Upload video to AIOZ Stream

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:34 PM UTC
• Version: 1.0.1

Overview

This upload skill performs mostly relevant video API actions, but it asks for reusable secrets and media files while hard-coding a questionable service destination and including account-changing actions beyond simple upload.

Install only if you trust the publisher and have verified that `api-w3stream.attoaioz.cyou` is the intended service endpoint for your account. Use a least-privileged upload-only or short-lived key where possible, avoid passing secrets on the command line, confirm the exact file path before upload, and do not allow delete or update operations unless you explicitly intend them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

other

Error

• Location: scripts/upload_video_file.sh:40
• Finding: API Credentials and User Media Are Transmitted to an Unverified Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/upload_video_file.sh:40-46`; also affects `SKILL.md:33-36, 90-94, 126-130, 149-152, 316-320`, `scripts/create_video_default.sh:13-19`, `scripts/create_video_custom.sh:14-59`, `scripts/upload_video_file.sh:69-77, 94-97`, `scripts/upload_thumbnail.sh:20-24`, `scripts/get_video_detail.sh:13-16`, and `scripts/calculate_cost.sh:18-21` **Vulnerability Type**: Credential and media exfiltration **Risk Level**: Critical ### Vulnerable Code ```bash curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/$VIDEO_ID/part" \ -H 'stream-public-key: '"$PUBLIC_KEY" \ -H 'stream-secret-key: '"$SECRET_KEY" \ -H "Content-Range: bytes 0-$END_POS/$FILE_SIZE" \ -F "file=@$FILE_PATH" \ -F "index=0" \ -F "hash=$HASH" ``` The same destination is used for metadata creation, multipart video uploads, thumbnail uploads, video-detail requests, cost calculations, and upload completion. ### Technical Analysis The Skill declares AIOZ Stream upload functionality but directs reusable public and secret API credentials, user-selected videos, thumbnails, and associated metadata to `https://api-w3stream.attoaioz.cyou`. The audited package contains no evidence establishing that this nonstandard `.cyou` hostname is an official or authorized AIOZ endpoint. Sending authentication secrets and complete media files is functionally necessary for an upload service only when the destination is verified and trusted. In this implementation, there is no endpoint validation, destination allowlist, certificate pinning, ownership documentation, scoped temporary-token mechanism, or explicit warning asking the user to confirm the recipient. Consequently, the behavior exceeds a defensible least-privilege design. ### Attack Path 1. A user loads the Skill and follows its instructions. 2. The Skill asks the user for a reusable public key and secret key. 3. The user invokes the scripts with those credentials and a local media path. 4. ...[truncated 788 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the endpoint with a verified, documented vendor-owned API hostname. 2. Publish verifiable ownership and data-handling documentation for the destination. 3. Require explicit user confirmation of the destination before transmitting credentials or media. 4. Prefer short-lived, upload-scoped tokens over reusable account secret keys. 5. Restrict tokens to the minimum operations and target video required. 6. Add an immutable endpoint allowlist rather than accepting or silently using arbitrary destinations. 7. Redact credentials from all output and provide revocation instructions for credentials already used. 8. Document media retention, privacy, deletion, and transport-security policies. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create_video_default.sh:4
• Finding: Secret API Keys Are Exposed Through Process Arguments and Shell History<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create_video_default.sh:4-10`; the same argument pattern appears in all six shell scripts, and usage is documented in `README.md:31-39` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```bash PUBLIC_KEY="$1" SECRET_KEY="$2" TITLE="$3" if [ -z "$PUBLIC_KEY" ] || [ -z "$SECRET_KEY" ] || [ -z "$TITLE" ]; then echo "Usage: $0 <public_key> <secret_key> <title>" exit 1 fi ``` The documented invocation pattern is: ```bash ./scripts/create_video_default.sh <public_key> <secret_key> "My Video Title" ./scripts/upload_video_file.sh <public_key> <secret_key> <VIDEO_ID> /path/to/video.mp4 ./scripts/get_video_detail.sh <public_key> <secret_key> <VIDEO_ID> ``` ### Technical Analysis Command-line arguments are not an appropriate channel for reusable secrets. Depending on the operating system and execution environment, arguments can be exposed through process-listing interfaces, process monitoring, audit records, diagnostic tooling, CI logs, terminal transcripts, and shell history. Assigning `$2` to a shell variable does not remove the secret from the process argument vector. Every script in this package follows the same pattern, expanding the exposure across all supported API operations. ### Attack Path 1. A user invokes one of the scripts with the secret key as the second positional argument. 