ClawHub
Back to skill

Security audit

Veo Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Monet/Veo video-generation guide, but one documented upload command can expose the user's API key in verbose logs.

Review before installing. Use this only for content you are willing to send to monet.vision, keep MONET_API_KEY in a secure environment variable or secrets manager, avoid hardcoding or logging it, and remove the -v flag from the upload command unless Authorization headers are safely redacted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:294
Finding

Bearer Token Disclosure Through Verbose curl Output in SKILL.md

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:294-298
Vulnerability Type: Credential exposure through verbose diagnostic output
Risk Level: Medium

Vulnerable Code

bash
curl -X POST https://monet.vision/api/v1/files \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -F "file=@/path/to/your/image.jpg" \
  -v

Technical Analysis

The documented upload command combines an authorization header containing MONET_API_KEY with curl's verbose (-v) option. Verbose mode writes request details, including outgoing headers, to standard error. After shell expansion, this output can contain the complete bearer token.

Uploading a user-selected reference image and authenticating to https://monet.vision are necessary for the declared image-to-video functionality. However, exposing the authentication header through verbose diagnostics is not necessary and exceeds the minimum information exposure required to perform the upload.

The token may be retained in terminal recordings, CI/CD logs, AI-agent execution transcripts, redirected diagnostic output, support bundles, or other centralized logging systems. HTTPS protects the credential in transit but does not prevent its disclosure through local verbose output.

Attack Path

  1. A user or agent follows the upload example in SKILL.md.
  2. The shell expands $MONET_API_KEY into the authorization header.
  3. The -v option causes curl to print the outgoing request headers to standard error.
  4. A terminal recorder, automation platform, agent transcript, or CI system captures that output.
  5. An attacker or unauthorized operator with access to the captured output extracts the bearer token.
  6. The attacker reuses the token against the Monet API until it is revoked or expires.

Impact Assessment

An exposed token may let an attacker act with the API permissions assigned to the affected Monet credential. Depending on server-side authorization, this ma ...[truncated 409 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove -v from the upload example:

    bash
    curl -X POST https://monet.vision/api/v1/files \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -F "file=@/path/to/your/image.jpg"

  2. If troubleshooting instructions are necessary, explicitly warn users that verbose HTTP output may expose authorization headers.

  3. Use sanitized diagnostics that redact Authorization, cookies, API keys, and signed URLs before logs are stored or shared.

  4. Configure CI and agent platforms to mask MONET_API_KEY in both standard output and standard error.

  5. Restrict log access and retention, and avoid including raw request headers in support bundles.

  6. Rotate any API key that may already have appeared in verbose output.

  7. Use narrowly scoped, revocable, and expiring API credentials if the Monet platform supports them.

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:177
Finding

Bearer Token Disclosure Through Verbose curl Output in README.md

Content
View full analysis

Vulnerability Details

File Location: README.md:177-181
Vulnerability Type: Credential exposure through verbose diagnostic output
Risk Level: Medium

Vulnerable Code

bash
curl -X POST https://monet.vision/api/v1/files \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -F "file=@/path/to/your/image.jpg" \
  -v

Technical Analysis

This upload example transmits the required Monet bearer token while enabling curl's verbose (-v) output. Curl can consequently print the expanded Authorization request header to standard error. The secret can then be persisted by terminal capture, CI logging, AI-agent transcripts, redirected output, or diagnostic collection.

Authentication and transmission of a user-selected reference image to the declared Monet service are consistent with the Skill's stated functionality. Verbose disclosure of the authentication header is not required for that functionality and unnecessarily increases credential exposure.

TLS protects the request while it travels over the network, but it does not mitigate credential leakage into local or centralized logs.

Attack Path

  1. A user or automated agent copies and executes the documented command.
  2. $MONET_API_KEY is expanded into the bearer authorization header.
  3. Curl's verbose mode writes outgoing headers, potentially including the complete token, to standard error.
  4. Execution output is captured in a terminal log, CI job, agent transcript, or support artifact.
  5. An unauthorized party reads the captured output and obtains the token.
  6. The party submits authenticated requests to the Monet API using the compromised credential.

