Security audit

AIOZ音频上传免费版

Security checks across malware telemetry and agentic risk

Overview

This skill needs Review because it asks for AIOZ credentials and local audio files while using a hard-coded upload endpoint and broad command guidance that are not tightly scoped to the stated purpose.

Install only if you intentionally want an agent to upload chosen audio files using AIOZ Stream credentials. Before use, verify the API endpoint with your AIOZ account or official documentation, prefer upload-limited keys, avoid private or regulated recordings, and require confirmation before any file is transmitted.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest and description position this as a narrowly scoped audio-upload skill, but the text broadens it into generic media processing, editing, dubbing, and automation use cases. Scope expansion increases the chance an agent will apply the skill in contexts involving unnecessary file handling, external data transfer, or command execution beyond the user's intended task.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The 'core capabilities' section claims broad powers such as file writing, information retrieval, and automated command execution that exceed the declared upload purpose. In an agent setting, overstated capabilities can cause unsafe invocation and authorize the skill to touch more data or systems than necessary.

Context-Inappropriate Capability

Low

Confidence: 86% confidence
Finding: The documentation instructs the agent to run ping for troubleshooting, which is unrelated to the core upload workflow and expands the operational scope into host/network diagnostics. Even if low severity, unnecessary diagnostic command execution can leak environment details or normalize broader shell access than the skill requires.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document warns against inserting user input into command lines, yet its own examples interpolate user-controlled file paths and titles directly into shell and curl commands. In an exec-enabled skill, this creates a realistic command injection and argument-smuggling risk if inputs are not safely escaped or passed as structured parameters.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation guidance is broad and unspecific, telling the agent to execute tasks based on general user instructions rather than tightly defined triggers. In practice this can cause the skill to be invoked in inappropriate contexts and send files or metadata to an external service without sufficiently clear user intent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill description does not clearly foreground that local audio files, filenames/titles, hashes, and related metadata will be transmitted to a third-party service. This is a data-transparency issue that can lead users to unknowingly exfiltrate potentially sensitive media content outside their environment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.