T09 · Insecure Skill Coding Practices
Error
- Location
scripts/visual_checker.py:59- Finding
Arbitrary Python Code Injection Through an Interpolated Frame Path
- Content
View full analysis
- Remediation
View remediation
Security audit
红果短剧审片
Security checks for vulnerabilities and agentic risk
Overview
This video review skill does what it broadly describes in its main instructions, but it under-discloses content moderation in metadata and includes unsafe local execution patterns that need review before installation.
Install only if you are comfortable with the skill analyzing both video frames and spoken content for policy categories, and review or fix the hard-coded paths, Python -c interpolation, fail-open visual checks, and temporary audio handling before using it on private or untrusted media.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/visual_checker.py:63- Finding
Visual Analysis Module Loaded From an Untrusted External Path
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/image_tool_wrapper.py:34- Finding
Visual Safety Analysis Failures Are Treated as Successful Checks
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This skill is advertised as basic technical quality review, but it actually performs content-safety classification of sensitive categories such as uniforms, national symbols, money, blood, superstition, and minors, via external visual analysis. In context, that hidden moderation functionality is more dangerous because it changes the sensitivity of processed data and could cause unexpected surveillance, policy enforcement, or censorship actions beyond what users consented to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This skill is advertised as basic technical quality review, but it actually performs content-safety classification of sensitive categories such as uniforms, national symbols, money, blood, superstition, and minors, via external visual analysis. In context, that hidden moderation functionality is more dangerous because it changes the sensitivity of processed data and could cause unexpected surveillance, policy enforcement, or censorship actions beyond what users consented to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This skill is advertised as basic technical quality review, but it actually performs content-safety classification of sensitive categories such as uniforms, national symbols, money, blood, superstition, and minors, via external visual analysis. In context, that hidden moderation functionality is more dangerous because it changes the sensitivity of processed data and could cause unexpected surveillance, policy enforcement, or censorship actions beyond what users consented to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This skill is advertised as basic technical quality review, but it actually performs content-safety classification of sensitive categories such as uniforms, national symbols, money, blood, superstition, and minors, via external visual analysis. In context, that hidden moderation functionality is more dangerous because it changes the sensitivity of processed data and could cause unexpected surveillance, policy enforcement, or censorship actions beyond what users consented to.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This skill is advertised as basic technical quality review, but it actually performs content-safety classification of sensitive categories such as uniforms, national symbols, money, blood, superstition, and minors, via external visual analysis. In context, that hidden moderation functionality is more dangerous because it changes the sensitivity of processed data and could cause unexpected surveillance, policy enforcement, or censorship actions beyond what users consented to.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says the skill performs basic video-quality review, but the body instructs full content-safety moderation and banned-word screening. That semantic deception is dangerous because it can bypass user expectations, policy gating, or internal approval processes that would apply to moderation and transcription tools but not to simple media QA.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring claims visual problem detection, but the actual prompt targets policy-sensitive moderation categories instead of technical video quality defects. This deceptive or misleading labeling is dangerous because it conceals the skill's true behavior from operators, undermines informed consent, and may route sensitive media into a moderation workflow that was not approved.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill metadata says it performs basic video quality checks, but the prompt implements content-safety and policy moderation over categories like sexuality, government symbols, currency, violence, superstition, and minors. This is a material scope mismatch that can cause unauthorized sensitive content classification, policy enforcement, or censorship under the guise of benign QA, making the skill more dangerous because users and reviewers may grant it trust and data access intended only for quality review.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill invokes shell commands (ffprobe, ffmpeg, python3, haoone-cli) and writes to fixed filesystem paths, but it declares no explicit tool scope or permissions. That creates unnecessary ambiguity about what the skill is allowed to do and weakens least-privilege controls, especially because it processes attacker-controlled file paths and produces local artifacts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest says the skill performs basic video-quality review, but the body instructs full content-safety moderation and banned-word screening. That semantic deception is dangerous because it can bypass user expectations, policy gating, or internal approval processes that would apply to moderation and transcription tools but not to simple media QA.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The description and the rest of the file are written entirely in Chinese and present fixed Chinese-language output/report conventions, without offering a language choice. This can constitute a language/locale policy issue because the skill appears to require Chinese output regardless of user preference and does not document a justified region-specific constraint.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases are broad enough to match ordinary requests such as '检测视频' or '审核视频', which can cause the skill to activate in contexts where the user did not intend this workflow. Because the skill runs shell tools, extracts media, and performs content/transcript analysis, accidental invocation expands privacy and operational risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Both the description and all trigger phrases are Chinese-only, which can bias activation and responses toward Chinese without explicit user opt-in. This is mainly a safety and usability issue: it can reduce transparency, mis-handle multilingual requests, and create confusing behavior for users expecting language preservation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes very generic phrases such as '检测视频' and '审核视频', which are likely to overlap with ordinary user requests and can cause the skill to activate unexpectedly. Over-broad activation increases the chance of unintended routing, causing incorrect task handling, privacy issues from processing user media without clear intent, or denial of the user’s preferred workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This JSON file consists entirely of Chinese profanity, advertising-superlative, nation, and profession word lists, indicating a language-specific moderation policy. Because the file provides no documented opt-in, language selection, or justified region-specific scope, it may violate the policy against forcing a specific language or locale without user choice.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python output_pattern, "-y" ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"抽帧失败: {result.stderr}", file=sys.stderr) return None
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python output_pattern, "-y" ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"抽帧失败: {result.stderr}", file=sys.stderr) return None
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description says it performs basic video quality review, but the implementation also extracts audio, transcribes speech, and performs banned-word moderation. This hidden capability expands data collection and analysis beyond the declared purpose, creating a security/privacy mismatch that can surprise users and downstream systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script extracts audio to a predictable sidecar path next to the input video without explicit notice or strong temporary-file hygiene. This can expose sensitive media-derived content to other local users/processes, leave residual files on failure paths, and process more personal data than users expect.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-ar", "16000", "-ac", "1", "-acodec", "pcm_s16le", wav_path, "-y" ] r = subprocess.run(cmd_convert, capture_output=True, text=True) if r.returncode != 0: return [{"type": "error", "desc": f"WAV转换失败: {r.stderr[:100]}"}]
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Invoking a transcription CLI from a hard-coded user path is unjustified for a skill advertised as basic quality review and introduces execution of an uncontrolled local dependency. In the skill context, this is more dangerous because it silently broadens capabilities from passive inspection to external code execution and speech-content analysis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code sends extracted audio to an external transcription CLI without explicit user disclosure or consent. In this skill context, that is more sensitive because the advertised function is visual quality review, so users may not expect speech analysis or external tool handling of audio-derived content.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 80% confidence
- Finding
This code executes an external binary from a hard-coded user-controlled filesystem path if it exists. That creates a trust-boundary problem: if the referenced binary is replaced, tampered with, or points to an unexpected tool, the skill will run arbitrary local code while processing user media.
- Content
python haoone_cli = "/Users/suran/Documents/haoone/haoone-cli" if os.path.exists(haoone_cli): cmd_transcribe = [haoone_cli, "transcribe", wav_path] r = subprocess.run(cmd_transcribe, capture_output=True, text=True, timeout=300) transcript = r.stdout if r.returncode == 0 else "" else: transcript = ""
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill manifest describes a video basic-quality review capability covering checks like composition, audio, black borders, and resolution for videos, but this file implements an image-analysis wrapper that invokes an
openclaw imagecommand on a single image path. That is a substantive modality mismatch rather than an expected implementation detail of video review.- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "--image", image_path, "--prompt", f"@{prompt_file}" ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=90) if result.returncode == 0: return result.stdout.strip()