Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its Modellix media-generation purpose, but it automatically installs or updates a global CLI and uses API credentials for paid network workflows, so users should review it before installing.
Install only if you are comfortable with a skill that can run shell commands, use your Modellix API key or CLI profile, send prompts/media to Modellix, make paid model requests, download outputs locally, and automatically install or update the global modellix-cli from npm. Set MODELLIX_CLI_AUTO_UPDATE=0 if you need to prevent automatic CLI changes, prefer session-only credentials, and require explicit approval for file deletion, batch jobs, credential persistence, or non-default network endpoints.
The skill goes beyond invoking Modellix APIs by checking npm, coordinating locks/state, sanitizing npm-related environment, and installing or updating a global CLI. Automatic package installation/update is a high-risk capability because it changes the host environment, can interfere with other tools, and introduces software-supply-chain exposure not clearly bounded by the declared purpose.
The skill goes beyond invoking Modellix APIs by checking npm, coordinating locks/state, sanitizing npm-related environment, and installing or updating a global CLI. Automatic package installation/update is a high-risk capability because it changes the host environment, can interfere with other tools, and introduces software-supply-chain exposure not clearly bounded by the declared purpose.
The skill goes beyond invoking Modellix APIs by checking npm, coordinating locks/state, sanitizing npm-related environment, and installing or updating a global CLI. Automatic package installation/update is a high-risk capability because it changes the host environment, can interfere with other tools, and introduces software-supply-chain exposure not clearly bounded by the declared purpose.
Referenced artifact was not completely inspected
If the Docs MCP exposes a skill resource, treat **this** `SKILL.md` as the execution policy source of truth (CLI-first, defaults, paid-submit safety).
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
| Resolve/update CLI and diagnose env/auth | `scripts/preflight.py --json` → `modellix-cli doctor --json` | N/A (manual key + probe) | Update check runs before paid work; failure keeps a working installed CLI |
| List / describe models | `model list`, `model describe <slug>` | Browse `llms.txt`, then fetch model `.md` | Prefer CLI when installed; `describe` is catalog metadata (`docs_url`, pricing, featured) |
| Get request / response schema | `model get-schema <slug>` (JSON default; public, no API key) | Fetch model `.md` OpenAPI via Docs MCP / `docs_url` / `llms.txt` | Use CLI schema before building `--body` when the slug is non-default or the body is non-trivial |
| Look up product / API / install docs | Docs MCP (`search_modellix` / docs filesystem) when connected via portable `mcp.json` or host adapter `.mcp.json` | Fetch `docs_url` or `llms.txt` → model `.md` | Docs MCP is read-only documentation — not generation. CLI flags still prefer npm / `--help` over website CLI pages |
| Submit async task | `modellix-cli model run --model-slug <provider/model> --body/--body-file ...` | `POST /api/v1/{provider}/{model_id}/async` | `model invoke` is an alias of `model run` |
| Wait for terminal status | `model run --wait` or `task wait <task_id>` | Wait with `GET /api/v1/tasks/{task_id}?wait=true&timeout=45` | Prefer CLI wait; do not hand-roll poll loops when CLI exists |
| Read task once | `task get <task_id>` | `GET /api/v1/tasks/{task_id}` | Same status lifecycle: `pending` / `processing` / `success` / `failed` |
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
The helper uses wait hops of at most 45 seconds, a finite transport margin, and one monotonic total deadline. An absolute socket deadline also bounds slow headers, response bodies, proxy CONNECT, and TLS handshakes. System DNS resolution is platform-controlled; if it returns after the deadline, no connection or request starts. `--initial-wait` and `--max-wait` are deprecated compatibility flags and do not add sleeps between valid wait responses. Only transient read errors back off; paid POSTs and uploads are never replayed automatically.
Use `GET /api/v1/media/files?limit=20&offset=0` to reuse uploaded URLs. CLI/MCP uploads accept at most 16 MiB (16777216 bytes); REST has a separate configurable limit. Defaults are 10 files per team, 2 concurrent uploads, and 7-day retention. On 429, list files and explicitly approve deleting an unneeded ID with `DELETE /api/v1/media/files/{file_id}`. Never auto-delete files or retry uploads to clear quota.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def child_env(api_key: Optional[str]) -> Dict[str, str]:
"""Pass an explicit key through the child environment, never process arguments."""
env = os.environ.copy()
if api_key:
env["MODELLIX_API_KEY"] = api_key
return env
The skill declares broad operational behavior involving shell execution, filesystem access, environment-variable use, and network egress, but it does not declare any explicit tool scope or permission boundaries. That makes the skill harder to sandbox and review, and increases the chance that a host agent grants more capability than users expect, especially since it handles API credentials and performs command execution.
