Sora AI视频生成

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 3.6.1

Overview

The skill mostly matches a Sora2 data-query assistant, but it inaccurately claims to be read-only while allowing autonomous image uploads to a third-party server.

Review before installing. Use this only if you trust MaxHub/aconfig.cn with your API key and submitted data. Do not upload sensitive images unless you are comfortable with them being sent to and stored by the remote service, and prefer explicit confirmation before any upload. Consider pinning the installer version instead of using an unpinned npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Remediation

View remediation

install maxhub-sora2 ``` 2. Document the expected npm registry and package publisher. 3. Publish and verify package integrity hashes or signed release provenance. 4. Recommend installation from a lockfile-controlled environment where possible. 5. Avoid using an implicit latest release in security-sensitive installation documentation. 6. Review and update the pinned version only after auditing the corresponding release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/api-cameo.md:84

Finding

Image Upload Contradicts Read-Only Assurance and Lacks Explicit Consent Controls

Content

View full analysis

- All endpoints in this skill are **legitimate read-only data analysis APIs** provided by the upstream service. > - This skill performs **read-only data queries** only. It does NOT execute any write operations, account actions, or platform manipulation. ``` It also directs autonomous execution: ```markdown ### Step 4: Plan & Execute No predefined patterns. Chain endpoints as needed based on user query. **Execution rules:** - Execute all planned queries autonomously. ``` However, the Cameo reference defines a remote write operation: ```markdown ## upload_image `POST /api/v1/sora2/upload_image` ``` The endpoint requires an image file of up to 10 MB and documents that the uploaded image is stored on the remote server: ```markdown - **file** (required): image file - Supported formats: PNG, JPG, JPEG - Maximum file size: 10 MB - Uploaded images are stored on the server - The returned media ID is generally valid for 24 hours ``` ### Technical Analysis Uploading a file with an HTTP `POST` request is not a read-only data query. It transfers user-controlled content to `https://www.aconfig.cn` and causes the remote service to store that content. The upload is part of the declared feature set, so transmission to the declared host is not itself covert exfiltration. Nevertheless, the broad read-only assurance is materially inaccurate. The autonomous-execution instruction also does not require confirmation that identifies: - The exact file selected for upload. - The external destination. - The fact that the image will be retained remotely. - Potential metadata contained ...[truncated 1631 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The duplicated hidden-instructions finding points to the same underlying issue: security-relevant execution guidance is embedded in hidden comments/reference conventions rather than transparent configuration. This reduces auditability and increases the risk that an agent follows concealed endpoint directions not obvious from the manifest.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径（如 `/api/v1/douyin/search/xxx`） | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名（如把 `aweme_id` 写成 `video_id`） | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点（见废弃标注） |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The duplicated hidden-instructions finding points to the same underlying issue: security-relevant execution guidance is embedded in hidden comments/reference conventions rather than transparent configuration. This reduces auditability and increases the risk that an agent follows concealed endpoint directions not obvious from the manifest.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径(如 `/api/v1/douyin/search/xxx`) | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名(如把 `aweme_id` 写成 `video_id`) | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点(见废弃标注) |

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The security declaration claims the skill is read-only, but the documentation explicitly includes POST requests and an upload_image action, which are not read-only operations. This contradiction can mislead reviewers and users about the skill's true capability, increasing the risk of unauthorized data submission, content upload, or expansion into mutable operations under a false safety claim.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

| "analyze" / "分析一下" | Switch to analyze mode |
| "compare with X" / "和X对比" | Add X as second query |

## Output Guidelines

1. **Language consistency** — ALL output matches user's detected language.
2. **Markdown links** — All URLs in `[text](url)` format.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-cameo.md (reported line 11)May include surrounding context.

md

`GET /api/v1/sora2/get_cameo_leaderboard`

<!-- Full path: /api/v1/sora2/get_cameo_leaderboard -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-cameo.md (reported line 46)May include surrounding context.

md

`GET /api/v1/sora2/get_user_cameo_appearances`

<!-- Full path: /api/v1/sora2/get_user_cameo_appearances -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 11)May include surrounding context.

