Security audit

Upload video to AIOZ Stream

Security checks for vulnerabilities and agentic risk

Overview

This upload skill performs mostly relevant video API actions, but it asks for reusable secrets and media files while hard-coding a questionable service destination and including account-changing actions beyond simple upload.

Install only if you trust the publisher and have verified that `api-w3stream.attoaioz.cyou` is the intended service endpoint for your account. Use a least-privileged upload-only or short-lived key where possible, avoid passing secrets on the command line, confirm the exact file path before upload, and do not allow delete or update operations unless you explicitly intend them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

other

Error

Location: scripts/upload_video_file.sh:40
Finding: API Credentials and User Media Are Transmitted to an Unverified Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create_video_default.sh:4
Finding: Secret API Keys Are Exposed Through Process Arguments and Shell History
Content: View full analysis
" exit 1 fi ``` The documented invocation pattern is: ```bash ./scripts/create_video_default.sh <public_key> <secret_key> "My Video Title" ./scripts/upload_video_file.sh <public_key> <secret_key> <VIDEO_ID> /path/to/video.mp4 ./scripts/get_video_detail.sh <public_key> <secret_key> <VIDEO_ID> ``` ### Technical Analysis Command-line arguments are not an appropriate channel for reusable secrets. Depending on the operating system and execution environment, arguments can be exposed through process-listing interfaces, process monitoring, audit records, diagnostic tooling, CI logs, terminal transcripts, and shell history. Assigning `$2` to a shell variable does not remove the secret from the process argument vector. Every script in this package follows the same pattern, expanding the exposure across all supported API operations. ### Attack Path 1. A user invokes one of the scripts with the secret key as the second positional argument. 2. The complete command may be persisted in shell history or automation logs. 3. While the process is running, another local user or monitoring process inspects the process command line where operating-system permissions allow it. 4. The observer extracts the reusable secret key. 5. The key is reused to perform API operations within its assigned scope. ### Impact Assessment An attacker who obtains the key gains the API privileges assigned to the affected account credential. The scope may include access to video metadata and the ability to create, upload, mod ...[truncated 180 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/upload_video_file.sh:68
Finding: Predictable Temporary File Enables Local Symlink and Integrity Attacks
Content: View full analysis
/dev/null | \ tee >(md5sum | awk '{print $1}' > /tmp/chunk_hash_$$) | \ curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/$VIDEO_ID/part" \ -H 'stream-public-key: '"$PUBLIC_KEY" \ -H 'stream-secret-key: '"$SECRET_KEY" \ -H "Content-Range: bytes $START_POS-$END_POS/$FILE_SIZE" \ -F "file=@-;filename=$(basename "$FILE_PATH")" \ -F "index=$PART_INDEX" \ -F "hash=$(cat /tmp/chunk_hash_$$)" echo "" # Cleanup temp file rm -f /tmp/chunk_hash_$$ ``` ### Technical Analysis The script constructs a temporary filename directly under the shared `/tmp` directory using only the process ID. It does not use `mktemp`, perform exclusive file creation, validate file ownership, assign restrictive permissions, or install a cleanup trap. Process IDs are observable or predictable. A local attacker can pre-create `/tmp/chunk_hash_` as a symbolic link or manipulate it during execution. The redirection performed by the hashing process then follows the attacker-controlled path. The separate write, read, and deletion operations also create race windows. ### Attack Path 1. A local attacker predicts or observes the upload process ID. 2. The attacker creates `/tmp/chunk_hash_` as a symbolic link to a file writable by the victim. 3. The victim performs a multipart upload. 4. The shell follows the symbolic link when writing the computed hash. 5. Data in the linked target may be overwritten or corrupted. 6. Alternatively, the attacker changes the temporary file before it is read, causing an attacker-selected hash to be submitted and disrupting upload integrity. ### Impact Assessment The issue can permit file corruption under the priv ...[truncated 356 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create_video_default.sh:13
Finding: Unescaped Video Titles Permit JSON Structure Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/upload_video_file.sh:36
Finding: Upload Scripts Report Success Without Validating HTTP or Pipeline Failures
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description centers on a full video upload workflow: creating video objects, uploading a file, finalizing the upload, and returning a video link. The supplied code does none of those things. It is a shell script that calls a /api/videos/cost endpoint to retrieve transcoding price information based on duration and output qualities. This is a materially different primary purpose, so the description does not accurately represent the code's behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description describes a full upload workflow: create video objects, upload the file, complete the upload, and return the final video link. The supplied code chunk performs only one subset of that workflow: sending a POST request to create a video object with a hardcoded custom quality configuration. There is no file transfer step, no completion/finalization call, and no logic to extract or return a video link. While the code is related to AIOZ Stream video creation, it materially underimplements the described end-to-end behavior, so the description does not accurately represent this specific code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a full quick-upload workflow: create video objects with default or custom encoding settings, upload the file, complete the upload, and return a link. The supplied code only performs the initial create-video API call with a title. It does not handle file upload, upload completion, link extraction/return, or custom encoding options. While creating a video object is consistent with part of the description, the actual code chunk implements only a narrow subset of the declared functionality, so the description overstates what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says the skill performs a video upload workflow: create a video object, upload the file, finalize the upload, and return a link. The supplied code does none of that. It only issues a GET request to retrieve details for a specified video ID from the API. This is a materially different primary purpose and capability from uploading videos, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes a full video-upload workflow: creating video objects, uploading a video, completing the upload, and returning a video link. The supplied code instead performs a different task: it uploads a thumbnail image (.png/.jpg) to the thumbnail endpoint for an already existing video ID. This is not a supporting implementation detail of the declared flow; it is a separate media-management action with a different primary purpose and different required inputs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code only implements the file-upload portion of the described workflow. It accepts credentials, a preexisting VIDEO_ID, and a local file path; computes hashes; uploads the file in one or more parts; and calls a completion endpoint. It does not create a video object, does not set encoding configurations, and does not obtain or return a user-facing video link. While the general domain matches video upload to an AIOZ-related API, the declared description overstates the implemented behavior in material ways.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Delete-video functionality is materially more dangerous than upload and is not justified by the skill's stated purpose. In an agent context, bundling destructive account operations into an upload skill increases the risk of unintended or socially engineered deletion of user assets.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/upload_video_file.sh (reported line 82)May include surrounding context.
sh
echo "" # Cleanup temp file rm -f /tmp/chunk_hash_$$ # Move to next chunk START_POS=$((END_POS + 1))

