AIGC视频生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:52 AM UTC
• Version: 1.2.3

Overview

The skill appears to generate LinkFox videos as advertised, but it also handles login, reusable API keys, and billing with weak scoping and credential-handling controls.

Install only if you are comfortable giving this skill access to LinkFox account credentials, phone-based onboarding, paid quota operations, and external processing of your image URLs and prompts. Prefer a securely stored API key, avoid overriding LinkFox endpoint environment variables, do not place secrets in shell startup files if your environment is shared or logged, and review payment prompts before creating any order.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/aigc_videogen.py:38

Finding

Credential-bearing requests can be redirected to arbitrary environment-controlled endpoints

Content

View full analysis

str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorizati ...[truncated 3777 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:511

Finding

Generated API key is exposed through plaintext standard output and shell configuration guidance

Content

View full analysis

dict: hdr = _headers("agent-linkfox-web", "ai.linkfox.com", access_token=access_token, user_id=user_id, group_id=group_id) for path, source in (("/group/getApiToken", "existing"), ("/group/generateApiToken", "generated")): resp = _http_post(f"{_agent_user_base()}{path}", {"id": group_id}, hdr) if "_error" in resp: return {"error": f"{path.rsplit('/', 1)[-1]}: {resp.get('_body') or resp['_error']}"} tok = _extract_token(resp) if tok: return {"api_key": tok, "source": source} ``` ```python tok = _get_or_generate_api_token(lg["access_token"], lg["user_id"], info["group_id"]) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 ``` The documentation additionally recommends commands equivalent to: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login command returns the complete reusable API key in a d ...[truncated 1796 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/aigc_videogen.py:46

Finding

Unsanitized SESSION_ID permits writes outside the intended session directory

Content

View full analysis

str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is accepted as an arbitrary path component. The code does not reject path separators, `..` components, drive-qualified paths, or absolute paths. When the final argument to `os.path.join` is absolute, Python discards the earlier root components. Traversal components can likewise cause the normalized destination to leave the expected date and session tree. Subsequent operations create directories and write metadata, generated API responses, media files, or payment QR images at the resulting location. The generated filenames reduce the likelihood of overwriting a specifically chosen file, but the attacker can still redirec ...[truncated 1316 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/aigc_videogen.py:151

Finding

API-provided media URLs are downloaded without destination or size restrictions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163

Finding

Runtime guidance recommends installing unpinned third-party dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis When dependencies are unavailable, the script recommends installing `qrcode`, `pillow`, and `requests` without exact versions, hashes, a lock file, or a trusted package-index requirement. Running those commands resolves whatever versions are currently available through the user's pip configuration. Installation may execute package build hooks or other packaging logic. The audit did not identify typosquatted package names or an actively malicious dependency, so this is a supply-chain hardening issue rather than evidence of deliberate dependency compromise. ### Attack Path 1. The user runs onboarding in an environment where one of the optional packages is missing. 2. The script displays an unpinned `pip install` command. 3. The user runs the command against their configured package index or mirror. 4. pip downloads mutable package versions and may execute packaging or build code. 5. If the index, mirror, account, or newly resolved release is compromised, malicious code executes with the privileges of the installing user. ### Impact Assessment The impact depends on the privileges used to run pip. A compromised dependency could potentially: - Execute arbitrary code as the installing user - Read environment variables and API credentials - Modify the Python environment - Tamper wit ...[truncated 192 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (21)

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/aigc_videogen.py (reported line 201)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The skill sends several environment-derived values, including SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME, as HTTP headers on every API request. Even though the destination is intended to be the LinkFox gateway, the base URL is overrideable via LINKFOX_TOOL_GATEWAY, so a manipulated environment can redirect requests and cause metadata disclosure to an unintended host.

