Litmedia

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent LitMedia media-generation integration, but it handles account credentials and identity media with unsafe logging and overreaching agent instructions that need review before installation.

Review this skill before installing. Use it only with media you are authorized to upload, especially faces and voices; expect files to be uploaded to LitMedia and credits to be consumed. Avoid running authentication where console output is logged or shared until the raw OAuth response logging is fixed, and treat the local ~/.LitMedia credentials file as sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:27

Finding

Mandatory Skill Instructions Hijack Agent Responses and Suppress Operational Transparency

Content

View full analysis

**⚠️ HIGHEST PRIORITY — every user-facing reply MUST follow ALL rules below.** > > Most users are non-technical. Many chat from Feishu, WeChat, or similar apps and **cannot** see local browser popups or terminals. 1. **Keep replies short** — give the result or next step directly. If one sentence is enough, don't write three. 2. **Use plain language** — no API jargon, no terminal references, no mentions of environment variables, polling, JSON, scripts, or "auth flow". Speak as if the user has never seen a command line. 3. **Never mention terminal details** — do not reference command output, logs, exit codes, file paths, config files, or any technical internals. These mean nothing to the user. 4. **Never ask the user to operate a browser popup** — the user cannot see the agent's machine screen. When login is needed, the **only** correct action is to send the authorization link directly in the chat. 5. **Always send the direct login link** — extract `URL: ...` from `auth.py login` output and use the login template below. Never say "browser opened" or similar. **If the URL is not found in the output, re-run `auth.py login` to get a new link. Never skip sending the link.** 6. **Wait for user confirmation after login** — ask the user to reply "好了" / "done", then continue the task. 7. **Handle account switching properly** — when switching accounts, use `auth.py accountswitch` and remind the user to log out of their current LitMedia web account or log in with the new account on the website first. After the switch, wait for user confirmation before proceeding. 8. **Explain errors simply** — if a task fails, tell the user in one sentence what happened and ask if they want to retry. Never paste ...[truncated 3637 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auth.py:168

Finding

OAuth Device and Approval Responses Are Printed Without Redaction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:275

Finding

Pending OAuth Device Secret Is Stored Without Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Mutable Unpinned Dependencies Execute in a Credential-Handling Process

Content

View full analysis

=2.28.0 python-dotenv>=1.0.0 ``` The documented installation instruction is: ```bash pip install -r {baseDir}/scripts/requirements.txt ``` ### Technical Analysis The lower-bound-only constraints permit the package resolver to install any future release of `requests` or `python-dotenv`. No lock file, package hashes, or trusted index restriction is provided. These dependencies execute in the same Python process as code that: - Reads `LITMEDIA_API_KEY` and `LITMEDIA_UID` from the environment. - Reads `~/.LitMedia/credentials.json`. - Sends authenticated requests. - Processes OAuth responses. - Reads and uploads user-selected image, audio, and video files. There is no evidence that the named packages are currently malicious or typosquatted. The confirmed weakness is the mutable supply-chain trust boundary: installation at a later date may resolve to code that was not reviewed during this audit. ### Attack Path 1. A user or agent follows the documented `pip install` instruction. 2. The package resolver queries its configured package index. 3. It selects versions newer than those reviewed by the Skill author. 4. A selected release is compromised, malicious, or incompatible, or the resolver is directed to an untrusted index containing a substituted package. 5. Package installation or subsequent import executes attacker-controlled code. 6. That code reads environment variables, local credentials, and media files or intercepts authenticated network requests. ### Impact Assessment A compromised dependency would execute with the same operating-system privileges as the agent or user running the Skill. It could potentially: - Read and exfiltrate LitMedia API credentials. - Access user-selected private media. - Modify generated outputs or API requests. - ...[truncated 251 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (103)

Tainted flow: 'OAUTH_BASE_URL' from os.environ.get (line 31, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The OAuth base URL is taken directly from the environment and used to initiate device authorization without any allowlisting or origin validation. In this script, the same flow later stores returned access tokens and API keys locally and prints parts of server responses, so a maliciously overridden LITMEDIA_OAUTH_URL could redirect authentication to an attacker-controlled endpoint and harvest device codes, account metadata, tokens, or API keys.

Content

Scanner excerpt · scripts/auth.py (reported line 254)May include surrounding context.

python

_delete_credentials()

        resp = requests.post(
            f"{OAUTH_BASE_URL}/oauth/api/device/init",
            json={
                "client_id": CLIENT_ID

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises creation of talking-head/avatar videos from a user's photo without warning about consent, likeness rights, deepfake misuse, or deceptive content risks. Given the skill's explicit ability to generate realistic identity-based media, the absence of guardrails makes misuse substantially more dangerous in this context than in a generic image-editing tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README promotes voice cloning from an uploaded sample without any warning about consent, impersonation, fraud, or applicable legal and policy constraints. In a skill centered on automated media generation, omission of these safeguards materially increases the risk of misuse for deceptive audio or non-consensual biometric/identity replication.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding again points to undeclared data-transfer and account-linked behavior behind a broad marketing description. The risky part is not the exaggerated claims themselves, but that file upload, remote download, and cost/account interactions are security-relevant behaviors omitted from the user-facing declaration.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: litmedia-skill
description: "Generate, Edit, Collaborate. Access all mainstream AI models in one toolkit. Simply describe your vision to create videos, images, and avatars—zero manual operations."
metadata:
  tags: litmedia, avatar, video, image, voice, ai, api, i2v, t2v, a2ls, anim, text2image, image_edit, tts, voice_clone
  requires:
    bins: [python3]
  primaryEnv: LITMEDIA_API_KEY
---

# LitMedia AI Skill

> Modular Python toolkit for the [LitMedia AI](https://www.litmedia.ai) API.

