Security audit

Glmv Caption Tunnel

Security checks for vulnerabilities and agentic risk

Overview

This captioning skill is mostly purpose-aligned, but its local file support can publish user files to the internet with weak scoping and misleading safety assurances.

Review carefully before installing. Avoid using this skill with confidential files, directories, source trees, credentials, or regulated data. Prefer remote URLs you already intend to share, or require fixes that validate regular files only, bind to localhost, add per-file random tokens, verify dependencies, and ask for explicit consent before any public tunnel is created.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:192
Finding: Mandatory Agent Behavior Override Forces Exclusive External Processing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/tunnel_server.py:139
Finding: Directory Inputs Can Cause Unauthenticated Public and LAN File Exposure
Content: View full analysis
`. Binding to all interfaces unnecessarily extends exposure to other hosts on the LAN. No authenticati ...[truncated 1335 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tunnel_server.py:119
Finding: Tunnel Setup Failures Can Bypass Resource Cleanup
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:178
Finding: Unpinned Dependencies and Unverified Executable Download
Content: View full analysis
Remediation: View remediation
cloudflared" | sha256sum --check - ``` 3. Verify official release signatures where supported. 4. Download to a temporary file, verify it, and only then atomically move it into the destination. 5. Prefer a user-local executable directory over `/usr/local/bin` when system-wide installation is unnecessary. 6. Pin `requests` to a reviewed compatible version in a dependency file. 7. Use a lock file with hashes, such as a hash-locked requirements file. 8. Document the exact dependency versions tested with the Skill. 9. Retain the existing requirement for explicit user consent before downloading or installing Cloudflared. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior materially exceeds the stated purpose of a captioning skill by exposing local files over HTTP, creating a public Cloudflare tunnel, and launching local services/subprocesses. A description-behavior mismatch is dangerous because users may provide local documents expecting simple captioning, while the skill actually performs public network exposure and other sensitive actions outside that mental model.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
export ZHIPU_API_KEY="你的密钥"

text
3. **.env file / .env 文件：** Create `.env` in this skill directory:

ZHIPU_API_KEY=你的密钥

text

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 91% confidence
Finding: The instruction to display full raw output exactly as returned can directly expose extracted prompt content, document text, or model-produced sensitive data without filtering. Because this skill processes local files and documents, verbatim disclosure can become a data-exfiltration vector for confidential content that the user did not intend to reveal in full.
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
md
4. **IF API fails** — Display the error message and STOP immediately 5. **NO fallback methods** — Do NOT attempt captioning any other way ### 📋 Output Display Rules (MANDATORY) After running the script, **you must show the full raw output to the user exactly as returned**. Do not summarize, truncate, or only say "generated". Users need the original model output to evaluate quality.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code automatically exposes local videos or files over a public Cloudflare tunnel so a third-party API can fetch them. That materially expands the skill from caption generation into temporary public file hosting, creating a data exposure risk if sensitive local files are selected, tunnel URLs are leaked, or the tunnel serves more than the intended content.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Automatically tunneling local videos/files without an explicit point-of-use confirmation means users may unknowingly publish local content to a public URL as a side effect of captioning. The absence of an informed-consent warning is especially dangerous here because the skill handles arbitrary local paths and forwards them to an external service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This logic adds an undeclared capability: making local files reachable on the public internet via Cloudflare tunnel. In the context of a captioning skill, that is broader than necessary and increases the blast radius from simple API transmission to public exposure of user-controlled local content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explains that local video and document files are exposed through a Cloudflare Quick Tunnel and gives a public HTTPS URL example, but it does not prominently warn that the selected file becomes publicly reachable over the internet for the lifetime of the API call. Users may reasonably interpret 'transparent local file support' and 'handles everything automatically' as low-risk local processing, which can lead to unintended disclosure of sensitive files or documents.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill requests capabilities equivalent to environment access, file write, network, and shell execution, but it does not declare an explicit tool scope or permissions boundary. That makes the skill harder to audit and allows a captioning workflow to perform broader side effects than users would reasonably expect, especially network exposure and subprocess execution.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
## Resource Links | Resource | Link | | --------------- | --------------------------------------------------------------------------------------------------------------------------------- | | **Get API Key** | [https://bigmodel.cn/usercenter/proj-mgmt/apikeys](https://bigmodel.cn/usercenter/proj-mgmt/apikeys) | | **API Docs** | [Chat Completions / 对话补全](https://docs.bigmodel.cn/api-reference/%E6%A8%A1%E5%9E%8B-api/%E5%AF%B9%E8%AF%9D%E8%A1%A5%E5%85%A8) |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The duplicated finding points to the same persistence pattern: storing and sharing a reusable API key in local config or environment creates residual access beyond a single session. In a skill that already invokes network operations and subprocesses, persistent shared credentials increase the consequences of any misuse or compromise.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
This script reads the key from the `ZHIPU_API_KEY` environment variable and shares it with other Zhipu skills. 脚本通过 `ZHIPU_API_KEY` 环境变量获取密钥，与其他智谱技能共用同一个 key。 **Get Key / 获取 Key：** Visit [Zhipu Open Platform API Keys / 智谱开放平台 API Keys](https://bigmodel.cn/usercenter/proj-mgmt/apikeys) to create or copy your key. **Setup options / 配置方式（任选一种）：**

