Security audit

AI电商专家｜音频参考生成视频

Security checks for vulnerabilities and agentic risk

Overview

The skill’s video workflow is understandable, but it needs Review because it runs a mutable npm MCP client with the user’s token and full environment, and the helper can call broader MCP tools than the named workflow.

Review before installing. Use only with a dedicated, low-privilege IMIVA token in an environment that does not contain unrelated secrets, prefer a pinned reviewed npm version, avoid generic API_URL overrides, and confirm any credit-consuming task before submission.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning

Location: scripts/imiva_mcp.py:14
Finding: Runtime Retrieval and Execution of an Unpinned npm Package
Content: View full analysis
dict: npx, token = require_runtime() env = os.environ.copy() env["MCP_TOKEN"] = token env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL)) proc = subprocess.Popen( [npx, "-y", PACKAGE], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1, env=env, ) ``` The same mutable dependency is recommended by the example configuration: ```json { "mcpServers": { "imiva-ecommerce": { "command": "npx", "args": [ "-y", "@infimind/ecom-content-cli@latest" ], "env": { "MCP_TOKEN": "your-token-here", "API_URL": "https://imiva.ecpro.com" } } } } ``` ### Technical Analysis The helper invokes `npx -y @infimind/ecom-content-cli@latest`. This retrieves and executes the package version currently associated with the mutable npm `latest` tag. Consequently, the code executed in a future invocation is not necessarily the code that existed when this Skill was audited. The `-y` option automatically accepts package installation, eliminating an interactive review opportunity. There is no exact version pin, lockfile, package integrity hash, vendored dependency, or verification step. This creates both a remote payload mutability risk and a software supply-chain weakness. The issue does not establish that the current package is malicious. The vulnerability is that a compromi ...[truncated 1538 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imiva_mcp.py:48
Finding: Complete Parent Environment Exposed to an External Child Process
Content: View full analysis
dict: npx, token = require_runtime() env = os.environ.copy() env["MCP_TOKEN"] = token env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL)) proc = subprocess.Popen( [npx, "-y", PACKAGE], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1, env=env, ) ``` ### Technical Analysis `os.environ.copy()` copies every variable from the parent process into the environment of the npm child process. The child only needs a limited runtime environment and the IMIVA-specific configuration, but it may also receive unrelated cloud credentials, source-control tokens, CI secrets, database passwords, agent configuration, proxy credentials, and API keys. Because the child is a remotely retrieved third-party package, unnecessarily exposing the complete environment substantially increases the consequences of a dependency compromise. This violates least-exposure principles even when the dependency is legitimate. ### Attack Path 1. A user or automated agent runs the helper from an environment containing unrelated secrets. 2. `os.environ.copy()` copies all those secrets into the child process environment. 3. The npm package executes with access to the copied variables. 4. A malicious or compromised package enumerates its environment. 5. The package sends discovered credentials to an external service or uses them directly. 6. The attacker accesses services associated with the exposed credentials, subject to their permissions. ### Impact Assessment The exposed privileges depend on which environment variables are present. Potential impact includes: - Compro ...[truncated 421 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/imiva_mcp.py:48
Finding: Authenticated API Endpoint Can Be Redirected Through Ambient Environment Variables
Content: View full analysis
dict: npx, token = require_runtime() env = os.environ.copy() env["MCP_TOKEN"] = token env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL)) ``` ### Technical Analysis The helper accepts `IMIVA_API_URL` or the generic `API_URL` variable from the ambient process environment without validating the URL scheme or hostname. At the same time, it supplies the real `MCP_TOKEN` to the child process. An attacker who can influence the process environment can redirect the client away from the documented `https://imiva.ecpro.com` service. Use of the generic `API_URL` fallback also creates a risk of accidental redirection when another application defines that common variable name. Whether the token is transmitted directly to the configured endpoint depends on the behavior of the external MCP package. Nevertheless, the helper combines an authentication secret with an unvalidated, attacker-influenceable service endpoint, creating a credible credential-redirection risk. ### Attack Path 1. An attacker, compromised wrapper script, contaminated shell profile, or CI configuration sets `IMIVA_API_URL` or `API_URL` to an attacker-controlled address. 2. The user invokes `scripts/imiva_mcp.py` with a valid `MCP_TOKEN`. 3. The helper assigns the attacker-controlled address to the child process's `API_URL`. 4. The npm MCP client connects to the substituted endpoint. 5. If the client sends the token or authentication-derived information to that endpoint, the attacker captures it. 6. The attacker reuses the token against IMIVA, subject to the token's permissions and validity. A non-HTTPS endpoint could additionally expose authenticated traffic to network in ...[truncated 520 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a dedicated audio-reference video generator, but its documented behavior includes listing all tools and invoking MCP tools through a generic dispatcher. That mismatch is dangerous because users and orchestrators may grant trust or permissions appropriate for a narrow media-generation skill while the implementation can enumerate and access a broader tool surface tied to the same token.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/imiva_mcp.py (reported line 51)May include surrounding context.
python
def invoke(method: str, params: dict | None = None) -> dict: npx, token = require_runtime() env = os.environ.copy() env["MCP_TOKEN"] = token env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL)) proc = subprocess.Popen(

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill exposes shell, environment-variable, and file-read capabilities without declaring a restrictive tool scope such as allowed-tools or permissions. In context, the document also instructs use of a generic local helper script and local files, which increases the chance that a model using this skill could access broader local resources or invoke unintended operations beyond the advertised workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script emits all runtime error messages in Chinese, such as when npx or MCP_TOKEN is missing. This imposes a specific language on users without opt-in, which matches the policy category for language/locale violations.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/imiva_mcp.py (reported line 54)May include surrounding context.
python
env = os.environ.copy() env["MCP_TOKEN"] = token env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL)) proc = subprocess.Popen( [npx, "-y", PACKAGE], stdin=subprocess.PIPE, stdout=subprocess.PIPE,

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The metadata explicitly fixes the skill language to zh-CN, and the body further states it is especially suitable for Chinese users. Under the policy, forcing a specific language without user choice can be a natural-language locale policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.