LrshuAI Sfx Generation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:55 AM UTC
• Version: 1.0.0

Overview

The skill is advertised as sound-effect generation, but its artifacts require direct Python execution and include a broad remote model client that can upload local image or video files.

Review this skill before installing. Only use it with a dedicated, revocable TEAM_API_KEY, verify the intended API endpoint, and avoid allowing agents to pass local file paths unless you explicitly want those files uploaded to the remote service. The standard runner-bypass instruction should be removed or justified before routine use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:5

Finding

Mandatory Direct Execution Bypasses the Standard Skill Invocation Path

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: script/invoke_model.py:29

Finding

Undisclosed Transmission of an Environment Credential to a Third-Party Endpoint

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: script/invoke_model.py:13

Finding

Undeclared Arbitrary Local File Reading and External Upload

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: script/invoke_model.py:11

Finding

General Multimodal Model Client Exceeds the Declared SFX-Only Scope

Content

View full analysis

.", file=sys.stderr) sys.exit(1) if args.model == 'jimeng-i2v-first-tail-v30': print(f"Warning: {args.model} usually requires both firstFrame and lastFrame. The current script maps --image to firstFrame only. It may fail if lastFrame is strictly required by the provider.", file=sys.stderr) ``` ### Technical Analysis The Skill documentation advertises one SFX model, `keling-audio-sfx`, and describes text-based sound-effect generation. The implementation instead accepts any model identifier and contains explicit support for unrelated image-to-video and multimodal models. There is no allowlist that restricts `--model` to the documented SFX model. Th ...[truncated 1616 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (13)

Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · script/invoke_model.py (reported line 115)May include surrounding context.

python

print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()

Tainted flow: 'poll_endpoint' from os.getenv (line 132, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · script/invoke_model.py (reported line 136)May include surrounding context.

python

while True:
            time.sleep(3) # 每3秒查询一次
            poll_resp = requests.get(poll_endpoint, headers=headers)
            poll_resp.raise_for_status()
            poll_data = poll_resp.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is narrowly framed as sound-effect generation, but the implementation reportedly supports broader remote model invocation and multimodal image/video workflows. This mismatch is dangerous because agents and users may authorize the skill under a narrow trust assumption while it can actually process additional data types and perform more expansive remote operations.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · script/invoke_model.py (reported line 11)May include surrounding context.

python

import os
import sys
import argparse
import base64
import requests
import json
import mimetypes
import time

def parse_args():
    parser = argparse.ArgumentParser(description='Invoke Team AI Models via unified API')
    parser.add_argument('--model', type=str, required=True, help='The model ID to use (e.g., qwen3_5-plus, sora-2, etc.)')
    parser.add_argument('--prompt', type=str, required=True, help='The prompt text to send to the model')
    parser.add_argument('--image', type=str, help='Path to the local image file or remote image URL (First frame)')
    parser.add_argument('--image-tail', type=str, help='Path to the local image file or remote image URL (Tail/Last frame)')
    parser.add_argument('--video', type=str, help='Path to the local video fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares access to Python execution and an API key-backed remote service, but does not define an explicit tool/permission scope. That makes the runtime capabilities broader and less auditable, increasing the chance that an agent invokes code execution or networked actions without clear policy boundaries or user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation text says the skill should be used whenever the user wants sound generation, but does not define clear boundaries, safety checks, or exclusions. Broad triggers can cause over-invocation of a Python- and API-backed skill, increasing unintended data sharing, unexpected code execution, or use in contexts where a simpler non-executing response would suffice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill description and operational instructions are written entirely in Chinese and direct behavior in that language without indicating user choice or opt-in. This can violate language/locale policy when a skill effectively forces a specific language rather than accommodating the user's preferred language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The implementation is materially broader than the declared skill purpose of text-to-sound-effect generation: it exposes arbitrary model selection and multimodal invocation. In an agent-skill context, capability overreach is dangerous because it can be abused to exfiltrate non-audio data, invoke unintended model classes, or bypass policy assumptions made from the skill metadata.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Image and video upload support is unjustified for a skill described as sound-effect generation from text. In the skill context this increases danger because users or the orchestrator may assume only text is processed, while the code can upload local media or remote URLs to an external service, expanding data-exposure and abuse surface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Support for image-to-video and video-generation model flows is unrelated to the stated sound-effect purpose and indicates latent, undocumented capabilities. In an agent ecosystem, hidden extra capabilities are risky because they undermine least privilege and can enable misuse well outside the expected audio domain.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · script/invoke_model.py (reported line 115)May include surrounding context.

python

print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code sends prompt text and potentially base64-encoded local image/video content to a remote API without an explicit warning, consent gate, or in-code disclosure at the point of transmission. In this skill context that is more dangerous because the published description suggests a narrow audio task, not broad remote multimodal upload, so users may unknowingly expose sensitive local data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The documentation instructs the agent to directly execute a Python script and use API-backed model access without any user-facing disclosure. While not inherently malicious, this reduces transparency and can lead to covert code execution and remote transmission of prompt content without informed consent.

Content

No source excerpt is available for this finding.