Giggle Video

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:39 AM UTC
• Version: 0.1.0

Overview

This video-generation skill is mostly coherent, but it needs Review because it uses a bearer API key with a configurable request origin and dynamically loads platform instructions without clear allowlisting.

Install only if you are comfortable sending prompts and video parameters to giggle.pro and storing generated-output metadata locally. Use a narrowly scoped Giggle API key, avoid setting GIGGLE_API_BASE unless you fully trust and validate the destination, and prefer explicit platform selection until the skill adds a fixed platform allowlist.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:28
• Finding: User-Controlled Platform Identifier Can Load Unintended Skill Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 28-48 **Vulnerability Type**: Path traversal into instruction files **Risk Level**: Medium ### Vulnerable Code ```markdown | prompt | string | Yes | Video description/prompt | | platform | string | No | Target platform ID (see impl/), default `giggle` | ``` ```markdown Stage 2 — Submit task Load impl/{platform}.md according to the platform parameter. Invoke the implementation layer to submit a generation task and obtain task_id. ``` ### Technical Analysis The `platform` parameter is supplied by the user and is interpolated directly into the instruction-file path `impl/{platform}.md`. The skill does not require the Agent or runtime to validate the value against a fixed platform allowlist, canonicalize the resulting path, or reject path separators and traversal sequences. A platform value containing `../`, an absolute path, or platform-specific separators could therefore resolve outside the intended `impl/` directory. Because the loaded Markdown is treated as implementation instructions, loading an unintended file can alter the Agent's behavior within the current session. This is best classified as instruction hijacking rather than ordinary data-file disclosure. ### Attack Path 1. An attacker asks the Agent to generate a video and supplies a crafted platform value, such as `../SKILL` or another traversal path targeting a Markdown file. 2. The Agent follows the documented construction rule and attempts to load `impl/{platform}.md`. 3. Path normalization resolves the crafted path outside the intended implementation directory. 4. The Agent reads the targeted file as trusted implementation guidance. 5. Instructions in that file can redirect the current workflow, request additional tools, or override the intended video-generation procedure. Exploitation requires a suitable readable file to exist at a path reachable ...[truncated 643 chars]
• Remediation: ## Remediation Suggestions - Replace path interpolation with a fixed mapping, for example `giggle -> impl/giggle.md`. - Reject unknown platform identifiers before opening any file. - Restrict identifiers to a conservative pattern such as `^[a-z0-9_-]+$`. - Explicitly reject `/`, `\`, `..`, URL schemes, absolute paths, and encoded path separators. - Resolve and canonicalize the selected path, then verify that it remains under the canonical `impl/` directory. - Treat implementation documents as package-controlled resources rather than arbitrary user-selected files.

T09 · Insecure Skill Coding Practices

Error

• Location: impl/giggle.md:9
• Finding: Configurable API Base URL Can Exfiltrate the Bearer Credential## Vulnerability Details **File Location**: `impl/giggle.md`, lines 9-21 **Vulnerability Type**: Unvalidated credential-bearing request destination **Risk Level**: High ### Vulnerable Code ```markdown | platform id | `giggle` | | Network allowlist | `api.giggle.pro`, `cdn.giggle.pro` | | Authentication | Bearer Token | | API Key variable | `GIGGLE_API_KEY` | | Base URL variable | `GIGGLE_API_BASE` (default `https://api.giggle.pro/v1`) | ## Submit generation task ``` POST ${GIGGLE_API_BASE}/video/generate Headers: Authorization: Bearer ${GIGGLE_API_KEY} Content-Type: application/json ``` ``` ### Technical Analysis The destination of the API request is controlled by the `GIGGLE_API_BASE` environment variable, while the same request unconditionally carries `GIGGLE_API_KEY` in its `Authorization` header. Although a safe default and a domain allowlist are documented, no validation procedure requires the resolved request URL to use HTTPS and the exact hostname `api.giggle.pro`. Consequently, a modified environment value can redirect the request to an attacker-controlled server. The request would disclose both the bearer credential and user-provided generation content. The configurable destination also conflicts with the stated constraint in `SKILL.md` that only allowlisted implementation domains may be accessed. Redirect handling presents a related risk if the HTTP client forwards authorization headers across origins. DNS and URL parsing ambiguities should also be considered when implementing the hostname check. ### Attack Path 1. An attacker or compromised deployment mechanism changes `GIGGLE_API_BASE` to an attacker-controlled endpoint, such as `https://attacker.example/v1`. 2. A user invokes the video-generation skill. 3. The Agent constructs the gene ...[truncated 967 chars]
• Remediation: ## Remediation Suggestions - Prefer a hardcoded API origin and allow configuration only for non-sensitive path components. - If an override is operationally necessary, parse it as a URL and require: - the `https` scheme; - the exact hostname `api.giggle.pro`; - an approved port; - no embedded user information; - an approved base path. - Do not validate destinations with substring or suffix-only comparisons. - Disable cross-origin forwarding of the `Authorization` header and reject redirects to non-allowlisted origins. - Apply the same validation to generation, estimation, and status-polling requests. - Use a narrowly scoped API key, rotate it after suspected exposure, and monitor audit logs for unauthorized use. - Enforce the documented network allowlist at the gateway or network-egress layer rather than relying only on skill instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description does not clearly disclose that prompts and generation metadata will be transmitted to third-party video platforms. Users may include sensitive business, personal, or copyrighted material in prompts without understanding that the data leaves the local environment, creating privacy and confidentiality risks.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger conditions are broad enough to match generic requests like generating videos or discussing creative ideas, which can cause the skill to activate outside a narrowly intended context. Over-broad activation increases the chance that user content is sent to an external service or archived without the user clearly intending to use this specific integration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented archive path shows that generated results and metadata are stored in a shared/local output location, but the skill does not warn users of this persistence behavior. This can expose prompts, URLs, and project metadata to other local users, processes, or downstream tooling that has access to the shared directory.

External Transmission

Medium

• Category: Data Exfiltration

Content

| 网络白名单        | `api.giggle.pro`, `cdn.giggle.pro`                    |
| 认证方式          | Bearer Token                                          |
| API Key 环境变量  | `GIGGLE_API_KEY`                                      |
| Base URL 环境变量 | `GIGGLE_API_BASE`（默认 `https://api.giggle.pro/v1`） |

## 提交生成任务

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: Most of the operational instructions, triggers, parameters, and safety constraints are presented only in Chinese, which effectively imposes a language requirement on users and maintainers. The file does not indicate that this locale is optional, user-selectable, or justified as a region-specific skill.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This markdown file documents authentication via a Bearer token and names the `GIGGLE_API_KEY` environment variable, but it does not include any warning about handling credentials securely or avoiding accidental exposure. Under the markdown-file criteria for missing user warnings, this is a privacy/safety-relevant behavior that should be disclosed to users.