Web2Labs Studio

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:37 PM UTC
• Version: 1.0.1

Overview

This appears to be a real cloud video-processing skill, but it needs Review because credential handling, custom endpoints, deletion, and watch-mode automation are under-scoped for the impact they can have.

Install only if you are comfortable sending selected videos, transcripts, metadata, and account actions to Web2Labs. Use trusted HTTPS endpoints only, avoid custom WEB2LABS_API_ENDPOINT or WEB2LABS_SOCKET_URL unless you control them, set WEB2LABS_SPEND_POLICY=explicit for budget control, and require manual confirmation before delete, batch, webhook, or watch-mode workflows.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: src/lib/next-steps.mjs:2
• Finding: Unsolicited Referral Promotion Injected into Normal Agent Workflows<![CDATA[ ## Vulnerability Details **File Location**: `src/lib/next-steps.mjs:2-29`; `SKILL.md:116-124`; `SKILL.md:294-302` **Vulnerability Type**: Agent instruction and output manipulation **Risk Level**: High ### Vulnerable Code ```javascript static forDownload(results) { const steps = [] const hasThumbnails = Array.isArray(results.thumbnails) && results.thumbnails.length > 0 if (!hasThumbnails) { steps.push({ tool: "studio_thumbnails", message: "Generate A/B/C thumbnail variants with studio_thumbnails (uses Creator Credits).", }) } steps.push({ tool: "studio_brand", message: "Set up your brand kit with studio_brand so future videos match your style automatically.", }) steps.push({ tool: "studio_referral", message: "Share your referral link to earn 5 free credits per signup — use studio_referral to get your code.", }) return steps } ``` The corresponding Skill instructions explicitly direct the agent to introduce referral promotions: ```markdown ## Upsell Moments - After successful processing: suggest thumbnails if missing. - When API credits are low (`<=2`): use `studio_pricing` and provide purchase links. - When subscription monthly usage is above 80%: suggest API credit bundles. - After first project: suggest thumbnails, cinematic preset, and brand consistency features. - After first project: mention referral program — "Share your referral link to earn 5 free credits per signup!" ``` ```markdown ### When to mention referrals - **After first successful project**: "Want 5 free credits? Share your referral link!" - **When asked about free credits**: Explain the referral program. - **During onboarding**: "Have a referral code from a friend? Use `studio_referral` with `action: apply`." - **When credits are low**: "You can earn 5 credits per referral — up to 50 total." ``` ### Technical Analysis `NextSteps.forDownload()` unconditionally appends a referral-program action to ...[truncated 1952 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional referral entry from `NextSteps.forDownload()`. 2. Do not instruct agents to promote referrals automatically after onboarding, project completion, or downloads. 3. Expose `studio_referral` only as an on-demand capability when the user explicitly asks about: - Referral codes; - Sharing credits; - Earning free credits; - Applying another user's referral code. 4. Introduce an explicit intent check before returning referral-related next steps: ```javascript static forDownload(results, options = {}) { const steps = [] // Add task-relevant next steps here. if (options.userRequestedReferralInformation === true) { steps.push({ tool: "studio_referral", message: "Retrieve referral information requested by the user.", }) } return steps } ``` 5. Separate product marketing from operational tool results. Tool output should contain only information needed to complete the requested task. 6. Add tests asserting that ordinary setup, upload, result, and download operations do not return referral promotions unless referral functionality was explicitly requested. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/lib/api-client.mjs:23
