Agnes Video V2.0

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Agnes video-generation integration, but its shell scripts contain serious unsafe coding and under-disclosed side effects that warrant Review before installation.

Install only if you are comfortable sending prompts, image URLs, and an Agnes API key to the Agnes API. Review or fix the shell scripts first, especially the heredoc injection risk, the broken extra fi in agnes-video.sh, the unvalidated video download path, and the test script that creates a real task instead of doing a read-only connection check.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/agnes-video.sh:89

Finding

Python Code Injection Through Untrusted Prompt and Image Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agnes-video.sh:152

Finding

Unvalidated API-Controlled URL Is Downloaded to a User-Selected Path

Content

View full analysis

Remediation

View remediation

other

Note

• Location: scripts/test-connection.sh:20

Finding

Connection Test Creates a Potentially Billable Video Generation Task

Content

View full analysis

&1) || { echo "❌ Connection failed" echo " Response: $RESPONSE" exit 1 } ``` ### Technical Analysis The file is named and documented as a connection test, but it sends a `POST` request to the video creation endpoint. This creates a real asynchronous generation task rather than performing a read-only connectivity or authentication check. Video generation commonly consumes paid credits, compute quota, rate limits, or account capacity. The script does not warn the user that the test may be billable, request confirmation, poll the task to completion, retrieve the result, or cancel the test task. Creating a task is necessary for an end-to-end generation test, but it is not the minimum privilege or side effect required to test basic network connectivity and credential validity. ### Attack Path 1. A user runs `scripts/test-connection.sh`, expecting a harmless connectivity check. 2. The script authenticates using the user's Agnes API key. 3. It submits a real 81-frame video-generation request. 4. The remote service creates a server-side task. 5. The account may incur charges or consume quota even though the user did not explicitly request video generation. 6. Repeated invocations create additional independent tasks. ### Impact Assessment The direct impact is limited to the configured Agnes account and may include: - ...[truncated 354 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/agnes-video.sh (reported line 141)May include surrounding context.

sh

sleep $POLL_INTERVAL
  ELAPSED=$((ELAPSED + POLL_INTERVAL))
  
  RESPONSE=$(curl -sf --max-time 30 \
    -H "Authorization: Bearer ${API_KEY}" \
    "${API_RESULT}?video_id=${VIDEO_ID}")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The script downloads a file from a URL taken directly from the remote API response and writes it to a local path without validating the URL's scheme, host, or content type. If the API is compromised or returns an unexpected URL, the script could be used to fetch arbitrary remote content, enabling SSRF-like retrieval behavior or saving malicious files locally under a trusted filename.

Content

Scanner excerpt · scripts/agnes-video.sh (reported line 158)May include surrounding context.

sh

echo "  URL: $VIDEO_URL"
    
    if [ "$OUTPUT_FILE" != "video_output.mp4" ]; then
      curl -sf -o "$OUTPUT_FILE" "$VIDEO_URL"
      echo "  Saved to: $OUTPUT_FILE"
    fi
    exit 0

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language content is presented entirely in Chinese, while examples also mix in English prompt text, but the skill does not state that Chinese is required nor offer a language choice. Under the language/locale policy, a skill should not implicitly force a specific language unless the constraint is documented and justified or the user is given an opt-in choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes very broad terms such as “动画”, “动态”, and “motion”, which are common in many unrelated user requests. This can cause unintended activation of the skill, leading the agent to invoke external video-generation behavior when the user did not clearly request it, increasing the chance of misrouting, unnecessary API usage, or accidental transmission of prompts and image URLs to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents nearly all operational instructions, parameter descriptions, and workflow guidance exclusively in Chinese. Under the policy rule for natural-language violations, this can constitute a locale/language constraint because users are not offered an alternative language or any explicit opt-in/justification for the restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends the prompt and possibly image URLs to a remote Agnes API endpoint via curl, which is a network transmission of user-provided data. Although it prints the prompt and workflow details, it does not clearly disclose that these inputs are being sent to an external service or warn about the privacy implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/test-connection.sh (reported line 24)May include surrounding context.

sh

# Test with a simple request
echo "📡 Sending test request..."
RESPONSE=$(curl -sf --max-time 30 \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document title and section headings are written in Chinese throughout, while the file provides no indication that the skill is region-specific or that users can choose another language. This can violate a language/locale policy when a skill implicitly mandates one language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, including the title and all guidance text. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a natural-language policy violation unless the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inline documentation states a single required environment variable, ANGES_API_KEY, while the implementation actually reads either ANGES_API_KEY or AGENT_ANGES_API_KEY. This is a direct documentation-to-code mismatch about how authentication is supplied.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script accesses ANGES_API_KEY or AGENT_ANGES_API_KEY from the environment, which falls under sensitive credential access for code-file warning checks. It reports when the variable is missing, but does not explicitly disclose that it will read and use these credentials to authenticate external API requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code writes remote content to a user-specified local output path using curl, which is a file-write operation covered by the warning requirement for code files. While the script logs that the file was saved after completion, there is no prior disclosure, confirmation, or explanatory comment near the write operation itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.