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to pass a secret API key directly as a command-line argument, which can expose credentials through shell history, process listings, audit logs, CI job logs, and terminal recordings. Because this skill is specifically for uploading to a remote API using long-lived authentication headers, disclosure of the secret key could allow unauthorized API access and misuse of the user's account.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs use of shell-capable tooling (curl, jq, md5sum) but does not declare an explicit tool scope such as allowed tools or permissions. In an agent setting, missing scope boundaries increases the chance the skill can invoke shell operations more broadly than users expect, including reading local files and transmitting them to remote endpoints.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This skill is explicitly designed to transmit sensitive material externally: API credentials are sent as headers on every request and local video files are uploaded to a third-party service. External transmission is expected for the use case, but it still creates real exfiltration risk if users provide the wrong file path, if prompts are manipulated, or if the destination/domain is not tightly validated.
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
emoji: "🎬" requires: bins: - curl - jq - md5sum ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The multipart upload step sends a local file and associated hash to an external service, which is the core behavior of the skill but also the primary security risk. In an agent environment, any capability that reads local paths and posts their contents remotely can be abused to exfiltrate unintended files if path handling and user consent are weak.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
Then upload via multipart form-data with the Content-Range header:

bash
curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/VIDEO_ID/part" \ -H 'stream-public-key: PUBLIC_KEY' \ -H 'stream-secret-key: SECRET_KEY' \ -H "Content-Range: bytes 0-$END_POS/$FILE_SIZE" \

