Security audit

Byted Airesearch Videoeval

Security checks for vulnerabilities and agentic risk

Overview

The skill’s video-evaluation workflow is coherent, but it includes an undocumented API-host override that could redirect API keys and uploaded videos to an untrusted server.

Install only if you trust the publisher and can control the runtime environment. Prefer BYTED_AIRESEARCH_VIDEOEVAL_API_KEY over passing real keys on the command line, rotate any key previously used in shell commands or logs, and ensure BYTED_AIRESEARCH_VIDEOEVAL_BASE_URL is unset or pinned to the expected HTTPS Volcengine host before submitting videos or prompts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/common.py:27
Finding: Unrestricted API Base URL Override Can Exfiltrate Credentials and Video Data
Content: View full analysis
dict[str, str]: headers: dict[str, str] = { "Accept": "application/json", "User-Agent": "byted-airesearch-videoeval/0.1", PRODUCT_VERSION_HEADER: PRODUCT_VERSION_VALUE, } resolved_api_key = resolve_api_key(api_key) headers["Authorization"] = f"bearer {resolved_api_key}" return headers def build_url(path: str) -> str: if path.startswith("http://") or path.startswith("https://"): return path return f"{BASE_URL}{path}" ``` The resulting session is used to upload files: ```python session = create_session(api_key) url = build_url(UPLOAD_PATH) with open(file_path, "rb") as file_obj: files = { "file": (os.path.basename(file_path), file_obj, ALLOWED_MIME_TYPE) } response = session.post(url, files=files, timeout=timeout) ``` ### Technical Analysis The environment variable `BYTED_AIRESEARCH_VIDEOEVAL_BASE_URL` controls the destination of every API request. Its value is not validated against an allowlist and is not required to use HTTPS. At the same time, `create_session()` installs the supplied API key into the session-wide `Authorization` header. Consequently, setting the base URL to an attacker-controlled server causes the API key to be sent directly to that server. During submission, the selected video file is also transmitted to the same destin ...[truncated 1638 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/submit_evaluation_task.py:63
Finding: API Key Passed Through Command-Line Arguments Can Leak Through Local Process Metadata and Logs
Content: View full analysis
str: resolved = (api_key or os.getenv(API_KEY_ENV, "")).strip() if resolved: return resolved ``` The documentation encourages direct command-line use: ```bash python scripts/submit_evaluation_task.py \ --file /path/to/video.mp4 \ --prompt "Evaluate this material for audience fit and content quality." \ --api-key "" ``` ### Technical Analysis Command-line arguments are generally not an appropriate channel for long-lived secrets. Depending on the operating system and execution environment, a supplied API key may appear in: - Shell history. - Process listings and process inspection interfaces. - CI/CD command logs. - Terminal session recordings. - Job metadata and debugging output. - Automation or orchestration audit records. Although environment variables are also available, the documentation identifies `--api-key` as a preferred method and demonstrates it in commands. This increases the likelihood that users will expose credentials unintentionally. ### Attack Path 1. A user follows the documented example and runs a command containing `--api-key ""`. 2. The shell records the complete command in its history, or an automation platform logs the invocation. 3. Alternatively, a local user or monitoring process read ...[truncated 874 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes use of network access, environment-based API keys, and script execution, but it does not declare any explicit tool scope or permission boundaries. That creates an authorization and review gap: an agent may invoke broader capabilities than a caller expects, including outbound API calls using sensitive credentials, without a policy-level allowlist constraining behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code opens a local file and uploads it to a remote API via session.post, which is a safety-relevant network transmission of user data. Although the module docstring and CLI description say it uploads a local video, there is no explicit warning, confirmation, or user-facing disclosure near the operation or argument help that the file contents will be sent to a remote service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: VALID_LANGUAGES = ("auto", "zh", "en") enforces a narrow language policy in the CLI. There is no accompanying explanation that this is a region-specific or service-imposed limitation, so it may constitute an undocumented locale constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This code sends the request body to a remote service via session.post, and the body can include user-provided prompt text and attachment IDs. Although the script purpose implies remote task creation, this file itself provides no confirmation prompt or explicit disclosure that these inputs are transmitted off-host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This code fetches task details from a remote API, includes fields such as prompt, result, and filtered detail, and then prints the full payload to stdout. Although the script docstring says it gets task detail, there is no explicit warning or disclosure that potentially sensitive remote task data will be retrieved and displayed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs an HTTP GET using a session built from the provided API key, which transmits authentication material and query metadata over the network. While the CLI help mentions the API key argument, this file does not include a user-facing warning, confirmation, or explanatory comment/docstring about making the remote API request.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.