Back to skill

Security audit

AIRILAB

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its AiriLab image-generation purpose, but it installs an autostarting background worker and handles tokens, phone numbers, and local uploads with weak safeguards.

Install only if you are comfortable with an AiriLab worker running in the background across sessions, with local plaintext account tokens and job data, and with images/files being sent to AiriLab services. Prefer disabling autostart, using a protected AIRILAB_HOME, avoiding sensitive files as inputs, and clearing tokens/project data when finished.

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T06 · System Persistence

Error
Location
scripts/post-install.sh:62
Finding

Default installation registers a persistent background worker

Content
View full analysis
"$service_file" <> \"$AIRILAB_HOME/scheduler/autostart.log\" 2>&1" existing="$(crontab -l 2>/dev/null | grep -F "$SKILL_DIR/scripts/start-worker.sh" || true)" if [ -z "$existing" ]; then (crontab -l 2>/dev/null; echo "$cron_line") | crontab - fi } ``` The standalone installer provides an additional persistence path: ```bash EXISTING=$(crontab -l 2>/dev/null | grep -F "start-worker.sh" || true) if [ -n "$EXISTING" ]; then echo "Autostart is already configured" else (crontab -l 2>/dev/null | grep -v '^#'; echo "$CRON_ENTRY") | crontab - fi ``` ### Technical Analysis The documented post-installation process enables autostart by default. It creates and immediately starts a systemd user service with `Restart=always`, or falls back to installing a `cron @reboot` entry. Both mechanisms survive the Skill invocation and future user sessions. The service executes Python cod ...[truncated 1884 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
core/config.py:51
Finding

Bearer token and sensitive runtime data are stored without enforced restrictive permissions

Content
View full analysis
bool: try: with open(TOKEN_FILE, 'w', encoding='utf-8') as f: f.write('# AiriLab API Token\n') f.write(f'AIRILAB_API_KEY={token}\n') if phone: f.write(f'AIRILAB_PHONE={phone}\n') f.write(f'AIRILAB_UPDATED={datetime.now().isoformat()}\n') return True except Exception as e: print(f'Failed to save token: {e}') return False ``` Runtime directories are created without explicit modes: ```python def ensure_runtime_dirs() -> None: get_config_dir().mkdir(parents=True, exist_ok=True) get_scheduler_dir().mkdir(parents=True, exist_ok=True) ``` ### Technical Analysis The AiriLab bearer token and the user’s phone number are written as plaintext to `config/.env`. Neither file creation nor directory creation specifies restrictive permissions. There is no explicit `chmod`, secure `open` mode, symlink rejection, or atomic replacement. The effective permissions therefore depend on the ambient process umask and any permissions already present on the configured runtime directory. The same pattern affects other sensitive runtime artifacts, including: - `scheduler/jobs.db`, containing user IDs, chat IDs, input parameters, result URLs, and errors. - `scheduler/notifications.log`. - Worker and autostart logs. - Generated completion files containing job IDs and image URLs. - `project_config.json`, containing team and project context. A caller can also redirect `AIRILAB_HOME` to an existing or insufficiently protected directory. Because path components and target files are not checked for symbolic links, a hostile same-user process may pre-create or redirect sensitive target ...[truncated 1109 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
core/upload.py:62
Finding

Image upload API can transmit arbitrary readable local files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
core/auth.py:205
Finding

Phone number and one-time verification code are exposed through process arguments

Content
View full analysis
--code ``` ### Technical Analysis The authentication flow places both the user’s phone number and short-lived OTP directly in the process argument vector. Command-line arguments can be visible to process-inspection utilities and may also be retained by Agent execution traces, shell telemetry, monitoring agents, audit systems, or debugging logs. Although the OTP is temporary, it is an authentication factor and should be handled as a secret. The documented Agent behavior makes argument exposure the standard login path rather than an exceptional fallback. ### Attack Path 1. The user supplies a phone number and OTP to the Agent. 2. The Agent follows the Skill instructions and invokes `auth.py` using `--phone` and `--code`. 3. The values appear in the spawned process’s argument vector and potentially in command-execution logs. 4. A concurrent local observer or telemetry collector captures the command before the OTP expires. 5. The attacker submits the captured phone number and OTP to the AiriLab ...[truncated 409 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Post-installation uses an unpinned and unhashed dependency specification

