Security audit

Aoment Visuals

Security checks for vulnerabilities and agentic risk

Overview

This is a real Aoment image/video generation skill, but it needs review because it requires unverified remote updates and can fetch arbitrary reference-image URLs from the user's environment before uploading them to Aoment.

Install only if you are comfortable sending prompts, reference images, nicknames, API keys, and generated-media downloads through Aoment. Do not let an agent auto-replace this skill from the latest ZIP without manual review and integrity checks. Avoid passing sensitive internal URLs as reference images, and prefer safer credential handling than putting real API keys directly in shell commands.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/aoment_visuals.py:133
Finding: Unrestricted reference-image URL retrieval enables internal resource disclosure
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:12
Finding: Mandatory unsigned remote Skill updates permit post-audit payload substitution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/aoment_visuals.py:3
Finding: Unpinned runtime dependency creates avoidable supply-chain exposure
Content: View full analysis
=3.10" # dependencies = [ # "requests>=2.28.0", # ] # /// ``` ### Technical Analysis The declared `requests>=2.28.0` constraint permits any future compatible release to be selected when the scripts are run through `uv run`. The project provides no lockfile, exact dependency version, or package hash. This makes installations non-reproducible: the same audited source can execute with different dependency code at different times. Although no malicious dependency is present in the reviewed project, resolving mutable third-party packages at runtime increases exposure to repository compromise, dependency-account compromise, and unexpected security regressions. The package name is legitimate and is not an observed typosquat. The risk arises from broad runtime resolution rather than from evidence that the current `requests` package is malicious. ### Attack Path 1. A future dependency version is compromised, maliciously published, or contains a relevant security regression. 2. The user invokes a script through `uv run`. 3. The resolver selects the affected release because it satisfies `requests>=2.28.0`. 4. The dependency is installed into the execution environment. 5. Dependency code is imported by the Skill and executes within the Agent process. ### Impact Assessment A malicious dependency executes with the same privileges as the Skill and could potentially: - Read files and environment data accessible to the Agent - Intercept API keys, prompts, images, and responses - Alter network destinations or request contents - Execute additional local actions - Compromise generated out ...[truncated 160 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/aoment_visuals.py:231
Finding: Bearer API keys exposed through command-line arguments
Content: View full analysis
-t text-to-image -p "a cute cat playing in a garden" # 3. Check remaining quota uv run {baseDir}/scripts/aoment_quota.py -k ``` The generation client requires the key as an argument: ```python parser.add_argument( "--api-key", "-k", required=True, help="Agent API Key（通过 aoment_register.py 注册获取）", ) ``` The quota client uses the same pattern: ```python parser.add_argument( "--api-key", "-k", required=True, help="Agent API Key（通过 aoment_register.py 注册获取）", ) ``` The key is then used as a bearer credential: ```python def _auth_headers(api_key: str) -> dict: """构建包含 Agent API Key 的认证头""" return {"Authorization": f"Bearer {api_key}"} ``` ### Technical Analysis Command-line arguments are not an appropriate primary transport for long-lived bearer credentials. Depending on the operating system and runtime environment, arguments may be visible through: - Process inspection facilities - Monitoring and observability agents - Shell history - Command audit logs - Agent execution telemetry - Debugging or diagnostic reports Anyone who obtains the bearer key can authenticate without another factor until the key expires or is revoked. The application does not print an existing key during normal generation or quota operations, but the documented invocation method unnecessarily increases its exposure. ### Attack Path 1. A user follows the documentat ...[truncated 902 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation promises image/video generation and API-key registration, but the analyzed package appears not to implement those functions and instead includes other behavior such as quota/account querying. A description-behavior mismatch prevents informed consent, impairs review, and can hide unexpected network or account-related operations behind a benign-looking skill label.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The skill instructs the agent to take a URL returned by an external service and immediately fetch it with curl. This is effectively a second-stage network fetch controlled by remote output, which can enable SSRF-like behavior, retrieval of unexpected content, large-file abuse, or downloading from untrusted domains if response validation is absent.
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
bash
# Download image curl -L -o output.jpg "$(uv run {baseDir}/scripts/aoment_visuals.py -k <your-api-key> -t text-to-image -p 'prompt' | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['image_url'])")" # Or in two steps: # 1. Generate

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The documented pipeline feeds tool output directly into another command without an approval or validation boundary. When a network-facing script can influence the argument passed to curl, an attacker controlling the upstream response can steer the agent into unintended network actions or resource consumption.
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
bash
# Download image curl -L -o output.jpg "$(uv run {baseDir}/scripts/aoment_visuals.py -k <your-api-key> -t text-to-image -p 'prompt' | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['image_url'])")" # Or in two steps: # 1. Generate

