ClawHub
Back to skill

Security audit

free-kameo

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its video-generation purpose, but it ships unsafe credential handling and a script flaw that can turn user input into local code execution.

Review before installing. Do not use the embedded Kameo key; it should be removed and rotated by the publisher. Avoid passing passwords on the command line, prefer a secret manager over plaintext config, and do not run the enhanced prompt script on untrusted image paths or dialogue until the heredoc injection issue is fixed. Be aware that portraits and prompts are uploaded to Kameo and, for enhanced generation, Google Gemini.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/enhance_prompt.sh:48
Finding

Arbitrary Python Code Execution Through Untrusted Heredoc Interpolation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Concrete Kameo API Credential Published in Documentation

Content
View full analysis
~/.config/kameo/credentials.json << EOF { "api_key": "kam_I3rdx43IymFNbfBw1c0ZbSc7o3aUfQgz8cljZA6T7fs" } EOF ``` ### Technical Analysis The documentation uses a high-entropy, credential-shaped Kameo API key rather than an unmistakable placeholder. It is repeated in several copy-and-paste examples and is included in the distributed Skill package. Static review cannot determine whether the key is currently active. Nevertheless, treating a concrete key as documentation exposes it to every user who downloads or reviews the package and potentially to public repository history, mirrors, logs, and security scanners. The exposed key is accepted by the documented generation endpoint through the `X-API-Key` header. If active, possession of the key is sufficient to act under the associated Kameo account's API authority. ### Attack Path 1. An attacker obtains the Skill package or accesses its repository. 2. The attacker extracts the published `kam_...` value from `SKILL.md` or `USAGE.md`. 3. The attacker sends the value in the `X-API-Key` header to Kameo's authenticated API endpoints. 4. If the key remains val ...[truncated 674 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/register.sh:7
Finding

Registration Password Exposure and Unsafe Authentication JSON Construction

Content
View full analysis
" ``` The password and email are then inserted directly into JSON strings: ```bash # Try signup first echo "1. Attempting signup..." SIGNUP_RESULT=$(curl -s -X POST "$SUPABASE_URL/auth/v1/signup" \ -H "apikey: $SUPABASE_ANON_KEY" \ -H "Content-Type: application/json" \ -d "{\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\"}") ``` The same construction is used for login: ```bash # If signup failed, try login echo "2. Attempting login..." LOGIN_RESULT=$(curl -s -X POST "$SUPABASE_URL/auth/v1/token?grant_type=password" \ -H "apikey: $SUPABASE_ANON_KEY" \ -H "Content-Type: application/json" \ -d "{\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\"}") ``` The documentation instructs users to invoke it in this form: ```bash scripts/register.sh your@email.com YourPassword123 ``` ### Technical Analysis Passing a password as a command-line argument may expose it through: - Interactive shell history. - Process listings while the script is running. - Process-accounting or endpoint-monitoring systems. - Wrapper logs, terminal session capture, or automation logs. The password is also interpolated into JSON manually. Shell quoting prevents direct shell command execution in this particular construction, but it does not perform JSON escaping. Quotes, backslashes, line breaks, and control characters in either value can alter the serialized request or make it invalid. This may cause authentication failures for legitimate passwords and can allow an input value to modify the structure of the outbound authentication request. The affected registrati ...[truncated 1583 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (52)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Account registration, login, API-key creation, and local credential storage are materially different from generating videos and introduce sensitive authentication workflows. If bundled into a simple media skill without clear disclosure, users may unintentionally expose credentials or authorize persistent account changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Account registration, login, API-key creation, and local credential storage are materially different from generating videos and introduce sensitive authentication workflows. If bundled into a simple media skill without clear disclosure, users may unintentionally expose credentials or authorize persistent account changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

