T09 · Insecure Skill Coding Practices
Error
- Location
skill.py:215- Finding
Unrestricted Remote Media Fetching Enables SSRF and External Data Relay
- Content
View full analysis
- Remediation
View remediation
Security audit
Wuli Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is for Wuli image and video generation, but it has review-worthy network, file-opening, and undeclared cookie behavior.
Review before installing. Use only with non-sensitive media and trusted URLs, run it in a network-restricted environment if possible, unset WULI_EXTRA_COOKIE unless explicitly needed, and be aware that generated files may be saved locally and opened automatically.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:154- Finding
Undeclared Environment Cookie Is Silently Transmitted to Wuli API
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:287- Finding
Network-Downloaded Results Are Automatically Opened Without Content Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (21)
Tainted flow: 'put_req' from pathlib.Path.read_bytes (line 205, file read) → urllib.request.urlopen (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python file_data = path.read_bytes() put_req = urllib.request.Request(upload_url, data=file_data, method="PUT") put_req.add_header("Content-Type", "application/octet-stream") with urllib.request.urlopen(put_req, timeout=120) as _: pass width, height = get_image_size(file_data)
Tainted flow: 'put_req' from pathlib.Path.read_bytes (line 205, file read) → urllib.request.urlopen (network output)
High
- Category
- Data Flow
- Confidence
- 91% confidence
- Finding
The skill downloads arbitrary remote content from user-supplied URLs and then re-uploads it to Wuli storage, effectively acting as a generic fetch-and-forward network relay. In an agent environment, this expands capability beyond image/video generation and can be abused to access internal resources or transfer sensitive content via SSRF-style retrieval.
- Content
python put_req = urllib.request.Request(upload_url, data=media_data, method="PUT") put_req.add_header("Content-Type", "application/octet-stream") with urllib.request.urlopen(put_req, timeout=120) as _: pass width, height = get_image_size(media_data)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises and documents capabilities that involve environment access, local file reads/writes, network operations, and shell execution, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent runtime may invoke the skill with broader capabilities than users expect, enabling uploads, downloads, and local execution effects without clear consent or confinement.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 84% confidence
- Finding
The trigger phrase 'edit image' overlaps with a common built-in verb pattern and can shadow or hijack ordinary user requests that are not meant for this external skill. If auto-selected, the skill could route user images and prompts to a third-party API, causing unexpected disclosure, charges, and file operations.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 83% confidence
- Finding
The trigger phrase 'create artwork' is highly generic and conflicts with common creation intents, making accidental invocation plausible. In this skill's context, accidental invocation is more dangerous because the skill performs external network requests, may upload media, and can auto-download/open outputs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad generic phrases like 'generate image', 'generate video', 'edit image', and 'create artwork', which can match many unrelated user requests. Over-broad triggers can cause the agent to select this skill unexpectedly, leading to unintended API calls, media uploads, costs, or disclosure of user-provided files to a third-party service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation states that local files may be auto-uploaded, remote URLs may be fetched and re-uploaded, results are auto-downloaded, and outputs may be auto-opened, but it does not prominently warn about privacy, bandwidth, storage, or local system side effects. Users may unknowingly send sensitive media to an external platform or trigger local file creation/opening behavior they did not intend.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md "default": "true" }, "no_optimize": { "description": "Disable prompt optimization when you need the raw prompt sent as-is.", "default": "false" } }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
json "default": "true" }, "no_optimize": { "description": "Disable prompt optimization when you need the raw prompt sent as-is.", "default": "false" } }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python "default": "true" }, "no_optimize": { "description": "Disable prompt optimization when you need the raw prompt sent as-is.", "default": "false" } }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation shows a bearer token directly in example headers and code without an explicit warning to use placeholders only and never paste real secrets into shared logs, screenshots, or source files. Even if the token string appears illustrative, this pattern normalizes unsafe secret handling and can lead users or downstream tool builders to hardcode or expose live API credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The upload examples instruct users to download third-party media and re-upload local or remote files to Wuli OSS, but do not clearly warn that this transmits potentially sensitive content to an external service. In a skill context, this can cause accidental disclosure of private images, videos, or copyrighted material because the examples encourage transfer as a normal preprocessing step.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This example performs an explicit external upload of a local file to a presigned URL, which is a real data egress action. In this skill's domain, external transmission is expected functionality, but it is still security-relevant because local user content may be uploaded off-device without adequate privacy notice, validation, or user confirmation.
- Content
md UPLOAD_URL=$(echo $UPLOAD_RESP | jq -r '.data.uploadUrl') # 2. PUT 上传文件（Content-Type 必须为 application/octet-stream） curl -X PUT \ -H "Content-Type: application/octet-stream" \ --data-binary @photo.jpg \ "$UPLOAD_URL"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This example uploads a local video file to an external presigned URL, creating a direct path for outbound transfer of potentially sensitive media. While consistent with the API's intended use, the lack of adjacent warnings makes accidental disclosure more likely, especially for agent users who may not realize local assets are being copied to third-party infrastructure.
- Content
md UPLOAD_URL=$(echo $UPLOAD_RESP | jq -r '.data.uploadUrl') curl -X PUT \ -H "Content-Type: application/octet-stream" \ --data-binary @clip.mp4 \ "$UPLOAD_URL"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Accepting arbitrary remote URLs and fetching them directly gives the skill broad URL-retrieval behavior unrelated to the narrow intent of generation. In a local or enterprise agent context, this can be abused for SSRF-like access to internal services, metadata endpoints, or as a blind content transfer mechanism.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill performs significant side effects—fetching remote URLs, writing files locally, and opening them—without an explicit user warning or separate consent step. In agent settings, hidden side effects reduce user awareness and can turn normal media prompts into unexpected network access and local file/application activity.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatically opening downloaded files is unrelated to the stated purpose of generating media and introduces a local side effect that can activate external applications on untrusted content. That increases the attack surface substantially, especially on systems where handlers may execute scripts, render active content, or expose parser vulnerabilities.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 88% confidence
- Finding
The skill automatically launches downloaded files with the OS default handler via
open, which creates an unintended local code/content execution surface. Although the call is not shell-invoked, opening attacker-controlled downloaded content can trigger risky applications, browser handlers, or vulnerable previewers without explicit user consent.- Content
python system = platform.system() try: if system == "Darwin": subprocess.Popen(["open", filepath]) elif system == "Windows": os.startfile(filepath) elif system == "Linux":
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 88% confidence
- Finding
The Linux
xdg-openinvocation automatically hands downloaded content to the desktop's default application, which is outside the core image/video generation function. Even without shell injection, this can expose users to malicious files, browser-based handlers, or unsafe helper applications processing untrusted output.- Content
python elif system == "Windows": os.startfile(filepath) elif system == "Linux": subprocess.Popen(["xdg-open", filepath]) except Exception: pass
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s user-facing text and link descriptions are entirely in Chinese, which can amount to forcing a specific language for users without opt-in. The policy allows locale constraints when they are explicitly justified, but this README does not state that the skill is intended only for Chinese-speaking or region-specific users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The token setup error message contains the Chinese-only phrase "左下角 -> API 开放平台" embedded in otherwise English guidance. This imposes a locale-specific instruction without giving the user a language choice or documenting that the skill is intentionally region/language-specific.
- Content