Content

Scanner excerpt · scripts/aigc_videogen.py (reported line 298)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The code builds destination URLs from environment variables and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints via requests.post. If an attacker can influence the runtime environment, they can redirect authentication and token-issuance traffic to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The gateway request URL is also derived from environment-controlled base URLs and used by urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. A manipulated environment can redirect these authenticated requests to attacker infrastructure, leaking API credentials and enabling unauthorized account actions such as querying plans or creating orders.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is video generation, but the analyzed behavior reportedly includes SMS login, API key generation, account/team data access, package listing, order creation, payment initiation, QR code generation, and payment-status polling. That is a significant expansion into authentication, billing, and account management flows, which can expose sensitive data, trigger unintended purchases, or perform actions the user did not clearly authorize.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements SMS login, API key acquisition, subscription enumeration, order creation, and payment QR generation, which are materially broader than the declared purpose of a video-generation skill. In skill ecosystems, hidden onboarding and payment flows increase the risk of credential harvesting, unauthorized billing, and deceptive collection of user account access under a misleading capability description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code contains purchase and payment functionality, including order creation and QR-code rendering for payment, despite the skill being presented as a video-generation tool. That mismatch makes the skill context more dangerous because users may not expect commerce actions, increasing the chance of social-engineering abuse or unauthorized charges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The login flow obtains or generates a LinkFox API key and returns it to the caller, which exceeds the stated video-generation purpose and grants reusable credentials that can be abused beyond a single task. In this context, the skill effectively acts as an account-provisioning and credential-brokering tool, making compromise or misuse far more severe than ordinary content generation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation describes capabilities that require environment access, file writes, and network usage, but it declares no explicit tool scope or permission boundaries. This increases the chance of over-privileged execution, making it harder for the platform or reviewer to restrict what the skill can access and increasing blast radius if the skill or its dependencies behave unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include broad, common requests such as '生成视频', '做个视频', and 'generate video', which can cause accidental invocation outside the user's intended context. Unintended activation is especially risky here because the skill performs network operations, writes files, and may connect to broader account or billing flows per the described/observed behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

This skill is inherently designed to transmit user-supplied inputs such as imageUrl, prompts, and optional frame images to an external video-generation service. In the context of an agent skill, that is a real data-transfer risk if users are not informed that their content will leave the local system and be processed by a third-party backend.

Content

Scanner excerpt · references/api.md (reported line 134)May include surrounding context.

{"errcode": 401, "errmsg": "authorized error"}

text

## curl 示例

创建任务：
```bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Feedback API instructs submission of freeform content describing what the user said and what happened, but does not warn that this information may be transmitted to an external service. In an agent context, this can cause unannounced exfiltration of user statements, potentially including personal, confidential, or regulated data copied from conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The onboarding flow instructs users to provide a phone number to a script-driven registration path, but it gives no privacy notice, consent language, retention details, or warning about transmitting personal data through the agent workflow. In a support/onboarding context, this increases the risk of unnecessary collection or mishandling of personally identifiable information, especially because users may assume the agent is an appropriate channel for sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code explicitly includes environment-derived session and application metadata in outbound HTTP headers without any visible consent, notice, or minimization. This creates a privacy and information-disclosure issue, especially because those identifiers may be sensitive operational metadata and the gateway endpoint can be overridden by environment configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI description and command behaviors are entirely specified in Chinese, and the login flow enforces area code +86 with 11-digit domestic phone validation. There is no indication that users can opt into this language/locale restriction or choose an alternative locale.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The code performs API token retrieval and generation without any direct in-file user warning or confirmation that a reusable credential will be created and returned. In a skill setting, silent credential issuance is risky because users may believe they are only logging in for video generation, not minting an access key that could be reused elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file title and introductory text are entirely in Chinese, and the document does not indicate that language selection is optional or that the skill is region-specific. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill manifest describes an AI video generation tool triggered by requests to create videos from images and prompts. Lines L154-L174 document a separate public feedback endpoint for sending sentiment/category/content about the skill, which is not an obvious requirement of generating videos and adds an unrelated capability surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

All user-facing instructions in the skill are presented in Chinese and do not indicate that another language can be used or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.