混元生视频能力

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:43 AM UTC
• Version: 1.0.2

Overview

The skill does what it claims, but its credential handling and unsafe TLS troubleshooting guidance are risky enough to warrant review before use.

Use this only with Tencent credentials scoped to the minimum required API access. Avoid submitting confidential media or internal URLs unless your policy permits Tencent Cloud processing. Do not disable TLS verification, do not print any part of SecretKey, prefer per-session or secret-manager injection over persistent user environment variables, and install the SDK in an isolated environment with a pinned version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25
• Finding: Unpinned Tencent Cloud SDK Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash pip install tencentcloud-sdk-python ``` ### Technical Analysis The installation instruction retrieves the latest available version of `tencentcloud-sdk-python` without enforcing an audited version or validating package hashes. Consequently, the code installed when the instruction is followed can change after the Skill has been reviewed. This does not prove that the current package is malicious. However, it creates a supply-chain risk if the package repository, publisher account, package distribution process, or a future release is compromised. The dependency executes in the same Python environment as the Skill and can access the Tencent Cloud credentials supplied through `TENCENT_SECRET_ID` and `TENCENT_SECRET_KEY`. ### Attack Path 1. An attacker compromises the package publisher, distribution account, or upstream release process. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user follows the documented unpinned installation command. 4. The package manager retrieves and installs the compromised release. 5. Malicious package code executes during installation or import. 6. The compromised dependency accesses Tencent credentials, local files, or network resources with the privileges of the user running the Skill. ### Impact Assessment A compromised dependency could execute arbitrary code under the invoking user's account. It could access the Tencent Cloud credentials required by the Skill, submit unauthorized API requests, read files available to the process, alter generated output, or communicate with external services. The affected scope is limited by the privileges of the Python environment and operating-system user, but those privileges exceed what is necessary merely to install a known, reviewed SDK version. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the SDK to a specifically reviewed version: ```bash pip install "tencentcloud-sdk-python==AUDITED_VERSION" ``` 2. Maintain dependencies in a lock file with cryptographic hashes, such as a hash-locked `requirements.txt`. 3. Install the dependency in an isolated virtual environment rather than a privileged or shared Python environment. 4. Use an internal or controlled package mirror where appropriate. 5. Periodically review and deliberately update the pinned version after checking release notes and package integrity. 6. Run the Skill with Tencent credentials scoped to only the API actions and resources required for video generation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:61
• Finding: Tencent SecretKey Prefix Exposed in Console Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61` **Vulnerability Type**: Partial sensitive credential disclosure **Risk Level**: Low ### Vulnerable Code ```powershell Write-Host "SecretKey: $($env:TENCENT_SECRET_KEY.Substring(0,10))..." ``` ### Technical Analysis The verification instruction prints the first ten characters of `TENCENT_SECRET_KEY`. Although this is not the complete credential, it unnecessarily discloses secret material to the terminal. Terminal output may be retained in CI logs, remote-session recordings, support transcripts, shell capture systems, screenshots, or screen-sharing sessions. Revealing a secret prefix reduces the credential's effective secrecy and gives an attacker information that may assist credential correlation or other attacks. Displaying any portion of the SecretKey is not necessary to verify that the environment variable exists. A boolean configured/not-configured check provides the required functionality with less exposure. ### Attack Path 1. A user follows the documented credential-verification procedure. 2. The first ten characters of the Tencent SecretKey are written to the terminal. 3. The output is retained in a log, screenshot, support transcript, or session recording. 4. An unauthorized observer obtains the partial credential. 5. The observer combines the leaked prefix with other exposed information or uses it to correlate credentials across systems. ### Impact Assessment This finding does not directly expose the complete Tencent SecretKey and does not independently grant Tencent Cloud access. Its immediate impact is partial disclosure of authentication material. The disclosure nevertheless violates secret-handling best practices and can increase the impact of another credential leak. The exposure scope includes anyone able to view or retrieve terminal output and associated logs. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never print any part of `TENCENT_SECRET_KEY`. 2. Replace the command with a presence-only check, for example: ```powershell if ($env:TENCENT_SECRET_KEY) { Write-Host "TENCENT_SECRET_KEY is configured." } else { Write-Host "TENCENT_SECRET_KEY is not configured." } ``` 3. Avoid printing the SecretId unless operationally necessary. 4. Ensure CI systems mask Tencent credential variables. 5. Rotate the SecretKey if its prefix has already been published in broadly accessible logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:209
• Finding: Documentation Recommends Disabling TLS Certificate and Hostname Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:209-212` **Vulnerability Type**: Insecure TLS configuration guidance **Risk Level**: Medium ### Vulnerable Code ```python ssl_context = ssl.create_default_context() ssl_context.check_hostname = False ssl_context.verify_mode = ssl.CERT_NONE ``` ### Technical Analysis The documentation recommends disabling both certificate validation and hostname verification as a workaround for download failures. If this configuration is applied to the downloader, HTTPS no longer authenticates the remote server. Encryption without peer authentication does not prevent an active network attacker from impersonating the download host. The attacker could return arbitrary content in place of the generated video. The current implementation in `scripts/generate.py` uses `urllib.request.urlopen` without the insecure context and therefore retains default TLS verification. The vulnerability is presently contained in the instructions rather than active executable behavior, but users are explicitly encouraged to adopt the unsafe configuration. ### Attack Path 1. A user experiences a certificate validation error. 