Content
View full analysis
=2.31.0 ``` The default installation executes: ```bash if [ "$INSTALL_DEPS" -eq 1 ]; then if [ -f "$SKILL_DIR/requirements.txt" ]; then echo "[1/4] Installing dependencies..." "$PYTHON_BIN" -m pip install -r "$SKILL_DIR/requirements.txt" else echo "[1/4] Skip dependency install: requirements.txt not found" fi fi ``` ### Technical Analysis The dependency declaration allows any future version of `requests` satisfying the lower bound. It does not pin or hash `requests` or its transitive dependencies. Resolution also depends on the user’s ambient pip configuration, configured package index, mirrors, and currently available releases. No malicious dependency was found in the reviewed package. The vulnerability is that installation is not reproducible and does not cryptographically bind the installed packages to versions reviewed with the Skill. This is especially consequential because the installed code is imported by authentication and network-handling components and may be used by the automatically persistent worker. ### Attack Path 1. The user runs the documented post-installation script. 2. Pip resolves `requests>=2.31.0` and its transitive dependencies using the ambient package-index configuration. 3. A compromised index, mirror, account, or future dependency release supplies altered package code. 4. Pip installs the unreviewed code because no exact version or expected hash is enforced. 5. The Skill imports the installed package during authentication, upload, API submission, or worker execution. 6. Malicious dependency code executes with the privileges of the user running the Skill and may access stored credentials or network data. ### Impact Assessment A successful supply-chain co ...[truncated 364 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (53)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Launching and managing a scheduler daemon with PID and log handling introduces persistent process execution and local state management not reflected in the user-facing description. This hidden operational surface can be abused or can fail in ways that affect system integrity, privacy, or resource usage.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Launching and managing a scheduler daemon with PID and log handling introduces persistent process execution and local state management not reflected in the user-facing description. This hidden operational surface can be abused or can fail in ways that affect system integrity, privacy, or resource usage.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Launching and managing a scheduler daemon with PID and log handling introduces persistent process execution and local state management not reflected in the user-facing description. This hidden operational surface can be abused or can fail in ways that affect system integrity, privacy, or resource usage.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Launching and managing a scheduler daemon with PID and log handling introduces persistent process execution and local state management not reflected in the user-facing description. This hidden operational surface can be abused or can fail in ways that affect system integrity, privacy, or resource usage.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Launching and managing a scheduler daemon with PID and log handling introduces persistent process execution and local state management not reflected in the user-facing description. This hidden operational surface can be abused or can fail in ways that affect system integrity, privacy, or resource usage.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Launching and managing a scheduler daemon with PID and log handling introduces persistent process execution and local state management not reflected in the user-facing description. This hidden operational surface can be abused or can fail in ways that affect system integrity, privacy, or resource usage.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Launching and managing a scheduler daemon with PID and log handling introduces persistent process execution and local state management not reflected in the user-facing description. This hidden operational surface can be abused or can fail in ways that affect system integrity, privacy, or resource usage.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
- `skill_root`:以当前 `SKILL.md` 所在目录为准,不依赖对话中的硬编码路径。

Missing User Warnings

High
Category
Not specified by scanner
Confidence
90% confidence
Finding

The function sends both phone number and OTP to a third-party service and then persists the returned access token locally, but there is no indication here that the token is stored securely or scoped minimally. In an agent skill context, long-lived persisted tokens can be abused by other local components or leaked through weak storage, enabling unauthorized reuse of the user's AiriLab account.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/config.py (reported line 20)May include surrounding context.