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest frames the skill as a simple upload helper, but the documentation also enables broader account operations including listing, updating, thumbnail upload, pricing, and deletion. This scope expansion matters because users or orchestrators may authorize the skill for upload-only tasks while it actually contains instructions for additional state-changing actions against the same API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented delete call is destructive and irreversible in effect, yet the skill provides no warning, confirmation, or safety checks. Without confirmation guidance, an agent could execute deletion from an ambiguous prompt or prompt-injection chain, causing loss of video assets.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest identifies the skill as "w3stream-video-upload" and describes uploading to the W3Stream API, while the provided skill metadata says the skill is "aioz-stream-video-upload" for the AIOZ Stream API. This mismatch can mislead reviewers and users about the skill’s true identity and destination service, increasing the risk of misconfiguration, accidental trust, or deceptive repackaging.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This shell script sends the provided public and secret keys as HTTP headers to a remote API using curl. Although the usage message shows that keys are required, there is no warning, confirmation, or explanatory comment disclosing that credentials will be transmitted over the network.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This script transmits sensitive credentials (stream-public-key and stream-secret-key) to an external service via HTTP headers. Although this appears necessary for the skill’s intended API interaction, it is still a real security-sensitive behavior because the skill causes secret material to leave the local environment and trusts a hard-coded third-party endpoint, increasing exposure if the endpoint is malicious, mistyped, compromised, or monitored.
Content: Scanner excerpt · scripts/create_video_custom.sh (reported line 14)May include surrounding context.
sh
fi # Example: 720p and 1080p with h264 codec curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \ -H 'stream-public-key: '"$PUBLIC_KEY" \ -H 'stream-secret-key: '"$SECRET_KEY" \ -H 'Content-Type: application/json' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/create_video_default.sh (reported line 13)May include surrounding context.
sh
exit 1 fi curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \ -H 'stream-public-key: '"$PUBLIC_KEY" \ -H 'stream-secret-key: '"$SECRET_KEY" \ -H 'Content-Type: application/json' \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This shell script sends the provided public and secret keys as HTTP headers to a remote API, but the file contains no warning, confirmation, or explanatory comment disclosing that credentials will be transmitted off-host. The usage message only describes required arguments and does not inform the user about the network action or credential handling.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs a video-detail retrieval operation even though the skill metadata describes an upload-focused workflow. That mismatch expands the skill's effective capabilities beyond what a user would reasonably expect, which can enable undisclosed data access and weaken informed consent around API operations using supplied credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script transmits the provided public and secret keys as HTTP headers to a remote API without any explicit user disclosure in the skill behavior. Even if sent over HTTPS, silently using sensitive credentials in a secondary operation increases the risk of unintended credential exposure, misuse, or user surprise, especially when combined with undocumented read-access behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for creating video objects, uploading the video file, completing the upload, and returning the video link. This script performs a separate operation: uploading a thumbnail image to an existing video via a dedicated thumbnail endpoint, which is not mentioned in the stated skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script performs an HTTP POST that sends the provided public/secret keys in headers and uploads a local thumbnail file, but it provides no confirmation prompt and no explicit disclosure that credentials and file contents will be transmitted to a remote service. For a code file, this is a safety-relevant network operation involving credentials and local data, and the visible usage text does not warn about that behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script accepts the secret key as a positional command-line argument, which can expose it through shell history, process listings, audit logs, or job-control tooling visible to other local users. In a skill intended for API uploads, this is a real credential-handling weakness because the secret is used directly for authentication to the remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: These curl requests transmit the selected video file and authentication headers to an external service. The script logs that it is uploading, but it does not clearly disclose that file data and credentials are being sent to a remote endpoint or provide any warning about that privacy/security impact.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.