The activation criteria are very broad, including generic provider-name mentions and many media-related requests, which can cause the skill to trigger in contexts where the user did not intend to use Modellix. In practice, overbroad activation increases the chance of unnecessary credential prompts, unintended network access, and accidental execution of shell/network workflows.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
},
{
"id": 8,
"prompt": "The video task task-existing is processing and upload quota is full. Continue waiting and reuse existing files. Do not generate again or delete without approval.",
"expected_output": "Uses task wait with task-existing and file list to reuse URLs. A normal deadline keeps the ID. Deletion requires explicit selection and approval.",
"files": [],
"assertions": [
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
"Uses server-side wait rather than task get plus sleep",
"Keeps task-existing after exit 124",
"Lists reusable uploaded files",
"Does not automatically delete or replay uploads or paid submissions"
]
}
]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
GET /tasks/{task_id}?wait=true&timeout=45
## cURL Example
Submit:
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
def __exit__(self, exc_type, exc, traceback):
self._stop.set()
self._watcher.join(timeout=0.2)
with self._lock:
self._socket = None
self.remaining()
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
except OSError:
pass
def create_connection(self, address, timeout=None, source_address=None):
host, port = address
last_error = None
# DNS uses the platform resolver. Recheck before connecting/sending if it
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from cli_runtime import CliRuntime, resolve_cli_runtime
from http_deadline import DeadlineHTTPHandler, DeadlineHTTPSHandler, HttpDeadline
BASE_URL = "https://api.modellix.ai/api/v1"
RETRYABLE_READ_STATUS = {408, 429, 500, 502, 503, 504}
MAX_READ_RETRIES = 3
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from cli_runtime import CliRuntime, resolve_cli_runtime
from http_deadline import DeadlineHTTPHandler, DeadlineHTTPSHandler, HttpDeadline
BASE_URL = "https://api.modellix.ai/api/v1"
RETRYABLE_READ_STATUS = {408, 429, 500, 502, 503, 504}
MAX_READ_RETRIES = 3
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from cli_runtime import CliRuntime, resolve_cli_runtime
from http_deadline import DeadlineHTTPHandler, DeadlineHTTPSHandler, HttpDeadline
BASE_URL = "https://api.modellix.ai/api/v1"
RETRYABLE_READ_STATUS = {408, 429, 500, 502, 503, 504}
MAX_READ_RETRIES = 3
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from cli_runtime import CliRuntime, resolve_cli_runtime
from http_deadline import DeadlineHTTPHandler, DeadlineHTTPSHandler, HttpDeadline
BASE_URL = "https://api.modellix.ai/api/v1"
RETRYABLE_READ_STATUS = {408, 429, 500, 502, 503, 504}
MAX_READ_RETRIES = 3
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from cli_runtime import CliRuntime, resolve_cli_runtime
from http_deadline import DeadlineHTTPHandler, DeadlineHTTPSHandler, HttpDeadline
BASE_URL = "https://api.modellix.ai/api/v1"
RETRYABLE_READ_STATUS = {408, 429, 500, 502, 503, 504}
MAX_READ_RETRIES = 3
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# Paid POST must not be auto-retried by this wrapper.
try:
proc = subprocess.run(
cmd,
check=False,
capture_output=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
output_dir,
"--json",
]
proc = subprocess.run(
cmd,
check=False,
capture_output=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
command = [cli_path, "doctor", "--json"]
if profile:
command.extend(["--profile", profile])
proc = subprocess.run(
command,
check=False,
capture_output=True,
The script refreshes modellix-cli from the latest public npm release before continuing, which changes installed software as part of a preflight check without explicit opt-in. In a security-sensitive agent skill, automatic execution of newly fetched tooling increases supply-chain risk and can unexpectedly alter behavior or execute compromised code if the upstream package or dependency chain is malicious or hijacked.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
1. If the user did not specify a model: use the **Default Models** table (do not scan the catalog first).
2. If they named a model or need discovery: `modellix-cli model list` / `modellix-cli model describe <slug>` (catalog metadata; describe returns `docs_url`).
3. For request body schema: `modellix-cli model get-schema <slug>` (JSON default; public, no API key). Call this when the user named a non-default slug, when the body needs fields beyond the documented examples, after HTTP `400`, or when reporting required fields. Skip when the skill default plus the example already lists required fields, or the user supplied a complete body.
4. If CLI is unavailable for schema or discovery: use Docs MCP or browse `llms.txt`, then fetch the target model `.md`. Do **not** invent slugs from filenames (decimals often matter, e.g. `bytedance/seedance-2.0-mini-t2v`).
### 3) Run and wait
When --output-dir is provided, the script invokes modellix-cli task download to place task outputs into the specified directory. Although this behavior is implied by the option name, there is no explicit user-facing warning in code comments, prompts, or printed messaging that local files will be created or overwritten as part of the download step.
No suspicious patterns detected.