2. The complete command may be persisted in shell history or automation logs. 3. While the process is running, another local user or monitoring process inspects the process command line where operating-system permissions allow it. 4. The observer extracts the reusable secret key. 5. The key is reused to perform API operations within its assigned scope. ### Impact Assessment An attacker who obtains the key gains the API privileges assigned to the affected account credential. The scope may include access to video metadata and the ability to create, upload, mod ...[truncated 180 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not accept secret keys as command-line arguments. 2. Read the secret interactively from standard input with terminal echo disabled, for example with `read -r -s`. 3. For automation, use a credential file owned by the invoking user with mode `0600`, or integrate with an operating-system secret store. 4. Prefer short-lived environment-specific tokens with minimal API scope. 5. Ensure scripts never print secrets in errors, debug traces, or usage examples. 6. Warn existing users to remove affected commands from shell histories and rotate previously exposed keys. 7. Avoid enabling shell tracing while credentials are loaded. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload_video_file.sh:68
• Finding: Predictable Temporary File Enables Local Symlink and Integrity Attacks<![CDATA[ ## Vulnerability Details **File Location**: `scripts/upload_video_file.sh:68-82` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```bash # Extract chunk and compute its MD5 dd if="$FILE_PATH" bs=1 skip="$START_POS" count="$CHUNK_SIZE_ACTUAL" 2>/dev/null | \ tee >(md5sum | awk '{print $1}' > /tmp/chunk_hash_$$) | \ curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/$VIDEO_ID/part" \ -H 'stream-public-key: '"$PUBLIC_KEY" \ -H 'stream-secret-key: '"$SECRET_KEY" \ -H "Content-Range: bytes $START_POS-$END_POS/$FILE_SIZE" \ -F "file=@-;filename=$(basename "$FILE_PATH")" \ -F "index=$PART_INDEX" \ -F "hash=$(cat /tmp/chunk_hash_$$)" echo "" # Cleanup temp file rm -f /tmp/chunk_hash_$$ ``` ### Technical Analysis The script constructs a temporary filename directly under the shared `/tmp` directory using only the process ID. It does not use `mktemp`, perform exclusive file creation, validate file ownership, assign restrictive permissions, or install a cleanup trap. Process IDs are observable or predictable. A local attacker can pre-create `/tmp/chunk_hash_<PID>` as a symbolic link or manipulate it during execution. The redirection performed by the hashing process then follows the attacker-controlled path. The separate write, read, and deletion operations also create race windows. ### Attack Path 1. A local attacker predicts or observes the upload process ID. 2. The attacker creates `/tmp/chunk_hash_<PID>` as a symbolic link to a file writable by the victim. 3. The victim performs a multipart upload. 4. The shell follows the symbolic link when writing the computed hash. 5. Data in the linked target may be overwritten or corrupted. 6. Alternatively, the attacker changes the temporary file before it is read, causing an attacker-selected hash to be submitted and disrupting upload integrity. ### Impact Assessment The issue can permit file corruption under the priv ...[truncated 356 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create temporary files with `mktemp`, for example: ```bash HASH_FILE=$(mktemp "${TMPDIR:-/tmp}/w3stream-hash.XXXXXX") || exit 1 chmod 600 "$HASH_FILE" trap 'rm -f "$HASH_FILE"' EXIT HUP INT TERM ``` 2. Avoid shared temporary files entirely when the hash can be computed before the upload or safely retained in memory. 3. Never construct temporary paths from only a PID. 4. Use exclusive creation and validate that any temporary object is a regular file owned by the current user. 5. Add strict error handling so that absent, incomplete, or modified hash files abort the upload. 6. Document that the script must not be run with elevated privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_video_default.sh:13
