T09 · Insecure Skill Coding Practices
Error
- Location
scripts/client.js:7- Finding
Bearer Credential Disclosure Through Unvalidated Proxy URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Sora2 Video
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its video-generation purpose, but it sends a sensitive bearer token to proxy URLs from configuration without validating that those destinations are trusted HTTPS endpoints.
Install only if AIZNT_PROXY_URLS is supplied by a trusted Tianshu/TsClaw source and points to HTTPS endpoints you trust. Treat TS_TOKEN as a sensitive credential, rotate it if exposed, and avoid running this skill with proxy URL configuration that other users or untrusted skills can modify.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
代码整体与“通过代理提交视频生成任务并获取结果”这一用途基本一致：它加载客户端配置与 token，向视频生成端点提交请求，并根据 task id 查询结果。未发现明显越权、无关资源访问或隐藏能力。唯一实质性不一致在于描述明确提到“轮询结果”，但代码没有循环、重试、等待或持续查询机制，只提供一次性的
fetch命令。因此描述对结果获取方式有夸大，属于轻度但明确的行为不匹配。- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares use of environment variables and network access but does not explicitly constrain or document tool scope via permissions or allowed-tools. In a skill that handles bearer tokens and performs outbound requests, this increases the attack surface and makes it harder for a host system or reviewer to enforce least privilege.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation instructs the skill to send a Bearer token through proxy URLs but does not provide an explicit warning about token sensitivity, proxy trust boundaries, logging risk, or endpoint validation. Because the token is an authentication credential and all traffic is routed through proxy URLs supplied from environment configuration, misuse or misconfiguration could expose the token to unintended intermediaries and enable account or API abuse.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The tagline is presented in Chinese ("Sora2 文生视频") while the description is in English, but the manifest does not explain whether the skill is intended for a specific locale or how language is selected. This can create an implicit language policy or user experience constraint without explicit opt-in or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This code reads the sensitive environment variables TS_TOKEN and AIZNT_PROXY_URLS, but the only disclosure is an internal Chinese comment and thrown error messages for missing values. There is no user-facing warning, confirmation, or explicit documentation in this file that the skill accesses credentials or proxy configuration from the environment.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The fetchJson helper makes outbound HTTP requests and may transmit authentication headers or other user/system data via the provided options, but this file contains no user-facing warning, confirmation, or descriptive documentation about that network behavior. For a general-purpose client helper, that omission can reduce transparency about external data transmission.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file contains user-facing text exclusively in Chinese, including validation errors and the usage/help output. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction, which matches the natural-language locale policy concern.
- Content