLs, without any warning about consent, privacy, rights of use, or biometric-data sensitivity. This can enable non-consensual avatar generation or misuse of third-party images, which is especially risky in a digital-human/video generation context where impersonation and deceptive media are plausible outcomes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation instructs users to upload or reference audio samples for voice cloning without any warning about obtaining consent, protecting biometric voice data, or the fact that samples may be transmitted to an external service. Because cloned voices can enable impersonation, privacy violations, and misuse of sensitive audio, omission of these safeguards creates a real security and abuse-enablement risk in the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script embeds a working default API token and automatically uses it when no user token is configured. This enables anyone running the skill to consume a third-party account or service allocation without explicit authorization, and normalizes secret-in-code practices that can lead to abuse, quota exhaustion, and account misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill accepts local file paths and uploads those files to a remote third-party service with no explicit consent prompt or strong disclosure at the point of transmission. In an agent-skill context, this increases the risk of accidental exfiltration of sensitive local files if a user or upstream tool passes an unintended path.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/hifly_client.py (reported line 130)May include surrounding context.
python
headers = get_headers() try: resp = requests.post(url, headers=headers, json=payload) resp.raise_for_status() data = resp.json() if data.get("code", 0) != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/hifly_client.py (reported line 237)May include surrounding context.
python
headers = get_headers() try: resp = requests.post(url, headers=headers, json=payload) resp.raise_for_status() data = resp.json() if data.get("code", 0) != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/hifly_client.py (reported line 265)May include surrounding context.
python
headers = get_headers() try: resp = requests.post(url, headers=headers, json=payload) resp.raise_for_status() data = resp.json() if data.get("code", 0) != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/hifly_client.py (reported line 302)May include surrounding context.
python
headers = get_headers() try: resp = requests.post(url, headers=headers, json=payload) resp.raise_for_status() data = resp.json() if data.get("code", 0) != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/hifly_client.py (reported line 347)May include surrounding context.
python
headers = get_headers() try: resp = requests.post(url, headers=headers, json=payload) resp.raise_for_status() data = resp.json() if data.get("code", 0) != 0:

Tainted flow: 'upload_url' from requests.post (line 137, network input) → requests.put (network output)

Medium

Category: Data Flow
Confidence: 93% confidence
Finding: The code trusts an upload URL returned by a remote API and then performs a PUT of a local file directly to that URL without validating the destination host, scheme, or expected storage provider. If the API is compromised or returns an unexpected presigned URL, the client will exfiltrate arbitrary local file contents to an attacker-controlled endpoint.
Content: Scanner excerpt · scripts/hifly_client.py (reported line 145)May include surrounding context.
python
print(f"Uploading {file_path.name}...") with open(file_path, 'rb') as f: headers_put = {"Content-Type": content_type} resp_put = requests.put(upload_url, data=f, headers=headers_put) resp_put.raise_for_status() print(f"Upload successful. File ID: {file_id}")

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README instructs users to provide their own API token for non-demo usage without warning that doing so may incur charges, consume account quotas, or expose the user's external account to unintended actions. While not a code-execution flaw, it is a real safety issue because agents or users may proceed without understanding the financial/account impact of enabling live credentials.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency manifest specifies requests without a version pin, which makes builds non-reproducible and can pull in unexpectedly old or newly broken releases depending on the installation environment. In a skill that likely performs outbound API calls for avatar/video generation, this increases supply-chain and maintenance risk because security posture depends on whichever version gets resolved at install time.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Because requests is unpinned, it is impossible to verify from this manifest whether installation will select a version affected by known advisories, including issues involving credential leakage or TLS/request verification behavior. For a network-integrating skill, that uncertainty is meaningful: if deployed in an environment that resolves an affected release, API tokens, session behavior, or request handling could be exposed to known weaknesses.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: save_memory persistently writes alias mappings to memory.json, but there is no prior warning that user-provided aliases and IDs will be stored on disk. The later success message confirms saving occurred, but it does not serve as advance disclosure of the file write behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comment at L227 states 'Should call create_video_tts but here we are,' indicating the documented intent for text input is to invoke TTS handling. The actual code instead rejects text input with an error and returns, so the inline documentation explicitly conflicts with runtime behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.