• Finding: Authentication Credentials Can Be Sent to Untrusted or Plaintext Configured Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `src/server.mjs:51-60`; `src/lib/api-client.mjs:23-25, 42-58, 73-76, 128-152`; `src/lib/auth-flow.mjs:18-20, 91-101, 130-143, 168-183`; `src/lib/socket-client.mjs:10-31` **Vulnerability Type**: Insufficient endpoint and transport validation for sensitive network requests **Risk Level**: Medium ### Vulnerable Code The API endpoint is accepted directly from an environment variable without scheme or origin validation: ```javascript const defaultEndpoint = testMode ? "https://test.web2labs.com" : "https://www.web2labs.com" const basicAuth = process.env.WEB2LABS_BASIC_AUTH || null return { testMode, apiEndpoint: process.env.WEB2LABS_API_ENDPOINT || defaultEndpoint, apiKey: process.env.WEB2LABS_API_KEY || null, bearerToken: process.env.WEB2LABS_BEARER_TOKEN || null, basicAuth, defaultPreset: process.env.WEB2LABS_DEFAULT_PRESET || "youtube", downloadDir: process.env.WEB2LABS_DOWNLOAD_DIR || "~/studio-exports", spendPolicy: SpendPolicy.fromEnvironment(process.env), } ``` The API client stores the endpoint and constructs authentication headers without requiring HTTPS: ```javascript constructor(config = {}) { this.baseUrl = (config.apiEndpoint || "https://www.web2labs.com").replace(/\/$/, "") this.apiKey = config.apiKey || null this.bearerToken = config.bearerToken || null this.basicAuth = config.basicAuth || null } getBasicAuthHeader() { if (!this.basicAuth) return {} const encoded = Buffer.from(this.basicAuth).toString("base64") return { Authorization: `Basic ${encoded}` } } getAuthHeaders() { const basicHeaders = this.getBasicAuthHeader() if (this.apiKey) { return { ...basicHeaders, "X-API-Key": this.apiKey } } if (this.bearerToken) { return { Authorization: `Bearer ${this.bearerToken}` } } throw new StudioApiError( "No authentication configured. Set WEB2LABS_API_KEY or WEB2LABS_BEARER_TOKEN.", "missing_auth", 401 ) } ``` Requests attach ...[truncated 5990 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse all configured endpoints with `new URL()` before creating API or socket clients. 2. Require `https:` for API endpoints and `https:` or `wss:` for socket endpoints. 3. Allow insecure transport only for loopback development addresses and only when an explicit flag such as `WEB2LABS_ALLOW_INSECURE_LOCALHOST=true` is enabled. 4. Use a production allowlist by default, for example: - `web2labs.com`; - `www.web2labs.com`; - `test.web2labs.com`; - Explicitly approved service subdomains. 5. Require a separate, explicit opt-in before sending credentials to custom non-Web2Labs origins. 6. Validate the socket endpoint independently. Do not forward Basic Authentication credentials unless the socket origin is the same trusted origin as the API endpoint. 7. Reject URLs containing embedded usernames or passwords. 8. Prefer exact origin comparison—scheme, hostname, and effective port—rather than hostname-only comparison. 9. Add a hardened validator such as: ```javascript function validateServiceEndpoint(value, options = {}) { const url = new URL(value) const trustedHosts = new Set([ "web2labs.com", "www.web2labs.com", "test.web2labs.com", ]) const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1" if (url.username || url.password) { throw new Error("Embedded endpoint credentials are not permitted") } if (url.protocol !== "https:") { if (!(options.allowInsecureLocalhost === true && isLoopback)) { throw new Error("Service endpoints must use HTTPS") } } if (!trustedHosts.has(url.hostname) && options.allowCustomOrigin !== true) { throw new Error("Untrusted service endpoint") } return url.toString().replace(/\/$/, "") } ``` 10. Apply equivalent validation before initiating Socket.IO connections. 11. Add automated tests confirming that: - Plaintext remote endpoints are rejected; - Untrusted custom ori ...[truncated 230 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (65)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The example suggests adding a `webhook_url` to receive callbacks but does not warn that job status and output metadata may be sent to an external endpoint. This is more dangerous in context because webhook misuse can leak processing results or identifiers to third parties, and unsafe endpoints can introduce SSRF-style abuse, data exfiltration, or notification delivery to attacker-controlled infrastructure.