python
from core.paths import get_config_dir  # noqa: E402

CONFIG_DIR = get_config_dir()
TOKEN_FILE = CONFIG_DIR / '.env'
PROJECT_FILE = CONFIG_DIR / 'project_config.json'
RESULT_URL = 'https://cn.airilab.com/api/CrudRouters/getOneRecord'

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_status.py (reported line 18)May include surrounding context.

python
from core.paths import get_config_dir  # noqa: E402

CONFIG_DIR = get_config_dir()
TOKEN_FILE = CONFIG_DIR / '.env'
PROJECT_FILE = CONFIG_DIR / 'project_config.json'
RESULT_URL = 'https://cn.airilab.com/api/CrudRouters/getOneRecord'

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch.py (reported line 18)May include surrounding context.

python
from core.paths import get_config_dir  # noqa: E402

CONFIG_DIR = get_config_dir()
TOKEN_FILE = CONFIG_DIR / '.env'
PROJECT_FILE = CONFIG_DIR / 'project_config.json'
RESULT_URL = 'https://cn.airilab.com/api/CrudRouters/getOneRecord'

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares powerful capabilities such as shell, filesystem, environment, and network access but does not define any explicit tool scope or permission boundaries in the manifest. This increases the blast radius of prompt-triggered actions and makes it harder for the host system or reviewer to constrain what the skill may execute.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill processes uploaded images and task/job data through an external SaaS but the description does not clearly warn users that their content is transmitted off-host. This is a privacy and compliance risk, particularly for sensitive images, internal designs, or tenant-linked project data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly persists tokens and project context locally but does not prominently warn users about that storage in the description or activation flow. Persistent authentication and project metadata can expose account access or tenant context if the host is shared, compromised, or later inspected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger list includes broad common terms like '放大', '高清', '4k', '渲染', and weather/day-night phrasing that may appear in ordinary conversation. Overbroad activation can cause unintended execution of networked, stateful, or file-handling actions without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The request header hard-codes accept-language to prefer zh-CN, which imposes a specific locale preference in outbound requests. This file does not offer a user choice or explain a justified region-specific constraint, so it conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Multiple request payloads set language to chs, forcing a specific output language regardless of user preference. Because the file provides no mechanism to select or override language, this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · core/api.py (reported line 298)May include surrounding context.

python
)
        
        try:
            response = requests.post(
                GENERATE_URL,
                headers=headers,
                json=payload,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The default headers hard-code 'accept-language' to prefer zh-CN, and the authentication payloads also force a Chinese language value. This is a natural-language locale policy issue because the code selects a specific language/locale behavior without offering user choice or documenting a justified regional constraint in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code sends a user's phone number to a remote login endpoint and initiates OTP delivery, but the function contains no warning, confirmation, or explanatory user-facing disclosure about transmitting personal data. Under the code-file criteria, network calls that transmit user data should have some visible disclosure unless clearly covered elsewhere in skill documentation, which is not present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The send_verification_code payload forces 'countryName' to 'China' and 'language' to 'chs' regardless of user preference or provided country code. This creates a locale/language policy issue because the skill imposes a specific regional and language context without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · core/auth.py (reported line 101)May include surrounding context.

python
headers['referer'] = 'http://localhost:3000/'

        try:
            response = requests.post(SEND_OTP_URL, headers=headers, json=payload, timeout=30)
            result = response.json()

            status = result.get('status')

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The verify_code payload again forces 'countryName' to 'China' and 'language' to 'chs' irrespective of user preference. This is a repeated language/locale policy violation because the skill does not offer a language or locale choice or document a justified regional limitation here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · core/auth.py (reported line 162)May include surrounding context.

python
headers['referer'] = 'https://cn.airilab.com/stdio/sign-in'

        try:
            response = requests.post(VERIFY_CODE_URL, headers=headers, json=payload, timeout=30)
            result = response.json()

            if result.get('status') == 200 and result.get('message') == 'Success':