Security audit

image-url-qiniu

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can fetch arbitrary user-supplied URLs and publish the fetched image to Qiniu without blocking internal network targets.

Review before installing. Use this only in an environment where outbound requests are restricted to the public internet, Qiniu credentials are narrowly scoped to the intended bucket/prefix, and users cannot cause the skill to fetch localhost, private-network, link-local, or cloud metadata URLs. Avoid using the SSL bypass except under controlled administrative conditions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/url_image_to_qiniu.py:94
Finding: Unrestricted Server-Side Request Forgery With Public Data Exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/url_image_to_qiniu.py:176
Finding: Optional TLS Certificate Verification Bypass
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/url_image_to_qiniu.py:3
Finding: Non-Reproducible Runtime Dependencies With Open-Ended Version Ranges
Content: View full analysis
=3.10" # dependencies = [ # "requests>=2.31.0", # "qiniu>=7.13.0", # ] # /// ``` ### Technical Analysis The script declares minimum dependency versions without upper bounds or exact pins. Execution through `uv run` may therefore resolve and install a later package version that was not present when the Skill was reviewed. This is particularly sensitive for the `qiniu` package because it runs in the Skill process, receives data derived from the Qiniu access key and secret key, creates upload tokens, and performs authenticated network operations. Third-party package initialization and imported module code execute with the same environment access and operating-system privileges as the Skill. No malicious package, dependency-confusion name, or compromised release was identified in the reviewed source. The confirmed weakness is the absence of reproducible dependency resolution, which unnecessarily expands the trusted supply-chain surface. ### Attack Path 1. The Skill is run in an environment without a reviewed lockfile or cached, verified dependency set. 2. `uv` resolves a newer release satisfying `requests>=2.31.0` or `qiniu>=7.13.0`. 3. The selected package release differs from the release previously audited or tested. 4. Package code executes in the Skill process when imported. 5. If that release is compromised or contains a security regression, it can access process environment variables, image data, network access, and authenticated Qiniu operations. ### Impact Assessment A compromised or unsafe resolved dependency could potentially: - Read Qiniu credentials from process environment variables - Intercept image content and generated upload tokens - Perform unauthorized network requests - Modify uploaded content or des ...[truncated 278 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill uses both network access and environment-based secrets but does not declare an explicit tool scope such as permissions or allowed-tools. That creates an overbroad trust boundary: an agent may invoke code that fetches arbitrary user-supplied URLs and uses cloud credentials without clear platform-level restrictions or review gates. In this context, the danger is increased because the skill explicitly downloads from arbitrary external URLs, which can enable SSRF-style access to internal endpoints if runtime egress is not otherwise constrained.
Content: No source excerpt is available for this finding.