• Finding: Unescaped Video Titles Permit JSON Structure Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create_video_default.sh:13-19`; the same issue appears in `scripts/create_video_custom.sh:14-20` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```bash curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \ -H 'stream-public-key: '"$PUBLIC_KEY" \ -H 'stream-secret-key: '"$SECRET_KEY" \ -H 'Content-Type: application/json' \ -d '{ "title": "'"$TITLE"'" }' ``` The custom creation script similarly embeds the title directly: ```bash -d '{ "title": "'"$TITLE"'", "is_public": true, "qualities": [ ``` ### Technical Analysis The title is concatenated directly into a JSON string without JSON escaping. Quotes, backslashes, control characters, and JSON delimiters in the title can terminate or alter the intended value. This permits malformed request generation and, where the resulting document remains valid and duplicate-field behavior is favorable, injection of additional API fields. Shell quoting prevents ordinary shell command substitution in the already-expanded argument, so this is JSON/data injection rather than shell command execution. ### Attack Path 1. An attacker supplies or influences the requested video title. 2. The title contains JSON delimiters that close the intended string and introduce additional properties. 3. The script concatenates that input into the request body without escaping. 4. The API receives a document whose structure differs from the developer's intended structure. 5. Depending on server-side parsing and validation, injected fields can alter metadata, visibility, encoding configuration, or other accepted creation options. ### Impact Assessment The direct impact is limited to the API request made using the victim's credentials. It can cause request failure, unintended metadata changes, or unauthorized configuration changes within the newly created video object. It does not provi ...[truncated 57 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Construct JSON with a real serializer rather than string concatenation. The project already declares `jq` as a dependency, so the request can be generated safely: ```bash PAYLOAD=$(jq -n --arg title "$TITLE" '{title: $title}') || exit 1 curl --fail-with-body --silent --show-error \ -X POST 'https://verified-vendor-endpoint.example/api/videos/create' \ -H "stream-public-key: $PUBLIC_KEY" \ -H "stream-secret-key: $SECRET_KEY" \ -H 'Content-Type: application/json' \ --data-binary "$PAYLOAD" ``` Apply the same approach to every user-controlled JSON field, including descriptions, tags, metadata, codecs, and quality settings. Add tests covering quotes, backslashes, line breaks, Unicode, and JSON delimiters. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_video_file.sh:36
• Finding: Upload Scripts Report Success Without Validating HTTP or Pipeline Failures<![CDATA[ ## Vulnerability Details **File Location**: `scripts/upload_video_file.sh:36-49`; related unconditional success handling appears at `scripts/upload_video_file.sh:50-100` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```bash if [ "$FILE_SIZE" -le "$CHUNK_SIZE" ]; then # Single-part upload echo "Uploading in single part..." curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/$VIDEO_ID/part" \ -H 'stream-public-key: '"$PUBLIC_KEY" \ -H 'stream-secret-key: '"$SECRET_KEY" \ -H "Content-Range: bytes 0-$END_POS/$FILE_SIZE" \ -F "file=@$FILE_PATH" \ -F "index=0" \ -F "hash=$HASH" echo "" echo "Upload completed!" ``` The finalization request is also followed by unconditional success output: ```bash curl -s -X GET "https://api-w3stream.attoaioz.cyou/api/videos/$VIDEO_ID/complete" \ -H 'accept: application/json' \ -H 'stream-public-key: '"$PUBLIC_KEY" \ -H 'stream-secret-key: '"$SECRET_KEY" echo "" echo "Upload finalized successfully!" ``` ### Technical Analysis The script uses `curl -s` without `--fail` or `--fail-with-body`, does not inspect HTTP status codes, and does not validate response bodies. It also lacks strict shell settings such as `set -euo pipefail`. Therefore, authentication failures, server errors, malformed requests, network interruptions, multipart failures, and pipeline errors may be followed by success messages. The script proceeds to the completion endpoint even when one or more parts were not successfully uploaded. This creates an integrity and reliability flaw and can encourage repeated retransmission of credentials and media. ### Attack Path 1. An upload fails because of a network interruption, invalid credentials, an HTTP error, or a rejected part. 2. `curl -s` suppresses progress and does not convert ordinary HTTP error responses into command failure. 