Byted Las Vlm Video

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.1

Overview

The skill fits its video-analysis purpose, but it automatically installs remote SDK code and includes unsafe environment-file handling that warrant review before use.

Install only if you are comfortable with the skill creating or reusing a Python virtual environment, installing a Volcengine SDK from a remote URL, uploading videos/results to Volcengine LAS, and using LAS credentials. Prefer reviewing or replacing the auto-update step with a pinned, hash-verified dependency install, and do not run the polling helper in workspaces where .env files may be untrusted.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/env_init.sh:30
• Finding: Unverified Remote SDK Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/env_init.sh:30-40` **Vulnerability Type**: Unverified remote dependency installation **Risk Level**: High ### Vulnerable Code ```bash manifest_url="https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/manifest.json" manifest=$(curl -sf "$manifest_url" || echo '{}') ``` ```bash pip install --quiet --upgrade https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/las_sdk-0.2.0-py3-none-any.whl ``` ### Technical Analysis The mandatory environment initialization workflow retrieves metadata from a remote endpoint and installs a remotely hosted Python wheel. The wheel is installed without validating a cryptographic hash, package signature, trusted publisher identity, or immutable artifact digest. Although the URL uses HTTPS, transport encryption does not establish that the downloaded artifact is the exact package reviewed with this skill. The effective code executed by the skill can therefore change after the package itself has been audited. Python package installation may execute package-controlled installation behavior, and subsequently invoking `lasutil` executes code from the installed package. The remote manifest also affects whether the installation branch is entered. If manifest retrieval fails, the script substitutes an empty JSON object, causing `remote_ver` to become `unknown`; this can still make the local and remote versions differ and trigger installation. ### Attack Path 1. An attacker compromises the remote storage account, publication pipeline, artifact, or another component in the remote dependency delivery chain. 2. The attacker replaces the wheel at the hard-coded URL with a malicious package. 3. A user or agent follows the documented initialization procedure and sources `scripts/env_init.sh`. 4. The script invokes `pip install` against the mutable remote URL without checking an expected d ...[truncated 846 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the SDK artifact to an immutable version and a documented SHA-256 digest. 2. Download the wheel to a temporary file, calculate its digest, and abort unless it exactly matches the expected value. 3. Verify a trusted publisher signature in addition to the digest where supported. 4. Store dependency versions and hashes in a reviewed lock file, such as a requirements file used with `pip --require-hashes`. 5. Do not allow a mutable remote manifest to trigger installation automatically. 6. Require explicit user approval before installing or upgrading executable dependencies. 7. Fail closed when the manifest cannot be fetched or parsed rather than treating an empty response as an update condition. 8. Install with the minimum required privileges in an isolated virtual environment. 9. Restrict access to credentials while dependency installation occurs and audit the provenance of the SDK release pipeline. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/poll_background.sh:20
• Finding: Arbitrary Shell Execution Through Sourced Environment File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/poll_background.sh:20-24` **Vulnerability Type**: Unsafe execution of configuration as shell code **Risk Level**: Medium ### Vulnerable Code ```bash if [ -f "${PROJECT_ROOT}/.env" ]; then source "${PROJECT_ROOT}/.env" export LAS_API_KEY LAS_REGION fi ``` ### Technical Analysis The script loads `.env` with the Bash `source` built-in. A dotenv file is expected to contain configuration data, but `source` interprets its entire contents as shell syntax. Consequently, command substitutions, function calls, redirections, external commands, and arbitrary shell statements in the file execute immediately. The later `export` statement does not constrain what was executed while sourcing the file. An attacker does not need to manipulate `LAS_API_KEY` or `LAS_REGION`; any valid shell command inserted into `.env` is sufficient. Exploitation requires an attacker or untrusted process to be able to create or modify the `.env` file at the computed project root. This may occur through a shared workspace, an untrusted archive, another vulnerable development tool, or incorrectly permissive file ownership and permissions. ### Attack Path 1. An attacker obtains write access to the project-root `.env` file or supplies a project containing a malicious `.env`. 2. The attacker inserts shell syntax, such as command substitution or a direct external command. 3. The user starts `scripts/poll_background.sh` to poll a video-processing task. 4. The script detects the file and executes it with `source`. 5. The injected commands run before polling begins, using the privileges and environment of the agent process. ### Impact Assessment Successful exploitation results in arbitrary command execution as the account running the polling script. The attacker could access files and environment variables available to that account, including LAS credentials; alter polling results and project outputs; invoke network services; or mod ...[truncated 254 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not load dotenv configuration with `source`, `.`, or `eval`. 2. Parse the file as data using a dotenv parser that does not execute shell syntax. 3. Allow only the required keys, specifically `LAS_API_KEY` and `LAS_REGION`. 4. Reject malformed lines, command substitutions, shell metacharacters, unexpected keys, and duplicate assignments. 5. Verify that the file is a regular file, is owned by the expected user, and is not writable by group or other users. 6. Avoid following symbolic links when opening security-sensitive configuration. 7. Prefer credentials supplied by a dedicated secret manager or inherited environment variables. 8. Document the expected file location and enforce restrictive permissions such as mode `0600`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is presented as a video-analysis wrapper, but its documented behavior includes environment bootstrapping, package installation/upgrade, manifest fetching, and other remote/networked setup actions not disclosed in the top-level purpose. Hidden or under-described execution behavior is dangerous because it can expand the attack surface to supply-chain compromise, unreviewed code download, and unexpected host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a video-analysis wrapper, but its documented behavior includes environment bootstrapping, package installation/upgrade, manifest fetching, and other remote/networked setup actions not disclosed in the top-level purpose. Hidden or under-described execution behavior is dangerous because it can expand the attack surface to supply-chain compromise, unreviewed code download, and unexpected host modification.

