Wuli Skill

• Outcome: Review
• Latest audit: Jun 25, 2026 · 9:09 AM UTC
• Version: 1.0.9

Overview

This appears to be a legitimate Wuli media-generation skill, but it uploads chosen media to Wuli and auto-opens downloaded results.

Install only if you are comfortable sending prompts and any selected images/videos to Wuli.art and its OSS upload URL. Do not use private, regulated, or confidential media, avoid internal/private URLs, and be aware that downloaded outputs are opened automatically by the local OS viewer.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

system = platform.system()
    try:
        if system == "Darwin":
            subprocess.Popen(["open", filepath])
        elif system == "Windows":
            os.startfile(filepath)
        elif system == "Linux":

• Confidence: 88% confidence
• Finding: subprocess.Popen(["open", filepath])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif system == "Windows":
            os.startfile(filepath)
        elif system == "Linux":
            subprocess.Popen(["xdg-open", filepath])
    except Exception:
        pass

• Confidence: 88% confidence
• Finding: subprocess.Popen(["xdg-open", filepath])

Tainted flow: 'put_req' from pathlib.Path.read_bytes (line 205, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

file_data = path.read_bytes()
    put_req = urllib.request.Request(upload_url, data=file_data, method="PUT")
    put_req.add_header("Content-Type", "application/octet-stream")
    with urllib.request.urlopen(put_req, timeout=120) as _:
        pass

    width, height = get_image_size(file_data)

• Confidence: 80% confidence
• Finding: with urllib.request.urlopen(put_req, timeout=120) as _:

Tainted flow: 'put_req' from pathlib.Path.read_bytes (line 205, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

put_req = urllib.request.Request(upload_url, data=media_data, method="PUT")
    put_req.add_header("Content-Type", "application/octet-stream")
    with urllib.request.urlopen(put_req, timeout=120) as _:
        pass

    width, height = get_image_size(media_data)

• Confidence: 93% confidence
• Finding: with urllib.request.urlopen(put_req, timeout=120) as _:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation indicates capabilities to read local files, write/download outputs, access environment secrets, invoke shell commands, and perform network transfers, yet it declares no explicit permissions. This creates a transparency and consent gap: users may trigger behavior involving local media uploads, token use, downloads, and auto-opening without a clear permission boundary, which increases the chance of unintended data exposure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This code path turns the skill into a general-purpose fetch-and-forward proxy: it downloads arbitrary remote media and re-uploads it to Wuli OSS. In the context of an agent skill, that exceeds the narrow API-wrapper role and increases the risk of SSRF, internal network access, and unintended transmission of third-party or sensitive content.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatically opening downloaded files is an unnecessary host-side capability for an image/video generation skill and expands the trust boundary to local desktop applications. That can expose the system to malicious or malformed media handling bugs and surprises users by causing side effects beyond saving the output.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrase 'wuli' is too broad and may activate the skill from casual mentions rather than an intentional request to use the third-party service. Because this skill can upload media to cloud storage and consume an API token, accidental activation could cause unintended external data transfer or charges.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill does not prominently warn up front that local files and remote URLs are uploaded to third-party cloud storage, outputs are auto-downloaded, and files may be auto-opened. In context, this is significant because the skill handles user-supplied media and automatically transfers and materializes data across trust boundaries.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation includes working examples for handling API tokens and downloading third-party media before re-uploading it to the provider, but it does not warn users about privacy, consent, copyright, or the risk of transmitting sensitive files to external infrastructure. In a skill that encourages image/video uploads, this omission can lead users to unknowingly exfiltrate private or regulated content to remote services.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill silently downloads content from user-provided URLs and re-uploads that content to Wuli infrastructure without an explicit warning. Even if intended for convenience, this can cause users to unknowingly transmit third-party or confidential media across service boundaries.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill writes outputs to the current directory and immediately opens them without any safety notice or consent step. This combination creates unexpected filesystem and application-launch side effects that are not obvious from the interface and may expose users to unsafe media handling.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

help="Disable sound for video output")
    args = parser.parse_args()

    token = os.environ.get("WULI_API_TOKEN")
    if not token:
        print("Error: WULI_API_TOKEN environment variable is not set\n"
              "Get your API token from https://wuli.art (左下角 -> API 开放平台)\n"

• Confidence: 70% confidence
• Finding: os.environ.get("WULI_API_TOKEN

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 81% confidence
• Finding: The trigger 'edit image' can collide with a generic built-in 'edit' capability and route users into this skill when they intended a local editing action. Because the skill may upload images to a third-party service and use an API token, trigger confusion can turn a benign local request into external data disclosure.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 80% confidence
• Finding: The trigger 'create artwork' overlaps with generic creation commands and may activate the skill for broad creative requests not intended for this provider. Given the skill's ability to send prompts and media externally and incur usage costs, ambiguous routing increases the risk of accidental invocation and data transfer.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/【呜哩Wuli】开放平台 API 文档.md:37