X(Twitter) Video Downloader

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward X/Twitter video downloader that sends a provided link to RedFox and returns download metadata, with some credential-handling precautions users should understand.

Use the environment variable or the script's save-key path rather than putting real API keys directly in command lines. Do not submit private or sensitive X/Twitter links unless you are comfortable sharing the URL and your RedFox API key with redfox.hk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

" --api-key ark_your_key` | | **Config File** | `echo '{"api_key":"ark_your_key"}' > ~/.qoder/apis/redfox.json` | ``` From `scripts/downloader.py:125-126`: ```python parser.add_argument("url", help="X(Twitter) video link, e.g. https://x.com/user/status/xxxxx") parser.add_argument("--api-key", help="API Key (format ark_xxx; falls back to env var or config file if not provided)") ``` From `scripts/downloader.py:137`: ```python api_key = get_api_key(cli_key=args.api_key) ``` ### Technical Analysis The skill explicitly supports and documents supplying `REDFOX_API_KEY` as a command-line argument. Secrets passed through command-line arguments can be exposed through shell history, process inspection utilities, process monitoring software, terminal session logs, or automation logs. While exposure through the process table depends on the operating system and its access controls, shell-history persistence is a common and durable disclosure channel. The code accepts the credential directly from `argparse`, so the secret is present in the process argument vector for the duration of execution. ### Attack Path 1. A user follows the documented example and invokes the downloader with `--api-key ark_secret`. 2. The shell records the full command, including the API key, in its command history. 3. During execution, the key may also be visible in the process argument list to an authorized same-host user or monitoring process. 4. A local attacker, support operator, or process with ac ...[truncated 632 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50

Finding

Documented Configuration Command May Create a Readable Plaintext Credential File

Content

View full analysis

~/.qoder/apis/redfox.json` | ``` ### Technical Analysis The documented command writes the API key in plaintext and relies entirely on the user's current `umask` to determine the resulting file permissions. It neither creates the parent directories with restrictive permissions nor explicitly assigns mode `0600` to the file. Under a permissive `umask`, the resulting file may be group-readable or world-readable. The API key is also embedded in the shell command and may therefore remain in shell history. The application's `save_api_key()` function applies mode `0600` after writing the file, but the documented `echo` command bypasses that protection. ### Attack Path 1. A user follows the documented configuration-file command. 2. The shell records the command and plaintext key in its history. 3. The active `umask` permits creation of a group-readable or world-readable file. 4. Another local account or process reads `~/.qoder/apis/redfox.json`, or obtains the key from shell history. 5. The attacker reuses the key to authenticate to the RedFox API. ### Impact Assessment An attacker who reads the file obtains the RedFox API credential and can exercise all API permissions assigned to it. Potential consequences include unauthorized requests, consumption of the victim's API quota, billing impact where applicable, and exposure of account-associated activity. The direct scope is the RedFox API account represented by the key. No evidence indicates that this flaw independently provides elevated operating-system privileges. ]]>

Remediation

View remediation

"$HOME/.qoder/apis/redfox.json" chmod 600 "$HOME/.qoder/apis/redfox.json" ``` Additional hardening measures: 1. Prefer a built-in configuration command that securely prompts for the key without placing it in shell history. 2. Use `getpass.getpass()` for interactive entry. 3. Create the destination atomically with restrictive permissions rather than writing first and correcting permissions afterward. 4. Validate ownership and reject configuration files owned by another user. 5. Document key rotation and revocation procedures. 6. Advise users to rotate keys that may have been stored with permissive permissions or entered directly in a shell command. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/downloader.py:18

Finding

Global Warning Suppression Conceals Security-Relevant Runtime Diagnostics

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 82% confidence

Finding

The claim that the skill returns the 'full description line by line without truncation' indicates potentially unbounded output derived from external tweet content. In agent contexts, unbounded external text can cause context flooding, increased token consumption, and prompt-injection propagation if hostile or extremely long tweet text is returned verbatim.

Content

Scanner excerpt · README.en.md (reported line 29)May include surrounding context.

md

### Core Features

- **Video Parsing**: paste an X(Twitter) video tweet link to parse out the watermark-free video download URL.
- **Complete Information**: displays resource type, duration, download link, cover link, and full description line by line without truncation.
- **Dual Domain Support**: recognizes both x.com and twitter.com links.

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to invoke the skill with very broad natural-language phrases such as 'Help me save this Twitter video' and 'Download this viral video.' These phrases can easily overlap with ordinary conversation, increasing the chance of accidental or unintended activation in agent environments that route requests by semantic similarity rather than explicit commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

README 说明“直接用自然语言描述需求，无需记忆命令”，并给出“帮我把这条推特视频存下来”“下载这条 X 视频”等日常化表达作为示例，但没有限定必须包含链接、平台范围或不触发的情形。这类宽泛话术容易与普通对话重叠，导致技能被意外调用。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to submit X/Twitter links to the redfox.hk API but does not clearly disclose in the description or usage flow that user-provided links are transmitted to a third-party service for processing. This creates a privacy and trust issue because tweet URLs may reveal user interests, internal references, or sensitive investigation targets, and users are not given an informed chance to avoid sharing that data externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code persists the API key to a local config file when --save-key is used, which is a sensitive credential-handling action. Although the save location is printed after the write, there is no prior confirmation prompt or warning at the point of action explaining that the credential will be stored on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The tool sends both a user-supplied URL and the user's API key to redfox.hk, a third-party service, without an explicit privacy or trust warning at the point of use. This can expose sensitive URLs, metadata, or account-related secrets to an external provider, and the risk is amplified because the whole purpose of the script is to proxy user input to that remote API.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · scripts/downloader.py (reported line 221)May include surrounding context.

python

print(f"\n{GREEN}{BOLD}✓ Parsed successfully!{RESET}")

    # Full description (original text, no truncation)
    if desc:
        print(f"\n{CYAN}{BOLD}📝 Description:{RESET}")
        for line in str(desc).splitlines():

Static analysis

No suspicious patterns detected.