Account registration, login, API-key creation, and local credential storage are materially different from generating videos and introduce sensitive authentication workflows. If bundled into a simple media skill without clear disclosure, users may unintentionally expose credentials or authorize persistent account changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Account registration, login, API-key creation, and local credential storage are materially different from generating videos and introduce sensitive authentication workflows. If bundled into a simple media skill without clear disclosure, users may unintentionally expose credentials or authorize persistent account changes.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The documentation exposes what appears to be a real API key and instructs users to store it in a plaintext local credentials file. This creates two issues: immediate secret leakage in the repository and encouragement of insecure at-rest secret handling on user systems.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

export KAMEO_API_KEY="kam_I3rdx43IymFNbfBw1c0ZbSc7o3aUfQgz8cljZA6T7fs"

text

Or store in `~/.config/kameo/credentials.json`:
```json
{
  "api_key": "kam_I3rdx43IymFNbfBw1c0ZbSc7o3aUfQgz8cljZA6T7fs"

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documentation exposes a hard-coded Kameo API key and explicitly instructs users to export it or write it to a persistent credentials file. This can lead to unauthorized use of the account, billing abuse, and downstream compromise if users assume the embedded secret is legitimate and reusable.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guide shows a real-looking API key and instructs users to place it in an exported shell variable or plaintext config file, but gives no warning about credential exposure, local file permissions, or shell history leakage. This increases the chance of secrets being disclosed through screenshots, logs, backups, or shared environments.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The documentation directs users to store an API key in a plaintext credentials.json file under the home directory, using a real-looking secret. Persisting secrets this way without permission hardening or secure storage guidance increases the risk of local credential theft, accidental sync/backup leakage, and misuse of the exposed account.

Content

Scanner excerpt · USAGE.md (reported line 13)May include surrounding context.

md
# 或保存到配置文件
mkdir -p ~/.config/kameo
cat > ~/.config/kameo/credentials.json << EOF
{
  "api_key": "kam_I3rdx43IymFNbfBw1c0ZbSc7o3aUfQgz8cljZA6T7fs"
}

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The API examples use an actual-looking secret in request headers and do not warn users not to expose, reuse, or share it. This normalizes unsafe secret handling and can result in credential compromise and account abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The API reference includes an authenticated curl example containing a real-looking API key in the HTTP header. Publishing a usable secret in docs enables direct credential theft and makes accidental reuse by readers likely.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · USAGE.md (reported line 163)May include surrounding context.

md
# Check Kameo credit balance

API_KEY="${KAMEO_API_KEY:-}"
if [ -z "$API_KEY" ] && [ -f ~/.config/kameo/credentials.json ]; then
    API_KEY=$(jq -r '.api_key' ~/.config/kameo/credentials.json)
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_credits.sh (reported line 5)May include surrounding context.

sh
# Check Kameo credit balance

API_KEY="${KAMEO_API_KEY:-}"
if [ -z "$API_KEY" ] && [ -f ~/.config/kameo/credentials.json ]; then
    API_KEY=$(jq -r '.api_key' ~/.config/kameo/credentials.json)
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_credits.sh (reported line 6)May include surrounding context.

sh
# Check Kameo credit balance

API_KEY="${KAMEO_API_KEY:-}"
if [ -z "$API_KEY" ] && [ -f ~/.config/kameo/credentials.json ]; then
    API_KEY=$(jq -r '.api_key' ~/.config/kameo/credentials.json)
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.sh (reported line 13)May include surrounding context.

sh
# Check Kameo credit balance

API_KEY="${KAMEO_API_KEY:-}"
if [ -z "$API_KEY" ] && [ -f ~/.config/kameo/credentials.json ]; then
    API_KEY=$(jq -r '.api_key' ~/.config/kameo/credentials.json)
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.sh (reported line 14)May include surrounding context.

sh
# Check Kameo credit balance

API_KEY="${KAMEO_API_KEY:-}"
if [ -z "$API_KEY" ] && [ -f ~/.config/kameo/credentials.json ]; then
    API_KEY=$(jq -r '.api_key' ~/.config/kameo/credentials.json)
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_video.sh (reported line 21)May include surrounding context.

sh
# Check Kameo credit balance

API_KEY="${KAMEO_API_KEY:-}"
