T05 · Unauthorized Access and Privilege Escalation
Error
- Location
script/invoke_model.py:25- Finding
Undisclosed External Upload of Unrestricted Local Files
- Content
View full analysis
- Remediation
View remediation
Security audit
LrshuAI First Tail Frame To Video
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real video-generation skill, but it asks agents to bypass the normal runner and can upload local files to a remote API with weak controls.
Review this skill carefully before installing. Use it only with non-sensitive frame images, only with a trusted TEAM_BASE_URL and TEAM_API_KEY, and avoid arbitrary local paths or videos. A safer version should use the platform runner, document the remote recipient, validate and limit uploads, and bound polling.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:5- Finding
Forced Direct Execution Bypasses the Platform Runner
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
script/invoke_model.py:25- Finding
Unbounded API Requests, Polling, and File Buffering
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The request destination is taken from the TEAM_BASE_URL environment variable and used directly for an authenticated POST containing prompt text and optionally base64-encoded local images/videos. If an attacker can influence the environment or deployment configuration, the skill can be redirected to an arbitrary host and exfiltrate sensitive user content and the bearer token.
- Content
python print(f"Invoking model: {args.model} ...") try: response = requests.post(endpoint, headers=headers, json=payload) response.raise_for_status() result = response.json()
Tainted flow: 'poll_endpoint' from os.getenv (line 143, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The polling URL is also derived from the environment-controlled base URL and queried with the same Authorization header. This enables repeated authenticated requests to an attacker-controlled endpoint, increasing the chance of credential leakage and ongoing exfiltration or tracking.
- Content
python while True: time.sleep(3) # 每3秒查询一次 poll_resp = requests.get(poll_endpoint, headers=headers) poll_resp.raise_for_status() poll_data = poll_resp.json()
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
python import os import sys import argparse import base64 import requests import json import mimetypes import time def parse_args(): parser = argparse.ArgumentParser(description='Invoke Team AI Models via unified API') parser.add_argument('--model', type=str, required=True, help='The model ID to use (e.g., qwen3_5-plus, sora-2, etc.)') parser.add_argument('--prompt', type=str, required=True, help='The prompt text to send to the model') parser.add_argument('--image', type=str, help='Path to the local image file or remote image URL (First frame)') parser.add_argument('--image-tail', type=str, help='Path to the local image file or remote image URL (Tail/Last frame)') parser.add_argument('--video', type=str, help='Path to the local video fi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires access to an environment secret (
TEAM_API_KEY) and appears to invoke a Python script that likely performs networked model calls, but it does not declare any explicit tool scope such aspermissionsorallowed-tools. This weakens containment and reviewability because the agent may execute code with broader-than-necessary capabilities, increasing the risk of secret misuse or unintended external access.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is presented as a narrowly scoped first-frame/last-frame video generator, but the code is a generic multimodal invoker that accepts arbitrary model IDs, prompts, and media types. This scope mismatch weakens user and platform trust boundaries, making it easier to invoke unintended remote capabilities and transmit data beyond what the skill description suggests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script supports video input even though the skill description only mentions generation from first and tail images. In an agent setting, this expands data exposure and behavior beyond declared intent, which can cause users or orchestrators to pass media they did not expect would be uploaded remotely.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python print(f"Invoking model: {args.model} ...") try: response = requests.post(endpoint, headers=headers, json=payload) response.raise_for_status() result = response.json()
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Local images and videos are read, base64-encoded, and sent to a remote API without any explicit warning or consent mechanism in the script. In this skill context, users may reasonably expect image-based video generation, but not necessarily that local files will be transmitted off-host to a third-party endpoint, creating privacy and data-handling risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Several inline comments and messages use Chinese, such as the comment at L032, which imposes a specific language in the skill's natural-language content. Under the stated policy, forcing a specific language without user opt-in or documented regional justification is a locale-policy issue.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The inline warning states that the current script maps only --image to firstFrame, implying no last-frame support. But earlier logic explicitly maps --image-tail to payload['input']['lastFrame'], so the comment contradicts actual behavior and can mislead reviewers about the skill's implemented intent.
- Content