luma

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.2.9

Overview

This skill coherently helps agents generate Luma videos through RunAPI, with disclosed CLI, network, file, and authentication use, but users should be aware of install and shell-template hygiene risks.

Install only if you trust RunAPI's Homebrew tap and CLI distribution. Use a scoped RunAPI API key where possible, avoid exposing unrelated local files, and ensure any downloaded deliverable URLs and output paths are handled safely with quoting and validation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned Executable Installed from a Third-Party Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12-17 **Vulnerability Type**: Supply-chain exposure through an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: brew formula: runapi-ai/tap/runapi bins: - runapi ``` ### Technical Analysis The skill instructs the environment to install and execute the `runapi` CLI from the custom Homebrew tap `runapi-ai/tap`. It does not pin an immutable version, formula revision, source commit, checksum, or cryptographic signature. Consequently, the executable installed when the skill is used can differ from the version that existed when the skill was reviewed. A compromise of the tap, its release infrastructure, the referenced package location, or the publisher account could introduce attacker-controlled code without requiring any change to `SKILL.md`. The source appears related to the declared RunAPI service, and there is no evidence in the reviewed project that the current package is malicious. The vulnerability is the absence of controls that establish the identity and integrity of the executable. ### Attack Path 1. An attacker compromises the custom Homebrew tap, its maintainer account, or an upstream artifact referenced by its formula. 2. The attacker publishes a modified `runapi` package under the expected formula name. 3. An agent loads the skill and follows its installation metadata. 4. Homebrew resolves and installs the current, unpinned package. 5. Malicious installation logic can run during installation, or the resulting executable can run when the skill invokes `runapi`. 6. The compromised executable operates with the privileges and environment access of the user running the agent. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the account that installs or invokes the CLI. This may expose files readable by that account, saved CLI credentials, environment variables such as `RUNAPI_API_K ...[truncated 362 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a reviewed version and, where supported, an immutable formula revision or source commit. 2. Verify downloaded artifacts against a publisher-provided cryptographic checksum or signature before execution. 3. Document the canonical package repository and trusted signing identity. 4. Prefer a package source with reproducible releases and authenticated provenance. 5. Do not automatically install or execute the CLI if its version and integrity cannot be verified. 6. Run the CLI with least privilege and expose only the task-specific files and environment variables it requires. 7. Establish a controlled update process in which new dependency versions are reviewed before the pin is advanced. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:79
• Finding: Unsafe Shell Interpolation of Remotely Supplied Deliverable URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 79-84 **Vulnerability Type**: Potential shell command and argument injection **Risk Level**: Medium ### Vulnerable Code ```shell curl --fail --location <deliverable-url> --output <downloaded-file> for file in <downloaded-files>; do expected_mime=<expected-MIME-or-family-pattern-for-this-file> test -s "$file" [[ "$(file --brief --mime-type "$file")" == $expected_mime ]] done ``` ### Technical Analysis The documented command places a deliverable URL, output path, file list, and MIME pattern into shell syntax without requiring safe quoting, validation, or array-based argument handling. The deliverable URL originates from a remote API response and therefore crosses a trust boundary. If an agent performs direct textual substitution into this template, shell metacharacters, whitespace, command substitutions, redirections, or option-like values could be interpreted by the shell rather than passed as literal data to `curl`. Unsafe output filenames could similarly alter arguments or target unintended filesystem locations. The unquoted MIME assignment can also be affected by shell expansion. This is a potential injection path in the prescribed operational instructions; the reviewed file does not contain a concrete malicious URL or evidence that exploitation has already occurred. ### Attack Path 1. An attacker compromises the remote service, an upstream result source, or another component capable of influencing a returned deliverable URL or filename. 2. The service returns a crafted value containing shell syntax, whitespace, option-like content, or a malicious output path. 3. An agent extracts that value and directly substitutes it into the documented shell template. 4. The shell parses attacker-controlled characters as syntax or additional command arguments. 5. The injected operation runs with the privileges of the agent process, or `curl` writes to an attacker-selected location. 6. The ...[truncated 761 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse response fields with a structured JSON parser such as `jq` rather than textual substitution. 2. Store each value in a quoted shell variable and preserve it as a single argument: ```shell deliverable_url="$(jq -er '.deliverable_url' result.json)" output_file="$(mktemp --tmpdir luma-output.XXXXXX)" curl --fail --location -- "$deliverable_url" --output "$output_file" ``` 3. Validate that the URL uses an expected scheme, preferably `https`, before passing it to `curl`. 4. Apply an approved-host policy when the service contract defines trusted media hosts. 5. Reject control characters, embedded newlines, and malformed URLs. 6. Generate output paths locally instead of deriving them directly from remote filenames. 7. Use shell arrays for multiple downloaded files: ```shell downloaded_files=("$output_file") for file in "${downloaded_files[@]}"; do test -s "$file" done ``` 8. Quote MIME values and compare them without evaluation or unintended glob expansion. 9. Consider implementing the download and validation operation in a language API that passes process arguments as an array without invoking a shell. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.