AI图转视频专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:09 AM UTC
• Version: 1.0.1

Overview

This appears to be a real LinkFox image-to-video integration, but it also handles login, API keys, payments, and media downloads with weak scoping that deserves review before use.

Install only if you trust LinkFox with your image URLs, prompts, phone/SMS onboarding data, account token, and billing actions. Use only the official LinkFox endpoint environment values, avoid storing long-lived API keys in shell startup files when possible, and treat payment QR creation as a deliberate user-approved billing step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-aigc-videogen/scripts/aigc_videogen.py:37

Finding

Authentication credentials and personal data can be redirected to attacker-controlled endpoints

Content

View full analysis

str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError as e: return {"_error": str(e)} try: r = reque ...[truncated 3029 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/linkfox-aigc-videogen/scripts/onboarding.py:484

Finding

Full API keys are exposed through standard output and plaintext shell persistence instructions

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key obtained successfully (source: {r['source']})", file=sys.stderr) return 0 return 1 ``` The accompanying onboarding instructions recommend putting the complete key in command arguments and shell startup files: ```shell setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis A successful onboarding operation includes the complete API key in a dictionary that is serialized directly to standard output. In an AI-agent environment, standard output may be copied into chat transcripts, tool logs, debugging traces, orchestration records, or support bundles. The documented configuration commands additionally place the key in command-line text and persistent plaintext shell init ...[truncated 1458 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/linkfox-aigc-videogen/scripts/aigc_videogen.py:168

Finding

Unrestricted media download permits internal-network requests and unbounded disk consumption

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (44)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script allows service base URLs to be overridden by environment variables and then sends sensitive material to those endpoints via requests.post, including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In an agent or shared runtime, a malicious wrapper or parent process could redirect these calls to attacker-controlled infrastructure and silently exfiltrate credentials.

Content

Scanner excerpt · skills/linkfox-aigc-videogen-multi/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is also environment-controlled and used by urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. This permits exfiltration of bearer credentials and account/order data to an attacker-controlled host if the process environment is tampered with.

Content

Scanner excerpt · skills/linkfox-aigc-videogen-multi/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-videogen-multi/scripts/aigc_videogen_multi.py (reported line 201)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-videogen/scripts/aigc_videogen.py (reported line 201)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-videogen-multi/scripts/aigc_videogen_multi.py (reported line 298)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 296, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-videogen/scripts/aigc_videogen.py (reported line 298)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-videogen/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-videogen/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code clearly performs image-to-video generation, so it is related to the declared domain. However, the description claims support for both 参考图模式 and 首尾帧模式 across specific model families, while this code chunk is specifically for '多参考图生视频' and calls a dedicated multiImageVideoGenAsync endpoint. There is no logic in this chunk indicating first/last-frame handling, mode switching, or validation/routing among the listed models. The local file saving and polling are supporting details, not mismatches. The key issue is that the declared functionality is materially broader than what this code actually implements.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill converts images into short videos with specific generation modes and model backends. The supplied code does nothing related to image input, video generation, media processing, or the listed model providers. Instead, it is entirely focused on LinkFox account onboarding and commerce flows: SMS verification, login, token acquisition, user/team info retrieval, package listing, order creation, and payment QR generation/querying. This is a materially different primary purpose and introduces undeclared capabilities involving authentication, account access, and billing/payment operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about generating short videos from images. The supplied code does not implement any image, video, or media-generation functionality at all. Instead, it is an onboarding and commerce utility for LinkFox accounts: it calls login/account/order APIs, handles SMS-based authentication, manages API tokens, lists plans, creates payment orders, and renders QR codes for payment. This is a materially different primary purpose and includes undeclared capabilities related to authentication, billing, and account management. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented API exposes a multi-reference-image video generation capability, while the declared skill scope is limited to single-image reference mode and first/last-frame mode. This kind of scope mismatch is dangerous because an agent may gain access to undeclared functionality and process more user-provided media than users or reviewers expect, undermining least-privilege and creating hidden data-flow and policy-scope risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code advertises and implements a multi-reference-image video generation flow, while the manifest describes a different image-to-video skill focused on reference-image and first/last-frame modes. This mismatch can cause the wrong capability to be invoked under a trusted skill identity, undermining review assumptions and potentially sending user media to an unintended backend workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This skill is described as image-to-video generation, but the onboarding script performs account lifecycle and commercial functions including login, API key retrieval, package discovery, ordering, and payment QR rendering. That scope expansion increases the amount of sensitive data handled and introduces unnecessary attack surface unrelated to the declared purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The billing and payment-order logic is not justified by the stated image-to-video capability and enables the skill to create orders and generate payment QR codes. In a skill ecosystem, unexpected payment functionality materially raises abuse risk, including tricking users into purchases or facilitating unauthorized billing flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs SMS authentication, token exchange, user/team enumeration, and API key generation, which is highly sensitive functionality unrelated to simple media generation. Embedding credential issuance inside a content skill increases the chance of token theft, misuse, or deceptive collection of user authentication factors.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skills/linkfox-aigc-videogen-multi/references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skills/linkfox-aigc-videogen/references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This onboarding script performs SMS login, token handling, API-key issuance, plan discovery, and account/payment operations that are not necessary for a normal image-to-video runtime path. In the context of a media-generation skill, collecting credentials and enabling account commerce materially expands attack surface and creates opportunities for credential harvesting or unauthorized account actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code can create orders and generate payment QR codes, which is unrelated to converting images into videos and therefore suspicious in this skill context. Even if intended for legitimate subscription purchase, embedding payment initiation inside the skill increases the chance of deceptive purchases, abuse, or social engineering through the agent interface.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill explicitly describes capabilities that involve network access and reading/writing task artifacts in the workspace, but it declares no tool scope restrictions such as allowed-tools or permissions. In an agent framework, missing scope constraints can let the skill invoke more powerful tools than necessary, increasing the blast radius if the skill is misrouted, modified, or prompt-injected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases include broad natural-language expressions like '把这张图动起来' and generic 'image to video' wording, which can cause accidental or overly eager activation. In an agent environment, overbroad triggers may route unrelated user content, images, and prompts into downstream services without the user clearly intending this specific skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs the agent to send image URLs and prompts to downstream video-generation services, but it does not prominently warn users that their media references and text inputs will leave the current agent context. This creates a privacy and consent risk, especially if users provide sensitive, private, or copyrighted content without realizing it will be shared with external processors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill directs the agent to read task records from workspace storage and notes that responses and downloaded media are written locally, but it does not provide a clear user warning about this persistence. Local storage of task metadata, prompts, file paths, and error details can expose sensitive information to other tools, sessions, or operators if retention and access are not tightly controlled.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger description is broad enough that the skill may activate for generic image-to-video requests without clear boundaries, increasing the chance of unintended invocation. In an agent setting, that can route user images and prompts to this external video-generation workflow unexpectedly, causing unnecessary external data transfer and user confusion.

Content

No source excerpt is available for this finding.