Security audit

Giggle Generation Aimv

Security checks for vulnerabilities and agentic risk

Overview

This skill is for Giggle MV generation, but it can automatically make a billable payment using your Giggle API key without a separate confirmation step.

Review this before installing if your Giggle account can be charged. Only use it if you are comfortable with the workflow automatically paying pending MV projects through GIGGLE_API_KEY; a safer version would require explicit confirmation of amount and project before payment.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/trustee_api.py:426
Finding: Automatic Payment Without Explicit User Authorization
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/requirements.txt:1
Finding: Unbounded Third-Party Dependency Version
Content: View full analysis
=2.31.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version of `requests`. Package installation can therefore resolve to any later release available from the configured package index. No lock file or cryptographic hashes are supplied to make installation reproducible or verify the exact artifact selected. The dependency is legitimate and consistent with the skill's declared network functionality. There is no evidence that the current `requests` package is malicious. The risk is prospective: an incompatible, compromised, or otherwise unsafe future release could be selected automatically during installation. ### Attack Path 1. An installer processes `scripts/requirements.txt`. 2. The package resolver selects the newest available `requests` version satisfying `>=2.31.0`. 3. If the selected future release or distribution artifact is compromised or incompatible, it is installed because no upper bound, exact pin, or integrity hash prevents its selection. 4. The installed package code is imported by `_check_requests()` when the skill runs. 5. Any malicious package-level behavior would then execute with the privileges of the user running the skill. This attack path is contingent on compromise of the dependency distribution channel or a future unsafe release; no such compromise was observed in the audited project. ### Impact Assessment A compromised dependency would execute in the local Python process and inherit the user's process permissions. It could potentially access environment variables, including `GIGGLE_API_KEY`, make network requests, and read or modify files accessible to that user. The confirmed project issue is the absence of deterministic dependency pinning and integrity verification, not evidence of an existing maliciou ...[truncated 17 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow explicitly states it will detect pending payment states and call the pay endpoint automatically, but the skill description and earlier warning sections do not clearly disclose that execution may incur charges. This is especially dangerous because a user or agent could invoke the skill expecting generation only, while the workflow proceeds to bill the associated account without separate informed consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The execute_workflow() routine automatically transitions from task creation into payment when pay_status is pending or the current step suggests payment. This is dangerous because a user asking to generate an MV could unknowingly trigger a billable action, making the skill capable of spending funds without a distinct consent boundary.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The automatic call to pay() is not necessary to satisfy the stated purpose of creating AI music videos and therefore broadens the skill's authority into financial operations. In practice, this enables an agent to convert a content-generation request into a purchase flow, increasing the risk of unauthorized or surprising charges.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill requires access to environment variables and performs outbound network calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens sandboxing and review controls because an agent may invoke capabilities not clearly surfaced to operators, increasing the risk of unintended secret access or network use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains broad phrases like 'music video' and 'lyrics video', which can cause the skill to activate for ambiguous user requests that may not intend external API use. In this skill's context, over-triggering is more dangerous because activation can lead to network requests and an automated payment-capable workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation gives conflicting operational guidance: it says not to retry on error, but later states the script auto-retries network failures up to 5 times. In a workflow that can trigger payment and long-running API actions, contradictory retry semantics can cause duplicate submissions, repeated charges, or unsafe agent behavior under failure conditions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation tells the operator both 'do not retry on error' and later that network failures should be retried automatically up to 5 times. This inconsistency can lead to unsafe or unintended repeated requests in a workflow that also submits jobs and may trigger payment, causing duplicate actions, unexpected charges, or confusing operational behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill states that the workflow will automatically detect and pay pending items, but it does not prominently warn that invoking the workflow can incur real charges. In an agent setting, this creates a high risk of unauthorized or surprising purchases because a user may think they are only generating content, not approving payment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file exposes a dedicated pay() method that executes a billable remote action, which exceeds the advertised skill purpose of generating music videos. In an agent setting, this creates a financial-action capability that could be invoked without the user clearly understanding that money may be charged.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow performs a sequence that may culminate in payment, but there is no explicit warning or confirmation step at the workflow entry point informing the operator that charges may occur. This weakens user consent and makes accidental spending more likely, especially when embedded in autonomous agent behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI exposes a pay command that directly triggers a billable action without any safety prompt, dry-run mode, or confirmation guard. This can lead to accidental charges from mistaken command execution, script misuse, or agent/tool invocation without the operator recognizing the financial consequence.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency is specified as requests>=2.31.0, which allows any future version and does not guarantee a known-good, reproducible install. This can introduce vulnerable or breaking releases into the environment over time and makes it difficult to verify whether deployed versions are affected by published advisories.
Content: Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: Because requests is not pinned, the manifest does not let reviewers determine whether the installed version is vulnerable to any of the known advisories affecting that package. In a skill that may interact with external services or user-supplied URLs/media workflows, uncertainty around HTTP client security increases supply-chain and runtime risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.