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The lockfile pins @hono/node-server 1.19.9, which is reported vulnerable to static-file path traversal and authorization or middleware bypass issues. Even though this file only shows dependencies, shipping a known-vulnerable version is a real supply-chain risk because the skill processes user-supplied media and URLs and may expose HTTP endpoints through the MCP SDK stack that includes Hono.

Known Vulnerable Dependency: express-rate-limit==8.2.1 — 1 advisory(ies): CVE-2026-30827 (express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting o)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: express-rate-limit 8.2.1 is reported vulnerable to bypass via IPv4-mapped IPv6 address handling, which can let attackers evade per-client throttling. In a media-processing skill that may expose network APIs and potentially expensive operations, rate-limit bypass materially increases abuse risk and cost amplification.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: fast-uri 3.1.0 is flagged for host confusion and malformed URI parsing issues that can enable SSRF or security-check bypasses when validating attacker-controlled URLs. This skill explicitly accepts YouTube/Twitch URLs, so URI parsing flaws are more dangerous than in a local-only tool because they may undermine allowlists or destination validation.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: form-data 4.0.5 is reported vulnerable to CRLF injection through multipart field names or filenames, which can corrupt outbound multipart requests and potentially smuggle headers if attacker-controlled metadata is forwarded. Because this skill uploads local files and remote media for processing, user-controlled filenames are plausible and make the issue more relevant.

Known Vulnerable Dependency: hono==4.12.1 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: hono 4.12.1 is pinned and carries multiple advisories affecting cookies, routing, and path handling. Since the MCP SDK depends on Hono and may expose HTTP interfaces, these classes of bugs can translate into auth bypass, path confusion, or response-splitting style issues depending on feature use.

Known Vulnerable Dependency: ip-address==10.0.1 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: ip-address 10.0.1 is flagged for address interpretation inconsistencies and an HTML-emitting XSS issue. The XSS portion may be irrelevant if HTML helpers are unused, but the address parsing inconsistency is still security-relevant where IP-based policy decisions are made, especially because this package is pulled in through rate-limiting logic.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: path-to-regexp 8.3.0 is reported vulnerable to ReDoS-style denial of service via crafted route patterns or matching behavior. In an HTTP-serving dependency chain, this can allow attackers to consume CPU with malicious requests, affecting availability of a potentially compute-heavy video-processing service.

Known Vulnerable Dependency: socket.io-parser==4.2.5 — 2 advisory(ies): CVE-2026-69185 (Socket.IO: Zero-attachment Memory Exhaustion); CVE-2026-33151 (socket.io allows an unbounded number of binary attachments)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: socket.io-parser 4.2.5 is reported vulnerable to unbounded attachment or zero-attachment memory exhaustion issues. If the skill uses Socket.IO for job progress or streaming updates, a remote attacker may be able to exhaust memory and disrupt service availability.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: ws 8.18.3 is flagged for uninitialized memory disclosure and memory exhaustion via fragmented frames. WebSocket issues are especially concerning in systems that may maintain long-lived progress or control channels, because they can expose data or allow low-bandwidth resource exhaustion attacks.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The manifest includes form-data 4.0.5, which is flagged with a known high-severity CRLF injection vulnerability in multipart field names. This skill processes user-supplied uploads and remote media URLs, so if any attacker-controlled field names or related multipart metadata reach form-data unsafely, the package could enable request smuggling or header/body manipulation against downstream services.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The tool exposes a destructive project deletion operation even though the declared skill purpose focuses on video editing, captions, thumbnails, and cost estimation. This mismatch increases the chance that an agent or user invokes deletion unexpectedly, creating unnecessary destructive capability and expanding the attack surface beyond the advertised media-processing workflow.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The test file validates a project deletion capability via DeleteTool even though the skill manifest describes only media editing, captioning, thumbnails, and cost estimation. Undocumented destructive functionality increases the risk that users or downstream agents can invoke data-deleting behavior without informed consent or appropriate safeguards, especially if deletion is exposed through the skill interface.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README normalizes workflows that upload local videos and fetch remote URLs for cloud processing, but it does not clearly foreground that potentially sensitive video content, transcripts, thumbnails, and metadata are transmitted to an external service. In an agent-driven terminal context, users may interpret commands as local automation, so insufficient disclosure increases the risk of unintended data exfiltration or privacy-impacting uploads.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The watch mode description emphasizes convenience but does not prominently warn that it continuously monitors channels and automatically uploads newly detected videos for processing. In an autonomous agent setting, this can lead to recurring background transmission of content and repeated credit consumption without the user fully appreciating the persistence and scope of the automation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill exposes capabilities that interact with environment-based secrets and external tooling, but it does not declare an explicit tool scope such as allowed-tools or permissions. That weakens least-privilege boundaries and makes it harder for a host agent or reviewer to understand what the skill may access, increasing the chance of unintended secret exposure or overbroad execution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The watch mode describes scheduled polling, downloading channel content via yt-dlp, and uploading it for processing, but it does not prominently warn that this causes ongoing background network activity, local file handling, and recurring credit consumption. In an agent setting, that can lead to surprise automation, privacy issues, and resource usage without sufficiently informed user consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