if [ -z "$API_KEY" ] && [ -f ~/.config/kameo/credentials.json ]; then
    API_KEY=$(jq -r '.api_key' ~/.config/kameo/credentials.json)
fi

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The script writes a usable API key to ~/.config/kameo/credentials.json in plaintext, creating a local secret that can be harvested by malware, other processes running as the user, insecure backups, or accidental disclosure. Because the key enables API access without the user's password, compromise of this file can directly enable unauthorized use of the account.

Content

Scanner excerpt · scripts/register.sh (reported line 81)May include surrounding context.

sh
# Save to config
    mkdir -p ~/.config/kameo
    cat > ~/.config/kameo/credentials.json << EOF
{
  "api_key": "$KAMEO_KEY",
  "email": "$EMAIL"

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Although this line sets restrictive permissions, it is part of the credential-persistence flow that leaves a long-lived API key stored on disk. The file remains accessible to any code executing as the user and may still be captured via backups or post-compromise collection.

Content

Scanner excerpt · scripts/register.sh (reported line 87)May include surrounding context.

sh
"email": "$EMAIL"
}
EOF
    chmod 600 ~/.config/kameo/credentials.json
    
    echo "✅ Saved to ~/.config/kameo/credentials.json"
    echo ""

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The script announces the location of the credential file and then suggests exporting the API key into the current shell session, increasing the chance the secret will appear in shell history, environment dumps, subprocess environments, or support logs. This compounds the risk created by generating and storing a persistent API credential.

Content

Scanner excerpt · scripts/register.sh (reported line 89)May include surrounding context.

sh
EOF
    chmod 600 ~/.config/kameo/credentials.json
    
    echo "✅ Saved to ~/.config/kameo/credentials.json"
    echo ""
    echo "Export for current session:"
    echo "  export KAMEO_API_KEY='$KAMEO_KEY'"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares no explicit tool permissions while clearly describing use of shell commands, environment variables, local credential files, and outbound network access. This weakens security review and consent boundaries because consumers cannot easily see that the skill can read secrets and transmit data off-host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: kameo
description: Generate expressive talking-head videos from static images using Kameo AI. Converts static avatars/portraits into dynamic 5-second videos with realistic facial expressions, lip-sync, and motion. Use when you need to bring static images to life, create AI character videos, demonstrate visual communication, or generate talking avatars from photos.
---

# Kameo AI - Talking Head Video Generation

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill does not prominently warn that uploaded images and prompts are sent to an external API and resulting videos are hosted on a CDN. Users may provide sensitive biometrics, portraits, or confidential text without understanding the external transmission and storage implications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

Including a registration helper and JWT/API-key creation path broadens the skill from content generation into identity and secret-management operations. That added scope increases risk of credential misuse and makes the skill more sensitive than its description suggests.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The example embeds what appears to be a live API key directly in documentation and in an outbound request header. Hardcoded secrets can be harvested from the repository, reused by unauthorized parties, and may expose the associated account to abuse or charges.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

Generate Video

bash
curl -X POST https://api.kameo.chat/api/public/generate \
  -H "X-API-Key: kam_I3rdx43IymFNbfBw1c0ZbSc7o3aUfQgz8cljZA6T7fs" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The example embeds what appears to be a live API key directly in documentation and in an outbound request header. Hardcoded secrets can be harvested from the repository, reused by unauthorized parties, and may expose the associated account to abuse or charges.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

Generate Video

bash
curl -X POST https://api.kameo.chat/api/public/generate \
  -H "X-API-Key: kam_I3rdx43IymFNbfBw1c0ZbSc7o3aUfQgz8cljZA6T7fs" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.potential_exfiltration

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:32

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
USAGE.md:9

Shell script base64-encodes a local file and sends it over the network.

Critical
Code
suspicious.potential_exfiltration
Location
scripts/generate_video.sh:57