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The duplicated finding points to the same persistence pattern: storing and sharing a reusable API key in local config or environment creates residual access beyond a single session. In a skill that already invokes network operations and subprocesses, persistent shared credentials increase the consequences of any misuse or compromise.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
This script reads the key from the `ZHIPU_API_KEY` environment variable and shares it with other Zhipu skills. 脚本通过 `ZHIPU_API_KEY` 环境变量获取密钥,与其他智谱技能共用同一个 key。 **Get Key / 获取 Key:** Visit [Zhipu Open Platform API Keys / 智谱开放平台 API Keys](https://bigmodel.cn/usercenter/proj-mgmt/apikeys) to create or copy your key. **Setup options / 配置方式(任选一种):**

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown mandates that the agent present a fixed explanation '原文照搬，不要精简' and the required text is entirely in Chinese. This imposes a specific language on the interaction without user opt-in, which is a natural-language policy violation under the language/locale rule.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to install third-party software via package managers or direct binary download as part of normal operation. Auto-installation guidance increases supply-chain and system-modification risk, especially for a skill whose primary purpose is media captioning rather than system administration.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Requiring the agent to always display the full raw model output can leak sensitive information extracted from images, videos, or documents, including personal, confidential, or regulated data. The risk is amplified because the skill handles arbitrary user-provided files and may process documents whose contents should be minimized or partially redacted in output.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.
python {baseDir}/scripts/glmv_caption.py (--images IMG [IMG...] | --videos VID [VID...] | --files FILE [FILE...]) [OPTIONS]

text
| Parameter | Required | Description | | --------------------- | -------- | -------------------------------------------------------------------------------------------- | | `--images`, `-i` | One of | Image paths or URLs (supports multiple, base64 OK) | | `--videos`, `-v` | One of | Video paths or URLs (supports multiple, mp4/mkv/mov, local paths auto-tunneled) |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default prompt is hard-coded in Chinese, which makes the tool produce Chinese captions by default regardless of user locale or preference. This is a natural-language locale policy issue because the file does not offer a language choice or document that the tool is intentionally Chinese-only.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/glmv_caption.py (reported line 331)May include surrounding context.
python
if response_format == DEFAULT_RESPONSE_FORMAT: payload["response_format"] = {"type": response_format} response = requests.post( API_BASE_URL, headers=headers, json=payload, stream=stream, timeout=120 )

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code publicly exposes files but provides no execution-time warning, confirmation, or transparency mechanism to ensure the user understands their local files are being published to a public URL. In the context of a multimodal captioning skill, users may reasonably expect files to be processed, not briefly hosted on the public internet, so the lack of disclosure materially increases the risk of unintended data leakage.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code intentionally exposes local files through an HTTP server and a public Cloudflare Quick Tunnel, creating internet-accessible URLs for local content. In a captioning skill, that significantly expands the trust boundary: sensitive local documents, videos, or images may be published to a third-party-accessible endpoint without strong controls, making accidental data disclosure likely.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/tunnel_server.py (reported line 195)May include surrounding context.
python
if sys.platform == "win32": popen_kwargs["creationflags"] = subprocess.CREATE_NEW_PROCESS_GROUP self._cf_process = subprocess.Popen(cmd, **popen_kwargs) self._tunnel_base = self._wait_for_url(timeout=30) def _wait_for_url(self, timeout: int = 30) -> str:

Static analysis

No suspicious patterns detected.