md

`GET /api/v1/sora2/get_comment_replies`

<!-- Full path: /api/v1/sora2/get_comment_replies -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 53)May include surrounding context.

md

`GET /api/v1/sora2/get_feed`

<!-- Full path: /api/v1/sora2/get_feed -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 98)May include surrounding context.

md

`GET /api/v1/sora2/get_post_comments`

<!-- Full path: /api/v1/sora2/get_post_comments -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 141)May include surrounding context.

md

`GET /api/v1/sora2/get_post_detail`

<!-- Full path: /api/v1/sora2/get_post_detail -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 193)May include surrounding context.

md

`GET /api/v1/sora2/get_post_remix_list`

<!-- Full path: /api/v1/sora2/get_post_remix_list -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 237)May include surrounding context.

md

`GET /api/v1/sora2/get_user_followers`

<!-- Full path: /api/v1/sora2/get_user_followers -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 277)May include surrounding context.

md

`GET /api/v1/sora2/get_user_following`

<!-- Full path: /api/v1/sora2/get_user_following -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 317)May include surrounding context.

md

`GET /api/v1/sora2/get_user_posts`

<!-- Full path: /api/v1/sora2/get_user_posts -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 358)May include surrounding context.

md

`GET /api/v1/sora2/get_user_profile`

<!-- Full path: /api/v1/sora2/get_user_profile -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post-user.md (reported line 400)May include surrounding context.

md

`GET /api/v1/sora2/get_video_download_info`

<!-- Full path: /api/v1/sora2/get_video_download_info -->

### Parameters

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README advertises an upload_image tool but does not warn users what happens to uploaded images, such as whether files are sent to a third-party service, retained, logged, or reused. Because image uploads can contain sensitive personal or proprietary data, the lack of disclosure increases the risk of unintended data exfiltration or privacy harm.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command uses npx clawhub without pinning a specific version, which means users may execute whatever package version is current at install time. If the upstream package is compromised, typosquatted, or updated maliciously, this can lead to arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README lists invocation examples as single generic words like "作品", "用户", "Cameo", "上传", and "图片" without clarifying when the skill should or should not activate. These broad everyday terms can overlap with ordinary conversation and may cause unintended invocation because no trigger constraints or negative examples are provided.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The install command uses npx clawhub without pinning a specific version, which means users may execute whatever package version is current at install time. If the upstream package is compromised, typosquatted, or updated with malicious code, this README directly encourages arbitrary remote code execution on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger examples are extremely broad terms such as '作品', '用户', '上传', and '图片', which overlap with ordinary conversation and can cause accidental invocation of the skill. In an agent environment, this increases the chance the skill accesses external data or performs actions unexpectedly when a user did not intend to activate it.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill is explicitly designed to transmit user-supplied query data and an API bearer token to an external service. While external transmission is expected for an API integration, it remains security-relevant because all user requests and authorization material are sent off-platform to a third party, creating confidentiality, logging, and misuse risks if inputs are overbroad or the service is not fully trusted.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

# GET example
curl -s "https://www.aconfig.cn/api/v1/sora2/{endpoint}?{params}" \
  -H "$maxhub_auth_header"

# POST example

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The routing rules use broad everyday trigger phrases and default behaviors that can classify vague user input into endpoint execution paths without strong constraints. In an agent setting, this increases the chance of overbroad or unintended API calls, especially when combined with autonomous execution and multi-endpoint orchestration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as a Sora2-only assistant, but the documented endpoints and downgrade mappings reference unrelated Douyin/Xiaohongshu-style paths and capabilities. This mismatch can cause the agent to invoke unintended services or data domains, creating a high risk of scope confusion, accidental cross-platform data access, and policy bypass through misleading documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly encourages sending per-user viewing history via the eager_views parameter to obtain personalized recommendations, but it provides no privacy warning, consent requirement, retention guidance, or minimization advice. In a skill context, this can normalize collection and transmission of behavioral data to a third-party endpoint without informing users that their watch history may be sensitive personal data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.