AIGC多场景视频生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:55 AM UTC
• Version: 1.2.3

Overview

This video-generation skill also handles login, API keys, and payment orders in ways that need careful review before installation.

Install only if you are comfortable with this skill sending images, prompts, phone numbers, verification codes, tokens, and billing requests to LinkFox services. Do not use environment overrides for LinkFox endpoints unless you fully trust them, avoid storing API keys in shell startup files, and review any payment/order action before approving it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/aigc_videogen_multi.py:37

Finding

Configurable endpoints allow sensitive credentials and user data to be sent to arbitrary hosts

Content

View full analysis

str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api ...[truncated 3286 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:487

Finding

Generated API key is exposed through standard output and recommended for plaintext persistence

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key obtained successfully (source: {r['source']})", file=sys.stderr) return 0 return 1 ``` The documentation recommends commands equivalent to: ```shell setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login command returns the complete generated API key in its result object. `_emit` serializes the entire object to standard output without redaction. In an Agent environment, standard output may be retained in conversation history, execution telemetry, terminal logs, CI logs, or orchestration records. The onboarding documentation also recommends persisting the key directly in shell startup files or the user environment. These storage locations are not purpose-built secret stores and may be exposed through backups, support bundles, process environments, shell configuration sharing, or overly broad file permissions. Although the user needs a way to configure the key, routine disclosure through stdout and plaintext persistence are not the least-privilege mechanisms for credential provisioning. ...[truncated 1086 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:163

Finding

Onboarding recommends installing unpinned runtime dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` The installation commands prescribed by these branches are: ```shell pip install qrcode pillow pip install requests ``` ### Technical Analysis The project does not include a dependency lockfile, exact package versions, cryptographic hashes, or a pinned package index. When required modules are absent, it instructs users to install the latest packages resolved by the active pip configuration. This creates a supply-chain exposure because the executed code can vary after the Skill has been audited. A compromised package release, malicious configured package index, or future incompatible package version could introduce unreviewed behavior into the Agent environment. The package names shown are established packages rather than apparent typosquatting attempts, and the script does not install them automatically. Consequently, this is a hardening issue rather than evidence of deliberate dependency confusion. ### Attack Path 1. The onboarding command runs in an environment where `requests`, `qrcode`, or Pillow is absent. 2. The script instructs the user to run an unpinned `pip install` command. 3. The active pip configuration resolves packages from a compromised or attacker-controlled index, or reso ...[truncated 673 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/aigc_videogen_multi.py:166

Finding

API-supplied media URLs are downloaded without destination validation or size limits

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/aigc_videogen_multi.py (reported line 201)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/aigc_videogen_multi.py (reported line 298)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends highly sensitive data to them, including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker or untrusted host controls the environment, they can redirect these authentication flows to a malicious endpoint and exfiltrate credentials with little visibility to the user.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The gateway URL is also derived from environment variables and used in urllib requests carrying the bearer API key in the Authorization header. An attacker who can influence the runtime environment can redirect these requests to a hostile server and capture the API key and account/order metadata, enabling unauthorized use of the victim's account.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a strong description-behavior mismatch: a video-generation skill reportedly also supports phone-based login, API key generation, account/team data access, package listing, order creation, payment QR generation, and payment-status queries. Hidden account, authentication, and payment flows materially expand the attack surface and can mislead users or orchestrators into authorizing sensitive operations they did not intend.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements account onboarding, SMS login, API key acquisition, plan discovery, and payment/order operations, which are materially broader than the declared purpose of a multi-image video generation skill. Such hidden expansion of scope increases the attack surface and creates unnecessary opportunities to collect credentials and drive commercial actions unrelated to the user’s expected task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code can list purchasable plans, create orders, and render payment QR codes, introducing financial transaction capability that is not justified by the manifest’s video-generation description. In a skill context, this is especially dangerous because users may not expect the tool to initiate purchase flows or write payment artifacts to disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file performs SMS-based authentication, token exchange, team selection, and API token generation, which go well beyond media generation and involve direct handling of credentials and long-lived secrets. In this skill context, that mismatch makes the behavior more suspicious because it quietly turns the skill into an account bootstrapper and secret issuer.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documentation indicates capabilities that require environment access, network access, and local file writes, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope declarations weakens least-privilege controls and can allow broader-than-expected access during execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states that generated videos are automatically downloaded into a local media directory and raw API responses are silently persisted to a data directory, but it does not prominently warn the user or obtain consent for local storage. This can expose sensitive prompts, signed URLs, metadata, or generated media to unintended local retention and later access by other tools or users in the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The API documentation instructs sending user-provided images and prompts to an external service but does not include any warning or consent guidance. In this skill context, images and prompts may contain sensitive personal, proprietary, or biometric information, so omission of disclosure materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 133)May include surrounding context.

{"errcode": 401, "errmsg": "authorized error"}

text

## curl 示例

创建任务：
```bash

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation includes a separate feedback submission endpoint unrelated to the primary video-generation function, creating an additional data egress path from the skill. Because it can transmit free-text content to a different external domain, it expands the attack surface and may enable silent exfiltration of user or conversation data if the skill invokes it without explicit user awareness and consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The feedback API section documents sending free-text feedback to a separate external endpoint without warning that the content leaves the primary tool path. Free-text fields are especially prone to containing sensitive conversation details, identifiers, or secrets, making undisclosed transmission risky.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill guidance is written as Chinese-only operator instructions and tells the agent to relay configuration and onboarding steps to users in that form, without any opt-in or alternative locale. This can violate language/locale policy when the skill is used in broader contexts where users have not chosen Chinese.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to solicit a user's phone number and use it in a script-driven registration flow, but it provides no privacy notice, consent language, retention limits, or safe-handling guidance for this personal data. In an agent context, collecting PII without explicit disclosure and minimization increases the risk of unnecessary exposure, logging, or misuse of the user's phone number and one-time code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s natural-language interface, help text, and validation logic are entirely Chinese-centric, including an 11-digit domestic phone requirement and fixed +86 area code. There is no indication that the user can opt into this locale or that the tool is intentionally restricted to a China-specific audience.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This code transmits sensitive authentication data to external services, including phone numbers, verification codes, and tokens. External transmission is expected for login functionality, but in this file it becomes security-relevant because the destination can be environment-controlled and the functionality is outside the core video-generation scope.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script generates or retrieves an API token and returns it in output without any in-file user-facing warning, consent gate, or handling guidance. Exposing a newly issued credential through normal CLI output increases the chance of accidental disclosure via logs, transcripts, shell history, or higher-level agent instrumentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The render_qr function saves a PNG file containing payment QR data to a session directory on disk. While the skill logs some operational details elsewhere, this file-write behavior is not disclosed to the user in this code path, and the saved artifact may persist in workspace, home, or temp directories.

Content

No source excerpt is available for this finding.