Credential Access

High

• Category: Privilege Escalation

Content

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"

if [ -f "${PROJECT_ROOT}/.env" ]; then
  source "${PROJECT_ROOT}/.env"
  export LAS_API_KEY LAS_REGION
fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"

if [ -f "${PROJECT_ROOT}/.env" ]; then
  source "${PROJECT_ROOT}/.env"
  export LAS_API_KEY LAS_REGION
fi

• Confidence: 91% confidence
• Finding: Using source on a .env file executes its contents as shell code, not just environment assignments. If an attacker can modify .env, they can achieve arbitrary code execution when this polling script runs, potentially inheriting the script's environment and any accessible secrets. This is more dangerous in an automation skill because the script may run unattended in CI, agent, or service contexts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to run shell commands (`source`, `ffprobe`, `lasutil`, file writes/uploads) but does not declare any explicit tool scope or allowed-tools boundary. This creates an authorization gap where a reviewer or runtime may underestimate the skill’s execution and network capabilities, increasing the chance of unintended command execution or data movement.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The result-handling instructions conflict with the earlier execution path and expected response schema, which can cause downstream parsing of the wrong fields or files. In a shell-capable skill, inconsistent output assumptions can lead to accidental disclosure, overwriting unrelated files, failed safety checks, or operators trusting incomplete/incorrect results.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script performs a remote manifest fetch and conditionally installs a package from a network URL during environment initialization, even though the skill's stated purpose is video analysis rather than software bootstrap or self-update. This expands the trust boundary to external infrastructure and creates a supply-chain risk: a compromised endpoint, manipulated manifest, or unexpected wheel change could cause unreviewed code to be installed and executed in the operator's environment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script automatically runs pip install --upgrade against a remote wheel URL without prior warning or confirmation. Installing executable Python packages during setup can execute attacker-controlled code via package contents or dependency hooks, making this a direct supply-chain execution risk, especially because it occurs implicitly as part of sourcing the script.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script sources a project .env file and exports LAS_API_KEY and LAS_REGION, which is access to sensitive credentials. While there is an internal comment about loading the environment, there is no user-facing warning, confirmation, or explicit disclosure that credentials will be read and used.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The checklist defines Step 4 as '结果呈现' at L42-L43, but the later section heading is '### Step 5: 结果呈现' at L118. This is an active contradiction in the skill's own operating instructions, not merely missing detail, and could cause an agent to skip or misreport required execution stages.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This shell script contains its title, error text, and status messages in Chinese only, which imposes a specific language on users. The file does not provide any opt-in, fallback, or documentation indicating that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The script's comments, usage guidance, and runtime status/error messages are all presented in Chinese, with no opt-in or alternative language path. This is a natural-language locale constraint that may violate organizational language policy when not explicitly justified or made configurable.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The file contains user-visible error text and operational comments in Chinese, with no indication that language selection is optional or region-specific. This can violate a language/locale policy when a skill imposes one language without user opt-in or documented justification.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: This file presents itself as a background polling helper for checking task status, but it also sources the project .env file and exports LAS_API_KEY/LAS_REGION. Reading credentials is not obviously required for a narrowly described local poll-loop script, and is a broader capability than simple status checking logic.

Static analysis

No suspicious patterns detected.