Security audit

Dargue Flag

Security checks for vulnerabilities and agentic risk

Overview

This video-search skill is functional but needs review because it under-discloses adult-content behavior and handles an API key in risky ways.

Review before installing. Use only if you intentionally want this adult-oriented video workflow, are comfortable sending searches and detail requests to the configured service, and can protect or rotate the API key. The endpoint should be restricted to the intended HTTPS API host and the key should not be pasted into chat or stored in an unprotected plaintext file.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/video-search.js:31
Finding: Insecure API Key Handling and Unrestricted API Endpoint Configuration
Content: View full analysis
{ const baseUrl = (loadConfig().baseUrl || DEFAULT_BASE_URL).replace(/\/+$/, ''); const fullUrl = new URL(urlPath, baseUrl); const isHttps = fullUrl.protocol === 'https:'; const mod = isHttps ? https : http; const options = { hostname: fullUrl.hostname, port: fullUrl.port || (isHttps ? 443 : 80), path: fullUrl.pathname + fullUrl.search, method: method, headers: { 'X-API-Key': apiKey, } }; ``` The configuration command accepts an arbitrary base URL and saves it together with the API key: ```javascript async function config(args) { const apiKey = getArg(args, '--api-key'); const baseU ...[truncated 2896 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a generic video browsing tool, but the instructions reveal hidden behaviors: API key collection and persistence, quota/account workflows, and direct disclosure of streaming URLs for adult-content resources. This mismatch is dangerous because it conceals the true nature and data-handling behavior of the skill, undermining informed consent and increasing the risk of unsafe or policy-violating use.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill invokes local scripts and reads/writes configuration containing an API key, but it declares no explicit tool scope or permission boundary. That makes the skill's operational capabilities opaque to the platform and increases the chance of unintended access to local environment or filesystem resources beyond what users expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Broad trigger phrases like '看视频' or '来点视频' can cause the skill to activate for ordinary, unrelated requests, leading users into an adult-content workflow unexpectedly. In this context, accidental invocation is more dangerous because the underlying content appears pornographic rather than neutral entertainment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill is written to operate in Chinese and instructs the assistant to present fixed Chinese responses, with no option for the user to choose another language. This is a natural-language policy issue because the skill imposes a locale/language behavior without documenting user choice or opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation rule applies to essentially any request related to watching videos, which is overly broad for a skill serving adult-oriented resources. This can route benign video requests into a sensitive content flow without adequate confirmation or safety checks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The reference file explicitly maps categories to 91-site URL paths, which strongly indicates the skill is designed to browse pornographic content while the manifest describes it only generically as 'search and browse video content.' This mismatch is dangerous because it conceals sexually explicit functionality from reviewers and users, increasing the risk of policy evasion, unsafe deployment contexts, and accidental exposure to adult content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The request function transmits user-provided search terms or detail URLs together with the API key to a remote service, but the tool provides no privacy notice or consent flow. In this skill context, the queries and viewed content may be highly sensitive, so undisclosed transmission meaningfully increases privacy risk even if it is part of normal functionality.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The config command allows arbitrary override of the base URL, and the request layer will send the API key to whatever host and protocol are configured. This turns the tool into a generic credential-bearing HTTP client, enabling exfiltration of the API key and user queries to attacker-controlled infrastructure, including over insecure plain HTTP.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The config flow stores the API key in a local JSON file under the user's home directory without warning, permission hardening, or use of a secure secret store. Local plaintext persistence increases the chance of credential disclosure through other local users, backups, logs, or malware on the host.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill's declared purpose is search, browse, and detail viewing, but the detail output exposes direct playback URLs such as highurl, lowurl, and HLS stream links. This materially expands capability from metadata retrieval into content access and redistribution, which is especially risky in a video skill whose content appears adult-oriented and may bypass expected platform controls or auditing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill as a Chinese-language experience, with no indication that users can choose another language or locale. This may violate language/locale policy when a skill implicitly restricts interaction language without documenting user choice or a justified regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file uses Chinese throughout, including the title and category labels, but does not indicate that the skill is intentionally region-specific or provide any user opt-in for language preference. Under the policy rule for natural-language locale constraints, forcing a specific language without choice can be a violation when no justification is given.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-facing help text and console messages are predominantly in Chinese, and the tool does not offer a language/locale selection mechanism. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.