Tomoviee Reference to Image

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:21 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent Tomoviee image-to-image API client, but it needs review because it exposes reusable API credentials through command-line arguments and printed output.

Review before installing or using in an agent environment. Avoid the token helper as written, do not pass real app secrets on the command line, do not let agents print Authorization tokens, and only submit image URLs, prompts, callbacks, and params that you are comfortable sending to Tomoviee/Wondershare.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_auth_token.py:27

Finding

Reversible API Credentials Exposed Through Process Arguments and Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_auth_token.py, lines 27–28 and 38–42
Vulnerability Type: Credential exposure through command-line arguments and stdout
Risk Level: Medium

Vulnerable Code:

python

credentials = f"{app_key}:{app_secret}"
access_token = base64.b64encode(credentials.encode()).decode()

python

app_key = sys.argv[1]
app_secret = sys.argv[2]

token = generate_access_token(app_key, app_secret)
print(f"Access Token: {token}")
print(f"\nUse in Authorization header as: Basic {token}")

Technical Analysis

The helper accepts the application secret as a command-line argument and prints a Base64 representation of app_key:app_secret to standard output. Base64 is an encoding mechanism, not encryption; the resulting Basic-auth token can be decoded trivially or reused directly in an HTTP Authorization header.

Supplying the secret through sys.argv can expose it through shell history, process inspection, command logging, automation logs, or Agent execution records. Printing the generated token creates an additional disclosure channel because stdout may be retained by terminals, CI systems, orchestration platforms, or Agent transcripts.

This behavior is especially significant because SKILL.md documents use of this helper while also stating that credentials remain only in process memory. Process arguments and printed output can leave externally observable or persistent records, so the implementation does not fully satisfy that claim.

The equivalent Base64 construction in scripts/tomoviee_img2img_client.py is not independently considered a vulnerability: that client uses the token internally in the required Basic-auth header and sends it only to the declared HTTPS API host. The confirmed issue is the helper's explicit exposure of the secret-derived token and its collection of the secret through command-line arguments.

Attack Path

1. A user or Age ...[truncated 1485 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the helper's printing of the complete Basic-auth token. Authentication headers should be constructed and used internally by the API client.
2. Do not accept app_secret through ordinary command-line arguments. Read it from an interactive getpass.getpass() prompt, a protected secret manager, or a narrowly scoped environment-based secret injection mechanism.
3. If an environment variable is supported, document that it must not be committed, echoed, or included in diagnostic output. Prefer a platform secret store for automated deployments.
4. Redact Authorization headers, application secrets, and generated tokens from exceptions, debug logs, telemetry, and Agent responses.
5. Update SKILL.md so its quick-start instructions use a non-echoing credential flow and accurately describe every location where credentials may be exposed.
6. Rotate any application credentials previously processed in environments where command history or stdout may have been retained.
7. Where supported by the provider, apply least-privilege scopes, usage limits, expiration, and credential rotation to reduce the impact of future disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description claims full image-to-image generation capability, but the described artifacts appear to primarily cover authentication/token generation rather than the advertised image transformation workflow. This mismatch is dangerous because reviewers and users may authorize the skill under false assumptions, while hidden or undeclared behavior involving credentials can create opportunities for abuse, over-privilege, or supply-chain style deception.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_auth_token.py (reported line 18)May include surrounding context.

python

def generate_access_token(app_key: str, app_secret: str) -> str:
    """
    Generate access token for Tomoviee API authentication.
    
    Args:
        app_key: Application key from Tomoviee console

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The script prints the generated Basic authentication token directly to stdout, which exposes reusable credentials in terminals, logs, CI/CD output, screen recordings, and shell transcripts. In this skill's context, the token is intended for authenticating to the Wondershare/Tomoviee API gateway, so disclosure could allow unauthorized API use and abuse of the linked account.

Content

Scanner excerpt · scripts/generate_auth_token.py (reported line 41)May include surrounding context.

python

app_secret = sys.argv[2]
    
    token = generate_access_token(app_key, app_secret)
    print(f"Access Token: {token}")
    print(f"\nUse in Authorization header as: Basic {token}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares network-relevant behavior and external API usage but does not specify any explicit tool scope such as allowed hosts or permissions. In an agent environment, missing scope declarations can allow broader-than-intended network access or make review and enforcement of outbound connections harder, increasing the risk of data exfiltration or misuse if the implementation changes or is swapped behind the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The reference explicitly documents user-supplied reference_image URLs and optional callback/params fields for transmission to an external service, but it does not warn that user content and callback data leave the local system and are sent to openapi.wondershare.cc. This can lead to unintentional disclosure of sensitive image content, internal URLs, or callback metadata, especially in agent contexts where users may assume processing is local or not understand the data flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script instructs users to pass the app key and app secret as command-line arguments and then prints the derived Basic auth token to stdout. Command-line arguments can be exposed through shell history, process listings, CI logs, and terminal capture, while stdout may also be logged or copied unintentionally, making credential disclosure more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The client accepts an app key and app secret, derives a Basic Authorization value, and transmits those credentials to the external API without any in-code warning or safeguards around secret handling. While using credentials is expected for API access, the lack of guidance increases the risk of unsafe storage, accidental logging, or misuse by integrators.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This client sends user prompts and image references to a third-party external service, which can expose sensitive user content, private URLs, or proprietary images if callers are unaware of the disclosure. In a skill that processes user-supplied images and prompts, the absence of any user-facing notice or consent mechanism increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'task_id' from requests.post (line 55, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/tomoviee_img2img_client.py (reported line 124)May include surrounding context.

python

return self._make_request(payload)

    def get_result(self, task_id: str) -> Dict[str, Any]:
        response = requests.post(
            self.RESULT_ENDPOINT,
            headers=self._get_headers(),
            json={"task_id": task_id},

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is only range-pinned (requests>=2.31.0,<3.0.0), so the actual installed version may vary by environment and could resolve to a release affected by one or more known advisories. In a network-facing skill that sends data to an external API, this uncertainty increases supply-chain and transport-layer risk, including possible credential leakage or use of a vulnerable HTTP client version.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.