Security audit

glm-grounding

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for image grounding, but it directs users to send images and prompts over plaintext HTTP while bypassing proxies, so it should be reviewed before installation.

Install only if the configured model endpoint is approved for the images and prompts users will submit, and if your environment accepts the documented HTTP transport and proxy bypass. Avoid sensitive screenshots, documents, or personal images unless the deployment has reviewed retention, logging, access control, and network protections.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:82
Finding: Plaintext Model API Communication with Mandatory Proxy Bypass
Content: View full analysis
' os.environ['no_proxy'] = '' url = 'http://:/v1/chat/completions' response = HttpInterface(url, prompt, images=[image_path], no_think=True) ``` ### Technical Analysis The Skill directs the Agent to transmit user-provided images and prompts to a model API over plaintext HTTP. HTTP provides neither transport confidentiality nor cryptographic server authentication. Consequently, an attacker with network-path visibility could inspect requests or alter requests and responses. The instructions also require adding the model host to both `NO_PROXY` and `no_proxy`. This bypasses configured proxy infrastructure for that destination. In environments where proxies provide TLS enforcement, access control, monitoring, content inspection, or egress auditing, the prescribed bypass removes those controls. The endpoint is hard-coded to a private IP address in the complete example. A private address does not establish endpoint trust: the host could be compromised, reassigned, impersonated through network manipulation, or observed by another actor on the internal network. The package contains only `SKILL.md`; the referenced `i ...[truncated 1862 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs sending user-provided images and prompts to an HTTP model API, but it does not include any user-facing notice, consent step, or data-handling guidance. Because images may contain sensitive content and the example uses an internal host over plain HTTP, this creates a real privacy and confidentiality risk if users or operators assume local-only processing.
Content: No source excerpt is available for this finding.