Upload files to catbox.moe (permanent) or litterbox.catbox.moe (temporary).

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:52 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Catbox/Litterbox file uploader with privacy and dependency cautions, but no hidden or unrelated behavior.

Only use this skill for files you are comfortable sending to Catbox or Litterbox. Treat returned URLs as shareable links, avoid secrets or private data, prefer temporary Litterbox when permanence is not needed, and consider pinning dependencies and adding request timeouts before operational use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded and Unhashed Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unrestricted dependency version resolution
Risk Level: Low

Vulnerable Code:

text

requests>=2.31.0

Technical Analysis

The dependency specifies only a minimum version and provides neither an exact version pin nor an integrity hash. Consequently, installations performed at different times may resolve to different, unaudited releases of requests and its transitive dependencies.

This does not establish that the current dependency is malicious. However, it weakens build reproducibility and supply-chain integrity because a future compromised, malicious, or incompatible release could be selected automatically during installation.

Attack Path

1. An attacker compromises an applicable upstream package release, maintainer account, or configured package index.
2. A release satisfying requests>=2.31.0, or a compromised transitive dependency, becomes available.
3. A user installs the project dependencies without a trusted lock file or hash verification.
4. The package installer resolves and installs the compromised release.
5. Attacker-controlled package code executes during installation or when upload.py imports and uses the package.

This path requires a separate compromise of the package supply chain or package index; the version constraint alone does not grant an attacker control.

Impact Assessment

If the dependency supply chain is compromised, malicious package code could execute with the privileges of the user or automation account installing or running the project. The resulting scope could include access to files, environment variables, network credentials, and other resources available to that account. The project itself does not request elevated privileges.

Remediation

View remediation

Remediation Suggestions

• Pin every direct and transitive dependency to an audited exact version.
• Generate a lock file with cryptographic hashes, for example using pip-compile --generate-hashes.
• Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
• Review and update pinned dependencies through a controlled dependency-update process.
• Use a trusted package index and restrict unapproved alternate indexes in build environments.

T09 · Insecure Skill Coding Practices

Note

• Location: upload.py:24

Finding

Outbound Upload Requests Lack Network Timeouts

Content

View full analysis

Vulnerability Details

File Location: upload.py:24 and upload.py:39
Vulnerability Type: Unbounded network operation
Risk Level: Low

Vulnerable Code:

python

response = requests.post(CATBOX_API, data=data, files=files)

python

response = requests.post(LITTERBOX_API, data=data, files=files)

Technical Analysis

Both upload operations invoke requests.post without a timeout argument. The Requests library does not impose a default request timeout, so connection establishment or response reads may remain blocked indefinitely when the destination, intermediary, or network stops making progress.

The destinations are fixed HTTPS endpoints rather than user-controlled URLs, which limits direct exploitation. Nevertheless, service disruption, a stalled remote endpoint, or adverse network behavior can indefinitely occupy the invoking process.

Attack Path

1. A user or automation worker starts an upload.
2. The Catbox or Litterbox endpoint, a network intermediary, or the connection accepts the request but fails to complete the response.
3. Because no connect or read timeout is configured, the call remains blocked.
4. The worker cannot complete the task or release associated resources.
5. Repeated stalled uploads may consume multiple workers and reduce service availability.

No additional privileges can be obtained through this issue; its practical effect is limited to availability and resource consumption.

Impact Assessment

Affected executions can hang for an unbounded period. In an automated or multi-worker environment, repeated occurrences could exhaust worker capacity and cause partial denial of service. The issue does not provide code execution, privilege escalation, or access to additional files.

Remediation

View remediation

Remediation Suggestions

• Configure explicit connect and read timeouts for both requests, for example:

  python

  response = requests.post(
      CATBOX_API,
      data=data,
      files=files,
      timeout=(10, 120),
  )
  

• Apply an equivalent timeout to the Litterbox request.
• Catch requests.Timeout separately and return a clear, non-sensitive error.
• If retries are added, use a small retry limit with exponential backoff and avoid retrying non-idempotent uploads unless duplicate-upload behavior is understood.
• At the orchestration layer, impose an overall execution deadline as a second layer of availability protection.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs users to upload files to catbox.moe or litterbox.catbox.moe but does not warn that this sends data to an external third-party service and may make uploaded content publicly accessible by URL. Users could unintentionally expose sensitive, proprietary, or personal files because the documentation frames the action as a routine upload without disclosing the privacy and retention implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code uploads arbitrary local file contents to a third-party service without any explicit confirmation, warning, or safeguard about external transmission and potential permanence. In an agent/skill context, that increases the risk of unintended exfiltration of sensitive files if the tool is invoked on confidential paths or if a user misunderstands where the data is going.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Although this path uses a temporary hosting service, it still sends the full file contents to an external domain without an explicit privacy or data-handling warning. Temporary retention does not eliminate the risk of exposing secrets, personal data, or proprietary material during the upload window or through unintended sharing of the returned URL.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any future release and does not guarantee a known-reviewed version during installation. This weakens reproducibility and can unintentionally pull in a vulnerable or breaking release through fresh installs or rebuilds, making supply-chain risk harder to control.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest references requests without an exact version pin, while the package has multiple published advisories across versions. Because the installed version is not fixed, it is impossible to verify from this file alone whether deployments will avoid affected releases, creating uncertainty around exposure to known vulnerabilities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.