T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/curl_examples.sh:98- Finding
Unescaped User-Controlled URL Allows JSON Request Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Video Translator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent video translation integration that sends user-provided videos or video URLs to a disclosed external service and returns a preview link.
Use this skill only for videos or URLs you are allowed to send to the disclosed third-party service. Keep VIDEO_TRANSLATE_SERVICE_API_KEY in the environment, avoid pasting it into prompts or logs, and be cautious with confidential media. If using the helper script with untrusted URLs, harden JSON construction with a serializer first.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README clearly states that user-provided videos are sent to an external service, but it provides no warning about third-party transmission, retention, or privacy implications. Because videos often contain sensitive personal or proprietary content, lack of disclosure can lead to unintended data exposure and unsafe operator assumptions about where user data is processed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares shell runtime requirements and operational steps that imply code/tool execution, but it does not explicitly constrain tool scope with permissions or allowed-tools. In an agent environment, that increases the chance the skill can invoke broader shell capabilities than intended, which can enable unsafe command execution paths or unreviewed network access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is built to send user-provided video files or URLs to a third-party service, but the user-facing description does not clearly warn that potentially sensitive media and linked content will leave the local system. This creates a privacy and data-handling risk because users may submit confidential videos or internal URLs without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions require defaulting targetLanguage to en whenever the user does not specify a target language. This imposes a language choice without asking the user or offering an opt-in, which is a natural-language policy concern under the language/locale rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The default_prompt specifies
targetLanguage (zh/en, default en), which imposes English as the default output language unless the user explicitly requests otherwise. This is a natural-language locale policy issue because it forces a specific language without opt-in or offering a neutral user choice in the interaction.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Lines L115-L120 instruct the skill to route CN users to the default Chinese site and non-CN users to an English-locale URL. This imposes a locale decision based on geography rather than offering the user a language choice, which matches the language/locale policy violation criteria.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "[2/4] Submit job" if [[ "${VIDEO_SOURCE}" =~ ^https?:// ]]; then SUBMIT_RESP="$(curl -sS -X POST "${BASE_URL}/video-trans/orchestrate" \ -H "Authorization: Bearer ${API_KEY}" \ -H 'Content-Type: application/json' \ --data-binary @- <<JSON
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README instructs the skill to default to
enif the user does not specify a target language. This imposes a specific language choice without user opt-in, which matches the language/locale policy violation criteria for natural-language instructions.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill requires an API key in an environment variable and uses it for authorization to an external service, but the description does not clearly warn users that sensitive credentials are required and will be handled by the skill. Without that notice, operators may mismanage secrets, expose them in logs, or misunderstand the trust boundary around external authentication.
- Content
Static analysis
No suspicious patterns detected.