T08 · Insecure Dependencies
Warning
- Location
SKILL.md:25- Finding
Unpinned Tencent Cloud SDK Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
混元生视频能力
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but its credential handling and unsafe TLS troubleshooting guidance are risky enough to warrant review before use.
Use this only with Tencent credentials scoped to the minimum required API access. Avoid submitting confidential media or internal URLs unless your policy permits Tencent Cloud processing. Do not disable TLS verification, do not print any part of SecretKey, prefer per-session or secret-manager injection over persistent user environment variables, and install the SDK in an isolated environment with a pinned version.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:61- Finding
Tencent SecretKey Prefix Exposed in Console Output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:209- Finding
Documentation Recommends Disabling TLS Certificate and Hostname Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/generate.py:253- Finding
Remote Job Identifier Used as an Unsanitized Output Path Component
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill accepts public URLs and local media files for processing by a third-party cloud service but does not clearly warn users that those inputs will be transmitted to Tencent Cloud. This can lead to unintended disclosure of sensitive images, videos, or internal URLs, especially because local files are base64-encoded and uploaded.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs users to store long-lived cloud credentials in environment variables and even print portions of them during verification, but it lacks strong secret-handling guidance. This increases the risk of credential exposure through shell history, screenshots, logs, shared terminals, or overly broad user-level persistence.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation explicitly recommends disabling SSL certificate validation and hostname verification when downloading generated videos. That enables man-in-the-middle interception or content tampering, allowing an attacker on the network path to substitute malicious or altered files while the client believes they came from Tencent Cloud.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code accesses sensitive credentials via TENCENT_SECRET_ID and TENCENT_SECRET_KEY. Although the docstring explains how to set them, it does not disclose that the script will consume these secrets at runtime or provide a clear warning about handling credentialed API access.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The script downloads a URL returned by a remote API and writes the response directly to a local file without validating the destination content type, size, or trust boundary of the URL. In this skill context, the file path is fixed under the output directory, so arbitrary path overwrite is not present, but a compromised or unexpected upstream service could cause users to fetch untrusted content, very large files, or internal-network targets if non-public URLs are returned.
- Content