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no explicit tool scope or allowed-tools despite documented behavior that requires network access and likely file interaction. Missing capability scoping increases the chance an agent runtime grants broader permissions than necessary, which weakens containment if the skill or its dependencies are compromised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to download and replace the skill package from a remote URL before use based only on freshness, not integrity. This creates a supply-chain execution path where a compromised host, tampered archive, or malicious update can change agent behavior and gain whatever permissions the skill has.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Instructing agents to fetch updated skill packages automatically without warning about executable-code risk normalizes unsafe behavior and bypasses normal review controls. In the context of agent skills, remote package replacement is especially dangerous because it can silently alter future executions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation does not clearly warn that prompts, reference images, and API keys are sent to an external third-party service. This is a privacy and secret-handling issue because users may provide sensitive content or credentials without understanding the external transmission and retention implications.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
Or register via API directly:

bash
curl -X POST https://www.aoment.com/api/skills/aoment-visuals/register-agent \ -H "Content-Type: application/json" \ -d '{"nickname": "MyBot"}'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and CLI description are entirely in Chinese, including the user-facing purpose and authentication guidance. This imposes a specific language on users without opt-in, and there is no indication that the skill is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language description is entirely in Chinese and presents the tool as a registration utility without indicating that the language is fixed or optional. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The script performs an outbound POST request to a remote service and allows the destination to be overridden via --api-base, but it does not validate or constrain the target host. In an agent context, this can be abused to send the provided nickname and receive arbitrary JSON from an attacker-controlled endpoint, enabling unintended data disclosure and trust of unverified remote responses.
Content: Scanner excerpt · scripts/aoment_register.py (reported line 31)May include surrounding context.
python
url = f"{api_base}{REGISTER_ENDPOINT}" payload = {"nickname": nickname} resp = requests.post(url, json=payload, timeout=TIMEOUT) resp.raise_for_status() return resp.json()

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language description and all user-facing help strings in this file are written only in Chinese, with no indication that users can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/aoment_visuals.py (reported line 51)May include surrounding context.
python
"imageSize": args.image_size, } response = requests.post( url, json=payload, headers=_auth_headers(args.api_key), timeout=IMAGE_TIMEOUT ) result = response.json()

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code sends user-supplied prompts and, in other paths, image data to a remote service, but the script does not provide a runtime notice, confirmation, or explicit warning that these inputs are transmitted off-system. The top docstring describes the service but does not clearly disclose the privacy-impacting behavior of uploading user content to an external endpoint.
Content: No source excerpt is available for this finding.

Tainted flow: 'data' from requests.get (line 204, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/aoment_visuals.py (reported line 97)May include surrounding context.
python
headers = _auth_headers(args.api_key) if files: response = requests.post( url, data=data, files=files, headers=headers, timeout=IMAGE_TIMEOUT ) else:

Tainted flow: 'data' from requests.get (line 204, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/aoment_visuals.py (reported line 101)May include surrounding context.
python
url, data=data, files=files, headers=headers, timeout=IMAGE_TIMEOUT ) else: response = requests.post( url, data=data, headers=headers, timeout=IMAGE_TIMEOUT )

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code issues requests.get against arbitrary user-controlled reference_image URLs before uploading the bytes onward. This is a classic SSRF-style pattern: if the skill runs in a privileged network environment, an attacker could make it reach internal services, cloud metadata endpoints, or other restricted resources and then exfiltrate the responses.
Content: No source excerpt is available for this finding.

Tainted flow: 'data' from requests.get (line 204, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 86% confidence
Finding: In video generation, the skill fetches arbitrary user-supplied URLs and then forwards the retrieved content to the remote API as uploaded files. This creates a server-side request behavior on the host running the skill and can be abused to access internal-only or otherwise unintended network resources, then exfiltrate the fetched content to the external service.
Content: Scanner excerpt · scripts/aoment_visuals.py (reported line 149)May include surrounding context.
python
headers = _auth_headers(args.api_key) if files_list: response = requests.post( url, data=data, files=files_list, headers=headers, timeout=VIDEO_TIMEOUT ) else:

Tainted flow: 'data' from requests.get (line 204, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/aoment_visuals.py (reported line 153)May include surrounding context.
python
url, data=data, files=files_list, headers=headers, timeout=VIDEO_TIMEOUT ) else: response = requests.post( url, data=data, headers=headers, timeout=VIDEO_TIMEOUT )

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.md (reported line 6)May include surrounding context.
md
Powered By Longfor.AuraSpace LICENSE: This skill and its related documentation are protected by license terms. Unless otherwise permitted by applicable law or expressly authorized in writing, no individual or entity may use the skill beyond the scope expressly granted by the license. Without permission, the skill may not be copied, distributed, resold, reverse engineered, or used for any purpose outside the authorized scope. The skill is provided "as is", without warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. To the maximum extent permitted by law, the licensor shall not be liable for any loss resulting from the use or inability to use this skill.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.md (reported line 6)May include surrounding context.
md
Powered By Longfor.AuraSpace LICENSE: This skill and its related documentation are protected by license terms. Unless otherwise permitted by applicable law or expressly authorized in writing, no individual or entity may use the skill beyond the scope expressly granted by the license. Without permission, the skill may not be copied, distributed, resold, reverse engineered, or used for any purpose outside the authorized scope. The skill is provided "as is", without warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. To the maximum extent permitted by law, the licensor shall not be liable for any loss resulting from the use or inability to use this skill.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This Python code sends the provided nickname to a remote HTTPS endpoint via an HTTP POST request. While the script purpose implies registration, there is no explicit disclosure in a prompt, print statement, or comment near execution that user input will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The script accepts an Agent API Key and places it into an Authorization header for outbound requests, but there is no explicit warning or note about the sensitivity of this credential beyond stating it is required for authentication. For a code file, sensitive credential use should have some visible disclosure, comment, or user-facing explanation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest says this skill provides text-to-image, image-to-image, and video generation with API key registration support. In addition to those generation operations, the code performs a remote version check and exits if the local skill is outdated, which is a separate control/update-enforcement behavior not reflected in the stated description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.