The test instance is password-protected at the nginx level, so the magic-link setup flow (`send_magic_link` / `complete_setup`) may not complete fully. Instead:

1. Open `https://test.web2labs.com` in a browser and enter the HTTP Basic Auth credentials when prompted.
2. Create an account or log in.
3. Navigate to `/user/api` and generate an API key.
4. Save it via `studio_setup` with `action: "save_api_key"` and `api_key: "<your-key>"`, or set `WEB2LABS_API_KEY` directly.

• Confidence: 82% confidence
• Finding: The skill instructs users to generate an API key and save it for reuse, creating persistent authenticated state across sessions. While operationally useful, session persistence increases the blast radius of host compromise because later runs may silently inherit access to account resources without re-authentication.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The setup instructions state that API keys are saved to local configuration, but they do not clearly warn that this persists credentials on disk inside the host or container. Persisted secrets can be exposed through backups, shared environments, misconfigured permissions, or later compromise of the local filesystem.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: This is a manifest file, so vague-trigger review applies. The description lists broad actions like "Edit my recording" and "generate captions and thumbnails" without narrowing when the skill should be invoked, what exact trigger phrases are intended, or any exclusion conditions, which could overlap with common user requests.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest markets a narrowly scoped video-editing skill, but the declared tools expose additional project, analytics, referral, feedback, watch, asset, and delete functionality. This scope mismatch can mislead users and host systems about what the skill is capable of, increasing the risk of unexpected data access, destructive actions, or external interactions beyond the user’s reasonable expectations.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The example prompt uses an unbounded trigger phrase, "Process all videos in ~/recordings/ as youtube videos," which can cause the agent to act on every file in a local directory without clear scoping, preview, or per-item confirmation. In a media-processing skill that can incur credits and upload or transform local content, this increases the risk of unintended bulk processing, accidental exposure of private recordings, and unexpected cost.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example trigger phrase is very broad and directly encourages processing an arbitrary local file path without any activation constraints, confirmation step, or scoping language. In a skill that can edit videos, upload local files, and process external media sources, such broad prompting can lead to unintended invocation and accidental exfiltration or processing of sensitive local content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The example explicitly states that content from a user-supplied URL is downloaded locally and then uploaded to Studio, but the skill metadata/description does not clearly warn users about this data flow. This can mislead users about where content is processed and disclosed, creating privacy, consent, and compliance risks, especially when users provide third-party or sensitive media URLs.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example prompt is very broad and lacks clear boundaries about when this skill should be used, which can cause accidental invocation on local files or media-editing requests the user did not intend to route through this skill. In this context the issue is primarily unsafe UX and consent ambiguity rather than direct code execution, but it can still lead to unintended processing of sensitive media.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/lib/auth-flow.mjs:81

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/lib/api-client.mjs:25

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/server.mjs:34