Kujiale 3D Model Upload

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:24 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it says, but it can use your Kujiale credentials to create and submit remote model assets by default, so it should be reviewed before installation.

Install only if you intend to let this skill create or modify assets in your Kujiale tenant. Prefer dry-run first, use environment-injected credentials instead of --app-secret, pin dependencies in your own environment, provide an explicit ZIP path, and verify the default category/location values before running the real flow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44, SKILL.md:140, SKILL.md:284, config.json:19, kujiale_upload.py:30, kujiale_upload.py:606-608, and kujiale_upload.py:653-656
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:44:

bash

pip install requests oss2

config.json:19:

json

"dependencies": ["requests", "oss2"]

kujiale_upload.py:606-608:

python

if not _HAS_REQUESTS:
  raise ImportError("'requests' not installed. Run: pip install requests")
if not _HAS_OSS2:
  raise ImportError("'oss2' not installed. Run: pip install oss2")

kujiale_upload.py:653-656:

python

if not _HAS_REQUESTS:
  print("ERROR: 'requests' not installed. Run: pip install requests", file=sys.stderr)
  return 1
if not _HAS_OSS2:
  print("ERROR: 'oss2' not installed. Run: pip install oss2", file=sys.stderr)

Technical Analysis

The project instructs users to install requests and oss2 without exact versions or package integrity hashes. Its metadata likewise declares only bare package names. Consequently, installation resolves whichever compatible release the configured Python package index serves at installation time.

This makes builds non-reproducible and places implicit trust in future package releases and the selected package index. If a dependency release or package repository is compromised, malicious installation or runtime code could enter the environment without any change to this audited project.

The package names themselves appear legitimate; the issue is the absence of version and integrity controls, not evidence that the currently published packages are malicious.

Attack Path

1. An attacker compromises a future release of one of the declared dependencies, its publisher account, or the package-resolution infrastructure.
2. A user follows the documented `pip install request ...[truncated 982 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency lock file containing exact versions, for example:

   text

   requests==REVIEWED_VERSION
   oss2==REVIEWED_VERSION
   

2. Generate and record cryptographic hashes for every direct and transitive dependency.

3. Install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Update SKILL.md, config.json, and runtime error messages to reference the locked requirements file instead of recommending unconstrained installation.

5. Use a controlled package index or internal mirror in production and CI environments.

6. Run dependency vulnerability and provenance checks during release preparation.

7. Review and update pinned versions on a controlled schedule rather than automatically resolving the latest releases.

T09 · Insecure Skill Coding Practices

Warning

• Location: kujiale_upload.py:637

Finding

API Secret Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: kujiale_upload.py:637-640; documented usage at SKILL.md:145-149
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code Snippets

kujiale_upload.py:637-640:

python

parser.add_argument("--app-key", default=None,
                    help="Kujiale OpenAPI appKey. Falls back to env var {}.".format(_ENV_APP_KEY))
parser.add_argument("--app-secret", default=None,
                    help="Kujiale OpenAPI appSecret. Falls back to env var {}.".format(_ENV_APP_SECRET))

SKILL.md:145-149:

bash

python kujiale_upload.py \
  --app-key YOUR_APP_KEY \
  --app-secret YOUR_APP_SECRET

Technical Analysis

The CLI accepts the long-lived Kujiale application secret directly as an argument and the documentation presents this as a supported invocation method. Command-line arguments may be recorded in shell history, terminal transcripts, CI logs, process telemetry, job definitions, or operating-system process listings.

Although the script does not intentionally print app_secret, passing the value through --app-secret exposes it before the script can protect or erase it. Any local account or monitoring component permitted to inspect the process command line or retained execution records may recover the credential.

The script also supports environment-based credentials, which reduces exposure to process argument inspection, but the vulnerable command-line route remains enabled and documented.

Attack Path

1. A user runs the documented command with a real Kujiale application secret in the --app-secret argument.
2. The shell records the command in its history, or a process monitor, CI runner, audit service, or diagnostic tool captures the full argument list.
3. An attacker with access to that history, log, telemetry source, or process metadata obtains the secret.
4. The ...[truncated 725 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --app-secret option or deprecate it with a prominent security warning.

2. Prefer a secret manager or protected environment injection for automated execution.

3. For interactive execution, read the secret without echoing it:

   python

   import getpass
   app_secret = getpass.getpass("Kujiale app secret: ")
   

4. If file-based configuration is required, enforce restrictive file permissions and exclude the file from version control.

5. Revise all examples so they never place a real secret directly on the command line.

6. Configure CI systems to mask the credential and inject it only into the job environment.

7. Advise users who previously used the argument form to clear relevant shell history and logs and rotate the credential if exposure is possible.

8. Continue ensuring that exceptions, request URLs, and diagnostic output never include the secret or generated signature.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

pip install requests oss2

# 2. Copy the example env file and fill in YOUR credentials
cp .env.example .env
# Windows PowerShell:
# Copy-Item .env.example .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

pip install requests oss2

# 2. Copy the example env file and fill in YOUR credentials
cp .env.example .env
# Windows PowerShell:
# Copy-Item .env.example .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md

pip install requests oss2

# 2. Copy the example env file and fill in YOUR credentials
cp .env.example .env
# Windows PowerShell:
# Copy-Item .env.example .env

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation describes capabilities that use environment variables for credentials and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope declarations can cause the skill to run with broader-than-expected privileges or make operators unaware that it accesses secrets and external services.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · kujiale_upload.py (reported line 290)May include surrounding context.

python

try:
    with open(local_path, "rb") as f:
      result = bucket.put_object(sts_data["filePath"], f)
  except Exception as exc:
    _raise_request_failure("Step 2 OSS PUT", exc)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill performs real remote side effects by default: it uploads a local ZIP to Alibaba OSS, triggers server-side parsing, and submits a model asset without any explicit confirmation gate immediately before execution. In an agent setting, that can cause unintended modification of third-party cloud assets or accidental publication/testing against a production tenant when the caller did not fully understand the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

If zip_path is omitted, the skill silently creates a local ZIP file via _create_test_zip() before proceeding. Automatic file creation is a side effect that may be unexpected in constrained or sensitive environments, especially when invoked by an automation agent on behalf of a user.

Content

No source excerpt is available for this finding.