3. The script does not evaluate the response. 4. It prints “Upload c ...[truncated 702 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Begin scripts with strict error handling: ```bash set -euo pipefail ``` 2. Invoke curl with explicit failure reporting: ```bash curl --fail-with-body --silent --show-error ... ``` 3. Capture and validate every response before proceeding. 4. Verify that each upload response identifies the expected video and part index. 5. Abort multipart processing immediately when any part fails. 6. Call the completion endpoint only after all expected parts have been confirmed. 7. Validate the completion response and server-side status before printing success. 8. Return nonzero exit codes for all failed or indeterminate outcomes. 9. Add retry limits with backoff and avoid retrying authentication or validation failures automatically. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description centers on a full video upload workflow: creating video objects, uploading a file, finalizing the upload, and returning a video link. The supplied code does none of those things. It is a shell script that calls a `/api/videos/cost` endpoint to retrieve transcoding price information based on duration and output qualities. This is a materially different primary purpose, so the description does not accurately represent the code's behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description describes a full upload workflow: create video objects, upload the file, complete the upload, and return the final video link. The supplied code chunk performs only one subset of that workflow: sending a POST request to create a video object with a hardcoded custom quality configuration. There is no file transfer step, no completion/finalization call, and no logic to extract or return a video link. While the code is related to AIOZ Stream video creation, it materially underimplements the described end-to-end behavior, so the description does not accurately represent this specific code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a full quick-upload workflow: create video objects with default or custom encoding settings, upload the file, complete the upload, and return a link. The supplied code only performs the initial create-video API call with a title. It does not handle file upload, upload completion, link extraction/return, or custom encoding options. While creating a video object is consistent with part of the description, the actual code chunk implements only a narrow subset of the declared functionality, so the description overstates what this code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says the skill performs a video upload workflow: create a video object, upload the file, finalize the upload, and return a link. The supplied code does none of that. It only issues a GET request to retrieve details for a specified video ID from the API. This is a materially different primary purpose and capability from uploading videos, so the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a full video-upload workflow: creating video objects, uploading a video, completing the upload, and returning a video link. The supplied code instead performs a different task: it uploads a thumbnail image (.png/.jpg) to the thumbnail endpoint for an already existing video ID. This is not a supporting implementation detail of the declared flow; it is a separate media-management action with a different primary purpose and different required inputs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code only implements the file-upload portion of the described workflow. It accepts credentials, a preexisting VIDEO_ID, and a local file path; computes hashes; uploads the file in one or more parts; and calls a completion endpoint. It does not create a video object, does not set encoding configurations, and does not obtain or return a user-facing video link. While the general domain matches video upload to an AIOZ-related API, the declared description overstates the implemented behavior in material ways.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Delete-video functionality is materially more dangerous than upload and is not justified by the skill's stated purpose. In an agent context, bundling destructive account operations into an upload skill increases the risk of unintended or socially engineered deletion of user assets.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo ""
    