2. The user applies the workaround documented in `SKILL.md`. 3. Certificate and hostname verification are disabled for video downloads. 4. An attacker with control over a network path, proxy, DNS response, or local trust configuration intercepts the HTTPS request. 5. The attacker presents an arbitrary certificate and impersonates the download server. 6. The attacker supplies manipulated content, which the Skill saves as the generated MP4. ### Impact Assessment An attacker could replace downloaded output with arbitrary data and undermine the integrity and confidentiality of the download connection. The immediate implementation only saves the response as an MP4 and does not execute it, limiting direct code-execution impact. However, a malicious media file could subsequently target vulnerabilities in media players ...[truncated 170 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the recommendation to set `CERT_NONE` or disable hostname verification. 2. Preserve Python's default certificate and hostname validation. 3. Resolve certificate errors by updating the operating system or Python certificate-authority bundle. 4. If a private certificate authority is required, load only that specific trusted CA rather than disabling verification globally. 5. Restrict downloads to HTTPS URLs and consider validating the expected hostname. 6. Where the API provides integrity metadata, verify the downloaded file's digest and expected content type. 7. Impose a maximum response size and stream downloads in bounded chunks. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate.py:253
• Finding: Remote Job Identifier Used as an Unsanitized Output Path Component<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.py:253-269` **Vulnerability Type**: Path traversal through an untrusted path component **Risk Level**: Low ### Vulnerable Code ```python job_id = result.get("JobId") ``` ```python today = datetime.now().strftime("%Y%m%d") output_dir = Path(args.output) / today / job_id output_dir.mkdir(parents=True, exist_ok=True) info_path = output_dir / "info.json" with open(info_path, "w", encoding="utf-8") as f: json.dump(final_result, f, ensure_ascii=False, indent=2) ``` The same derived directory is subsequently used for the downloaded result: ```python video_path = output_dir / f"{args.command}_result.mp4" ``` ### Technical Analysis `job_id` originates in a remote API response and is used directly as a filesystem path component. The code does not verify that the value contains only an expected identifier character set. A value containing `..`, path separators, or an absolute path can cause `pathlib` to resolve the output outside the intended `{output}/{date}/` directory. The code then creates the resulting directory and writes `info.json` and potentially the downloaded video into it. Under normal operation, Tencent Cloud is expected to return a conventional opaque identifier. Exploitation therefore requires a compromised or malicious API response, compromised SDK behavior, or equivalent control over the returned object. This substantially reduces likelihood but does not eliminate the missing trust-boundary validation. ### Attack Path 1. An attacker gains the ability to influence the `JobId` returned to the process, such as through a compromised API account, SDK dependency, or upstream service. 2. The attacker returns a value containing traversal components or an absolute path. 3. The application appends the attacker-controlled value to the configured output path. 4. Path resolution escapes the intended date-specific output directory. 5. The application creates directories and writes `i ...[truncated 709 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `job_id` before using it in a path. Permit only the identifier characters expected from the API, for example: ```python import re if not isinstance(job_id, str) or not re.fullmatch(r"[A-Za-z0-9_-]+", job_id): raise ValueError("Invalid job identifier") ``` 2. Reject empty identifiers, absolute paths, path separators, dot components, and identifiers exceeding a reasonable length. 3. Resolve both the output root and candidate directory, then verify that the candidate remains beneath the root: ```python output_root = (Path(args.output) / today).resolve() output_dir = (output_root / job_id).resolve() if output_dir.parent != output_root: raise ValueError("Job output path escapes the output root") ``` 4. Avoid following symbolic links in security-sensitive output paths where the local environment may be attacker-controlled. 5. Use exclusive file creation or an explicit overwrite policy to prevent unintended replacement of existing files. 6. Treat all API response fields as untrusted data even when received through an authenticated SDK. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill accepts public URLs and local media files for processing by a third-party cloud service but does not clearly warn users that those inputs will be transmitted to Tencent Cloud. This can lead to unintended disclosure of sensitive images, videos, or internal URLs, especially because local files are base64-encoded and uploaded.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to store long-lived cloud credentials in environment variables and even print portions of them during verification, but it lacks strong secret-handling guidance. This increases the risk of credential exposure through shell history, screenshots, logs, shared terminals, or overly broad user-level persistence.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documentation explicitly recommends disabling SSL certificate validation and hostname verification when downloading generated videos. That enables man-in-the-middle interception or content tampering, allowing an attacker on the network path to substitute malicious or altered files while the client believes they came from Tencent Cloud.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code accesses sensitive credentials via TENCENT_SECRET_ID and TENCENT_SECRET_KEY. Although the docstring explains how to set them, it does not disclose that the script will consume these secrets at runtime or provide a clear warning about handling credentialed API access.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The script downloads a URL returned by a remote API and writes the response directly to a local file without validating the destination content type, size, or trust boundary of the URL. In this skill context, the file path is fixed under the output directory, so arbitrary path overwrite is not present, but a compromised or unexpected upstream service could cause users to fetch untrusted content, very large files, or internal-network targets if non-public URLs are returned.

Static analysis

No suspicious patterns detected.