Impact Assessment

Token reuse may allow unauthorized operations within the Monet API account's granted scope, potentially including creating video-generation tasks, consuming quota or funds, uploading content, listing tasks, viewing task metadata, and retrieving API-visible results.

N ...[truncated 266 chars]

Remediation
View remediation

Remediation Suggestions

  1. Delete the unnecessary -v option:

    bash
    curl -X POST https://monet.vision/api/v1/files \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -F "file=@/path/to/your/image.jpg"

  2. Add documentation warning users not to publish terminal output or logs containing request headers.

  3. Redact authorization headers from troubleshooting output and support artifacts.

  4. Enable secret masking for MONET_API_KEY in CI systems and agent execution environments.

  5. Apply restrictive access controls and short retention periods to execution logs.

  6. Revoke and rotate credentials that may have been exposed by prior use of the verbose example.

  7. Prefer least-privilege, short-lived API credentials where supported.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

Your First Video Generation Task

bash
curl -X POST https://monet.vision/api/v1/tasks/async \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README instructs users to upload local files to a third-party remote service and only notes retention duration, not the privacy, sensitivity, or transmission implications of sending user-provided images off-device. In an agent context, this can lead to unintentional exfiltration of sensitive files or user content if callers do not realize uploads leave the local environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 189)May include surrounding context.

Upload a file to get an online access URL.

📁 File Storage: Uploaded files are stored for 24 hours and will be automatically deleted after expiration.

bash
curl -X POST https://monet.vision/api/v1/files \

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

Upload a file to get an online access URL.

📁 File Storage: Uploaded files are stored for 24 hours and will be automatically deleted after expiration.

bash
curl -X POST https://monet.vision/api/v1/files \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 243)May include surrounding context.

Example 1: Basic Video Generation

typescript
const response = await fetch('https://monet.vision/api/v1/tasks/async', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 284)May include surrounding context.

Example 1: Basic Video Generation

typescript
const response = await fetch('https://monet.vision/api/v1/tasks/async', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 310)May include surrounding context.

Example 1: Basic Video Generation

typescript
const response = await fetch('https://monet.vision/api/v1/tasks/async', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This code uploads a local file to a remote endpoint, which is a real security/privacy concern when embedded in an agent skill because files may contain personal, proprietary, or regulated data. The risk is elevated by the documentation presenting the upload flow as routine without strong warnings, consent guidance, or file-scope validation.

Content

Scanner excerpt · README.md (reported line 272)May include surrounding context.

md
const formData = new FormData();
formData.append('file', imageFile);

const uploadResponse = await fetch('https://monet.vision/api/v1/files', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.MONET_API_KEY}`,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to send prompts, reference images, and generated media to a third-party service but does not clearly warn that this content leaves the local environment and is processed externally. This creates a real privacy and data-governance risk, especially if agents pass sensitive prompts or private images to the API without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explains how to obtain and configure the API key but omits basic credential-handling guidance. Without an explicit warning, users may paste the key into source code, prompts, screenshots, logs, or shared examples, increasing the chance of credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This example explicitly transmits user-supplied content and an authorization token to an external domain. In context this is the intended function of the skill, but it is still security-relevant because it can exfiltrate sensitive prompts or image inputs if agents use the skill on confidential material without consent or policy controls.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Create a Video Generation Task

bash
curl -X POST https://monet.vision/api/v1/tasks/async \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The API reference repeats the pattern of sending task inputs and bearer credentials to a third-party endpoint. Although expected for a cloud video-generation skill, it remains a true exposure point because any secrets, personal data, or proprietary prompts included in requests are disclosed outside the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Request:

bash
curl -X POST https://monet.vision/api/v1/tasks/async \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MONET_API_KEY" \
  -d '{

Static analysis

No suspicious patterns detected.