Tomoviee Image Redraw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:21 AM UTC
• Version: 1.0.2

Overview

The skill appears to provide the advertised Tomoviee image redrawing client, but its credential workflow can expose reusable API secrets in command lines and terminal output.

Review before installing. The image-redrawing functionality and external endpoints are coherent, and I did not find destructive behavior, persistence, local credential-file harvesting, or hidden execution. Treat Tomoviee app keys, app secrets, and generated Basic tokens as secrets: avoid running the documented token helper in shared terminals, CI logs, or agent transcripts, and prefer a safer credential flow. Do not submit sensitive images, masks, prompts, or untrusted callback URLs unless you are comfortable sending them to the Tomoviee/Wondershare service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_auth_token.py:36

Finding

Application Secret Exposure Through Command-Line Arguments and Reversible Token Output

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/generate_auth_token.py:36-42
• scripts/tomoviee_redrawing_client.py:137-140
• SKILL.md:36-38

Vulnerability Type: Sensitive credential exposure through process arguments and standard output
Risk Level: Medium

Vulnerable Code

scripts/generate_auth_token.py:36-42:

python

app_key = sys.argv[1]
app_secret = sys.argv[2]

token = generate_access_token(app_key, app_secret)
print(f"Access Token: {token}")
print(f"\nUse in Authorization header as: Basic {token}")

scripts/tomoviee_redrawing_client.py:137-140:

python

app_key = sys.argv[1]
app_secret = sys.argv[2]
prompt = sys.argv[3]
init_image = sys.argv[4]

SKILL.md:36-38:

bash

python scripts/generate_auth_token.py YOUR_APP_KEY YOUR_APP_SECRET

Technical Analysis

The documented authentication workflow requires users to provide the application secret as a command-line argument. Command-line arguments may be retained in shell history and exposed through process listings, operating-system auditing, orchestration telemetry, debugging tools, or CI/CD logs.

The token helper then prints base64(app_key:app_secret) to standard output. Base64 is a reversible encoding and provides no confidentiality. Anyone who obtains the printed token can decode it to recover both credential components or use it directly as an HTTP Basic Authorization value.

The Base64 operation inside scripts/tomoviee_redrawing_client.py:24-32 is not independently malicious: it constructs the documented HTTP Basic credential in memory and sends it over HTTPS only to openapi.wondershare.cc. The vulnerability arises from accepting secrets through process-visible arguments and explicitly printing the reusable credential in the standalone helper.

Attack Path

1. A user follows the authentication command documented in SKILL.md.
2. The application secret is placed in the command ...[truncated 1224 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not accept application secrets as positional command-line arguments.
2. Read the secret from a protected secret manager, a narrowly scoped environment variable, or an interactive non-echoing prompt such as getpass.getpass().
3. Do not print the Base64 credential or any reusable Authorization value to standard output.
4. Construct the Authorization header only in memory immediately before making the request.
5. Update SKILL.md to document a secure credential-loading workflow rather than embedding secrets in commands.
6. Ensure application logs, exceptions, Agent transcripts, and debugging output redact Authorization headers, application secrets, and encoded credentials.
7. Configure CI/CD systems to use masked secret variables and prevent command echoing.
8. Rotate any application credentials that may previously have appeared in process arguments, shell history, logs, or Agent output.
9. Where supported by the provider, replace long-lived Basic credentials with short-lived, scoped access tokens.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description claims image-redrawing behavior, but the analyzed content appears to center on authentication/token generation and provides no evidence in this file of the claimed redrawing implementation. This mismatch is dangerous because reviewers and users may authorize the skill for one purpose while hidden or adjacent code handles credentials or performs different actions, increasing the risk of misuse, secret exposure, or policy bypass.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_auth_token.py (reported line 18)May include surrounding context.

python

def generate_access_token(app_key: str, app_secret: str) -> str:
    """
    Generate access token for Tomoviee API authentication.
    
    Args:
        app_key: Application key from Tomoviee console

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The script prints the generated authorization token directly to stdout. Even though the code is not malicious, exposing a valid Basic auth token increases the risk of credential leakage through console logs, CI/CD output, terminal scrollback, shell recording, or accidental copy/paste disclosure.

Content

Scanner excerpt · scripts/generate_auth_token.py (reported line 41)May include surrounding context.

python

app_secret = sys.argv[2]
    
    token = generate_access_token(app_key, app_secret)
    print(f"Access Token: {token}")
    print(f"\nUse in Authorization header as: Basic {token}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents network access to external endpoints but does not declare any explicit tool scope such as permissions or allowed-tools. In agent environments, undeclared network capability weakens policy enforcement and review, making it easier for a skill to exfiltrate data or contact unintended services without clear operator consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown instructs use of external URLs for source images, masks, polling, and optional callbacks without warning that user-provided images and callback destinations are sent to a third-party service. This creates a real privacy and data-governance risk because users may unknowingly expose sensitive images or metadata to Wondershare/Tomoviee infrastructure and potentially to attacker-controlled callback endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script takes an app key and secret on the command line and then prints the resulting Basic auth token to stdout. Command-line arguments and terminal output can be exposed through shell history, process listings, logs, CI job output, or screen recording, which can disclose long-lived credentials or a reusable authentication token.

Content

No source excerpt is available for this finding.

Tainted flow: 'task_id' from requests.post (line 55, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/tomoviee_redrawing_client.py (reported line 91)May include surrounding context.

python

return self._make_request(payload)

    def get_result(self, task_id: str) -> Dict[str, Any]:
        response = requests.post(
            self.RESULT_ENDPOINT,
            headers=self._get_headers(),
            json={"task_id": task_id},

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The document describes the skill’s capability and endpoints but does not define clear invocation boundaries or trigger conditions. In an agent setting, ambiguous activation scope can cause the skill to be used in broader contexts than intended, increasing the chance of unnecessary third-party image submission or misuse for unreviewed image-editing requests.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification allows any requests release from 2.31.0 up to but not including 3.0.0, which leaves resolution dependent on install time and environment. Because multiple advisories exist in the requests package, not pinning to a known-safe version makes it impossible to verify that deployments avoid vulnerable releases, creating supply-chain and patch-regression risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.