T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:128- Finding
SeaArt Authentication Token Is Printed to Terminal and Agent Logs
- Content
View full analysis
- Remediation
View remediation
Security audit
SeaArt Image Generator
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but its instructions can expose the user's SeaArt authentication token in logs.
Review this skill before installing. Do not let an agent run `echo $SEAART_TOKEN`; use a non-printing presence check instead. Only install the Python dependency from a trusted source, preferably in a virtual environment, and use this skill only if you trust SeaArt with your prompts and account session token.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:10- Finding
Unpinned Runtime Installation of the Requests Dependency
- Content
View full analysis
- Remediation
View remediation
\ --hash=sha256: ``` 3. Pin and hash all transitive dependencies, not only `requests`. 4. Install with integrity enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 5. Use an isolated virtual environment rather than the global Python environment. 6. Configure a trusted package index explicitly and review any organization-specific mirror. 7. Avoid running pip as root or an administrator. 8. Add automated dependency and provenance scanning to release workflows. 9. Vendor a reviewed dependency set or publish a reproducible locked environment if the execution platform permits it. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill requires access to a sensitive environment variable and makes authenticated network requests, but it declares no explicit tool scope or permission boundary. This increases the chance an agent can use env and network capabilities without transparent user review, which is risky here because the skill handles a token explicitly described as password-like.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill hard-codes English as the locale via the
accept-language: 'en'header and alang='en'cookie. This imposes a specific language setting on all requests without offering the user a choice or documenting a justified region-specific requirement.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest and earlier documentation state the default model is 'SeaArt Infinity', but the usage instructions later say to default to 'WAI-ANI-NSFW-PONYXL'. These are materially different generation behaviors, so the documentation does not consistently describe what the skill is intended to do.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The aspect-ratio table uses Chinese-only or Chinese-first labels such as 方图, 竖图, 横图, and 手机竖屏, and the example usage is also partly presented in Chinese. While not severe, this can reflect a locale-specific presentation without explicitly stating that users may interact in any language or choose their preferred locale.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill manifest context describes an image-generation capability on SeaArt, and the file's security manifest documents only access to SEAART_TOKEN. However, the code also reads SEAART_DEFAULT_MODEL_NO and SEAART_DEFAULT_MODEL_VER to control behavior, which is an extra configuration capability not disclosed in the documented environment-variable access for this skill file.
- Content