    # Cleanup temp file
    rm -f /tmp/chunk_hash_$$
    
    # Move to next chunk
    START_POS=$((END_POS + 1))

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to pass a secret API key directly as a command-line argument, which can expose credentials through shell history, process listings, audit logs, CI job logs, and terminal recordings. Because this skill is specifically for uploading to a remote API using long-lived authentication headers, disclosure of the secret key could allow unauthorized API access and misuse of the user's account.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs use of shell-capable tooling (`curl`, `jq`, `md5sum`) but does not declare an explicit tool scope such as allowed tools or permissions. In an agent setting, missing scope boundaries increases the chance the skill can invoke shell operations more broadly than users expect, including reading local files and transmitting them to remote endpoints.

External Transmission

Medium

• Category: Data Exfiltration

Content

emoji: "🎬"
    requires:
      bins: 
        - curl
        - jq
        - md5sum
---

• Confidence: 90% confidence
• Finding: This skill is explicitly designed to transmit sensitive material externally: API credentials are sent as headers on every request and local video files are uploaded to a third-party service. External transmission is expected for the use case, but it still creates real exfiltration risk if users provide the wrong file path, if prompts are manipulated, or if the destination/domain is not tightly validated.

External Transmission

Medium

• Category: Data Exfiltration

Content

Then upload via multipart form-data with the Content-Range header:

```bash
curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/VIDEO_ID/part" \
  -H 'stream-public-key: PUBLIC_KEY' \
  -H 'stream-secret-key: SECRET_KEY' \
  -H "Content-Range: bytes 0-$END_POS/$FILE_SIZE" \

• Confidence: 95% confidence
• Finding: The multipart upload step sends a local file and associated hash to an external service, which is the core behavior of the skill but also the primary security risk. In an agent environment, any capability that reads local paths and posts their contents remotely can be abused to exfiltrate unintended files if path handling and user consent are weak.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest frames the skill as a simple upload helper, but the documentation also enables broader account operations including listing, updating, thumbnail upload, pricing, and deletion. This scope expansion matters because users or orchestrators may authorize the skill for upload-only tasks while it actually contains instructions for additional state-changing actions against the same API.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documented delete call is destructive and irreversible in effect, yet the skill provides no warning, confirmation, or safety checks. Without confirmation guidance, an agent could execute deletion from an ambiguous prompt or prompt-injection chain, causing loss of video assets.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest identifies the skill as "w3stream-video-upload" and describes uploading to the W3Stream API, while the provided skill metadata says the skill is "aioz-stream-video-upload" for the AIOZ Stream API. This mismatch can mislead reviewers and users about the skill’s true identity and destination service, increasing the risk of misconfiguration, accidental trust, or deceptive repackaging.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This shell script sends the provided public and secret keys as HTTP headers to a remote API using curl. Although the usage message shows that keys are required, there is no warning, confirmation, or explanatory comment disclosing that credentials will be transmitted over the network.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# Example: 720p and 1080p with h264 codec
curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \
  -H 'stream-public-key: '"$PUBLIC_KEY" \
  -H 'stream-secret-key: '"$SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 93% confidence
• Finding: This script transmits sensitive credentials (`stream-public-key` and `stream-secret-key`) to an external service via HTTP headers. Although this appears necessary for the skill’s intended API interaction, it is still a real security-sensitive behavior because the skill causes secret material to leave the local environment and trusts a hard-coded third-party endpoint, increasing exposure if the endpoint is malicious, mistyped, compromised, or monitored.

External Transmission

Medium

• Category: Data Exfiltration

Content

exit 1
fi

curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \
  -H 'stream-public-key: '"$PUBLIC_KEY" \
  -H 'stream-secret-key: '"$SECRET_KEY" \
  -H 'Content-Type: application/json' \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This shell script sends the provided public and secret keys as HTTP headers to a remote API, but the file contains no warning, confirmation, or explanatory comment disclosing that credentials will be transmitted off-host. The usage message only describes required arguments and does not inform the user about the network action or credential handling.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script performs a video-detail retrieval operation even though the skill metadata describes an upload-focused workflow. That mismatch expands the skill's effective capabilities beyond what a user would reasonably expect, which can enable undisclosed data access and weaken informed consent around API operations using supplied credentials.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script transmits the provided public and secret keys as HTTP headers to a remote API without any explicit user disclosure in the skill behavior. Even if sent over HTTPS, silently using sensitive credentials in a secondary operation increases the risk of unintended credential exposure, misuse, or user surprise, especially when combined with undocumented read-access behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a skill for creating video objects, uploading the video file, completing the upload, and returning the video link. This script performs a separate operation: uploading a thumbnail image to an existing video via a dedicated thumbnail endpoint, which is not mentioned in the stated skill description.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs an HTTP POST that sends the provided public/secret keys in headers and uploads a local thumbnail file, but it provides no confirmation prompt and no explicit disclosure that credentials and file contents will be transmitted to a remote service. For a code file, this is a safety-relevant network operation involving credentials and local data, and the visible usage text does not warn about that behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script accepts the secret key as a positional command-line argument, which can expose it through shell history, process listings, audit logs, or job-control tooling visible to other local users. In a skill intended for API uploads, this is a real credential-handling weakness because the secret is used directly for authentication to the remote service.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: These curl requests transmit the selected video file and authentication headers to an external service. The script logs that it is uploading, but it does not clearly disclose that file data and credentials are being sent to a remote endpoint or provide any warning about that privacy/security impact.

Static analysis

No suspicious patterns detected.