T09 · Insecure Skill Coding Practices
Error
- Location
config.json:1- Finding
Hardcoded Jimeng Session Credential in Project Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Jimeng Ai
Security checks for vulnerabilities and agentic risk
Overview
The skill is an image-generation proxy, but it ships and persists a real-looking Jimeng session credential and exposes the local API more broadly than its documentation suggests.
Review before installing. Replace and rotate any bundled Jimeng session, do not put your sessionid on the command line, restrict the service to 127.0.0.1 with trusted CORS/auth controls, and update vulnerable dependencies before exposing it to any network.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/jimeng.py:21- Finding
Plaintext Session Storage and Exposure Through Command-Line Arguments
- Content
View full analysis
") sys.exit(1) update_session(sys.argv[2]) ``` ### Technical Analysis The update mechanism accepts a reusable session credential through `sys.argv` and persists it in plaintext. Command-line arguments can be retained in shell history and may be visible to process-inspection or monitoring facilities while the command is running. The resulting configuration file relies on inherited filesystem permissions rather than explicitly restricting access to the owning user. Although the script prints only credential prefixes, even partial credential output is unnecessary and can complicate log hygiene. The combined behavior increases the number of places where the credential may be disclosed: process metadata, command history, terminal capture, project files, backups, and repository tool ...[truncated 1024 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
configs/dev/service.yml:1- Finding
Local API Service Binds to All Network Interfaces with Unrestricted CORS
- Content
View full analysis
{ if(host === "0.0.0.0" || host === "localhost" || host === "127.0.0.1") return resolve(null); this.app.listen(port, "localhost", err => { if(err) return reject(err); resolve(null); }); }), new Promise((resolve, reject) => { this.app.listen(port, host, err => { if(err) return reject(err); resolve(null); }); }) ]); logger.success(`Server listening on port ${port} (${host})`); } ``` ### Technical Analysis The Skill documentation and Python wrapper use `127.0.0.1`, indicating that the intended workflow is a local service. However, the actual Node.js service binds to `0.0.0.0`, making it reachable through every available interface unless an external firewall prevents access. The application also enables permissive CORS. The generation routes accept Jimeng session tokens supplied in request authorization headers, but there is no separate service-level authentication, client allowlist, or rate limiting visible in the reviewed path. Consequentl ...[truncated 1599 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (118)
Known Vulnerable Dependency: form-data==4.0.0 — 2 advisory(ies): CVE-2025-7783 (form-data uses unsafe random function in form-data for choosing boundary); CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)
Critical
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
form-data 4.0.0 is a direct runtime dependency and the listed advisories include CRLF injection and weak randomness for multipart boundaries. In a service that uploads images or forwards multipart requests to upstream AI endpoints, malformed field names or predictable boundaries can enable request manipulation, parser confusion, or credential-bearing request corruption.
- Content
Known Vulnerable Dependency: koa==2.15.3 — 4 advisory(ies): CVE-2025-25200 (Inefficient Regular Expression Complexity in koa); CVE-2026-27959 (Koa has Host Header Injection via ctx.hostname); CVE-2025-8129 (Koa Open Redirect via Referrer Header (User-Controlled)) +1 more
Critical
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
koa 2.15.3 is the core runtime web framework for this skill, so host-header injection, open redirect, and regex-complexity issues directly affect the externally reachable API surface. Because this service likely accepts user requests for image generation and file handling, framework-level request parsing and header handling bugs are highly relevant and can lead to denial of service, cache poisoning, redirect abuse, or trust-boundary failures.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Enumerating local IPv4/MAC addresses, scheduling cron jobs, fetching arbitrary remote files, and converting them to base64 are unrelated to the declared image-generation purpose and strongly increase suspicion. In this skill context, such host-enumeration and persistence-oriented capabilities suggest possible reconnaissance, persistence, or data-staging behavior hidden behind a benign-looking AI tool.
- Content
Known Vulnerable Dependency: axios==1.7.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The project includes axios 1.7.2, and the reported advisories include SSRF-related and prototype-pollution-adjacent issues that are relevant for a network-facing image-generation API skill. Because this skill likely fetches remote resources and interacts with external services, a vulnerable HTTP client increases the risk of request smuggling, proxy bypass, credential leakage, or attacker-controlled outbound requests.
- Content
Known Vulnerable Dependency: brace-expansion==2.0.1 — 5 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +2 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: cross-spawn==7.0.3 — 1 advisory(ies): CVE-2024-21538 (Regular Expression Denial of Service (ReDoS) in cross-spawn)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: glob==10.4.5 — 1 advisory(ies): CVE-2025-64756 (glob CLI: Command injection via -c/--cmd executes matches with shell:true)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: lodash==4.17.21 — 3 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names); CVE-2025-13465 (Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
lodash is a direct runtime dependency, and its historic and newly reported prototype-pollution and template/code-injection issues can become exploitable when user-controlled object paths or template strings are passed into helper functions. The lockfile alone does not prove exploitability, but this is a real risky dependency in a networked service that may transform user request objects.
- Content
Known Vulnerable Dependency: minimatch==9.0.5 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Static analysis
No suspicious patterns detected.