Security audit

Zight - video instructions capability for agents

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear Zight-transcript purpose, but its code can fetch arbitrary URLs and caption links instead of enforcing the documented Zight hosts.

Install only if you are comfortable with the skill making outbound requests from your agent environment. It should be tightened to allow only expected Zight HTTPS domains and trusted caption hosts before use in sensitive networks or environments with local services, cloud metadata access, or private files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: skill.py:8
Finding: Unrestricted URL Fetching Enables SSRF and Local File Disclosure
Content: View full analysis
str: req = urllib.request.Request( url, headers={ "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" }, ) with urllib.request.urlopen(req, timeout=timeout) as resp: return resp.read().decode("utf-8", "ignore") ``` ```python # Accept common Zight share URL formats, including: # - https://a.cl.ly/XXXXX # - https://share.zight.com/XXXXX if not re.match(r"^https?://", zight_url, re.I): zight_url = "https://" + zight_url try: html = _fetch_text(zight_url) except (HTTPError, URLError, TimeoutError, ValueError) as e: print(json.dumps({"error": f"Failed to fetch Zight URL: {e}"}, indent=2)) return ``` ```python transcript = "" captions_url = output.get("captions_url") if captions_url: try: vtt = _fetch_text(captions_url) transcript = _vtt_to_text(vtt) except Exception as e: transcript = f"Failed to fetch/parse captions: {e}" ``` ### Technical Analysis The skill documentation identifies `a.cl.ly` and `share.zight.com` as its supported hosts, but the implementation does not enforce either hostname. The primary `zight_url` is accepted from the caller and passed to `urllib.request.urlopen` as long as it starts with HTTP or HTTPS. This permits requests to arbitrary Internet hosts, loopback services, private-network addresses, link-local addresses, and cloud metadata endpoints. The HTML returned by the first request is untrusted. The skill extracts `captions_url` from the page's embedded `store` JSON and passes that value directly to the same generic fetch function. No scheme, hostname, port ...[truncated 2702 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill performs network access to arbitrary user-supplied Zight URLs, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: agents may invoke outbound fetch behavior without clear policy constraints, making review, sandboxing, and least-privilege enforcement harder. The context makes this somewhat more sensitive because the skill explicitly accepts bare host/path input and fetches remote HTML and captions, so network behavior is central to the skill rather than incidental.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill performs outbound HTTP requests to the user-supplied Zight URL and then to a captions URL derived from the remote page, but there is no explicit disclosure or consent mechanism around that network access. In this skill's context, remote fetching is core functionality, so the issue is not code execution but a privacy/transparency weakness: using the skill can cause external requests that expose metadata such as IP, timing, and requested URLs to third parties.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.