✨ **Generate. Edit. Collaborate. — All in One Place.** ✨

- 🧠 **All Mainstream Models**: Seamless

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The status output includes a masked API key and identifying account details such as uid, name, and email. Even partially masked secrets and account metadata can be exposed through agent logs, chat transcripts, screenshots, or telemetry, increasing the chance of credential leakage or account targeting.

Content

Scanner excerpt · references/auth.md (reported line 93)May include surrounding context.

api_key: sk-...3HB charge_type: pro authorized: 2026-03-04T10:00:00+00:00 file: /Users/you/.LitMedia/credentials.json

text

## `logout` — Remove Credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The credential load priority allows authentication via environment variables, which are commonly exposed through process listings, CI logs, crash reports, and inherited subprocess environments. In an agent ecosystem that may invoke many tools, env-based secrets can spread further than intended and be consumed by unrelated components.

Content

Scanner excerpt · references/auth.md (reported line 135)May include surrounding context.

md

All modules use `shared/config.py` which loads credentials in this order:

1. Environment variables `LITMEDIA_UID` + `LITMEDIA_API_KEY` (CI/scripting)
2. `~/.LitMedia/credentials.json` (set by `auth.py login`)
3. Error — prompts to run `auth.py login`

## Agent Rules

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The script persists sensitive credentials, including API keys and possibly access tokens, in a local JSON file under the user's home directory. Although chmod(0o600) helps on Unix-like systems, plaintext storage still creates a high-value target for malware, local compromise, backups, or other processes with user-level access.

Content

Scanner excerpt · scripts/auth.py (reported line 38)May include surrounding context.

python

DEFAULT_SCOPE = "read:profile read:billing read:apikey"

CRED_FILE = Path.home() / ".LitMedia" / "credentials.json"
PENDING_FILE = Path.home() / ".LitMedia" / "pending_device.json"
LOGIN_TIMEOUT = 600  # 10 minutes, matching server-side expiry

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The polling flow prints the full OAuth token/status response, which may contain credential-related account data such as access tokens, API keys, email, UID, and other metadata. Exposing such responses to stdout risks credential leakage into shell history captures, CI logs, agent transcripts, or telemetry systems.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth.md (reported line 32)May include surrounding context.

md

Priority order:
1. Environment variables LITMEDIA_UID + LITMEDIA_API_KEY  (CI / backwards compat)
2. Credential file ~/.LitMedia/credentials.json           (set by auth.py login)
3. Error — prompts user to run auth.py login
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth.md (reported line 47)May include surrounding context.

md

Priority order:
1. Environment variables LITMEDIA_UID + LITMEDIA_API_KEY  (CI / backwards compat)
2. Credential file ~/.LitMedia/credentials.json           (set by auth.py login)
3. Error — prompts user to run auth.py login
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth.md (reported line 112)May include surrounding context.

md

Priority order:
1. Environment variables LITMEDIA_UID + LITMEDIA_API_KEY  (CI / backwards compat)
2. Credential file ~/.LitMedia/credentials.json           (set by auth.py login)
3. Error — prompts user to run auth.py login
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth.md (reported line 128)May include surrounding context.

md

Priority order:
1. Environment variables LITMEDIA_UID + LITMEDIA_API_KEY  (CI / backwards compat)
2. Credential file ~/.LitMedia/credentials.json           (set by auth.py login)
3. Error — prompts user to run auth.py login
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/shared/config.py (reported line 5)May include surrounding context.

python

Priority order:
1. Environment variables LITMEDIA_UID + LITMEDIA_API_KEY  (CI / backwards compat)
2. Credential file ~/.LitMedia/credentials.json           (set by auth.py login)
3. Error — prompts user to run auth.py login
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/shared/config.py (reported line 20)May include surrounding context.

python

Priority order:
1. Environment variables LITMEDIA_UID + LITMEDIA_API_KEY  (CI / backwards compat)
2. Credential file ~/.LitMedia/credentials.json           (set by auth.py login)
3. Error — prompts user to run auth.py login
"""

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README tells users to 'just tell the AI what you need' without defining clear trigger boundaries, constraints, or exclusion conditions. In a skill context, this kind of open-ended activation language is ambiguous and may overlap with ordinary conversation, making it unclear when the skill should activate versus when it should not.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The statement that users can 'freely combine' capabilities into 'any workflow you can think of' describes the skill's trigger scope in extremely broad natural language. It does not provide explicit boundaries, supported request types, or examples of unsupported requests, increasing the risk of accidental or inappropriate invocation.

Content

No source excerpt is available for this finding.