T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:93- Finding
API Bearer Credential Disclosure Through an Unrestricted Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Happy Horse 视频生成
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its AI video-generation purpose, but it needs review because it can send an API key to a configurable server and its activation wording is very broad.
Install only if you are comfortable sending prompts and referenced media to AI Hive and saving generated outputs locally. Do not set --base-url, AI_HIVE_BASE_URL, or config base_url to an untrusted host, because the skill sends the AI Hive bearer key with API requests. Prefer a dedicated low-privilege API key, monitor account usage, and use a pinned dependency environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:240- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and verify cryptographic hashes for all direct and transitive packages, then install with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Use a lock-generation tool such as `pip-tools` to produce a fully resolved dependency graph. 4. Install dependencies inside a dedicated virtual environment rather than a shared or system Python environment. 5. Define a trusted package index explicitly and avoid uncontrolled additional indexes. 6. Add automated dependency vulnerability scanning and periodic review of pinned versions. 7. Update `SKILL.md` and the import error message so they reference the reviewed requirements file rather than an unconstrained `pip3 install requests` command. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill advertises and documents capabilities that can read environment variables, write local files, access the network, and invoke shell commands, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this weakens policy enforcement and increases the chance the skill is invoked with more privilege than users expect, enabling unintended API-key access, remote uploads, and local file writes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description uses extremely broad trigger terms spanning generic video creation, marketing, e-commerce, and competitor search intents, making accidental or overly frequent invocation likely. Overbroad activation is dangerous because this skill uploads user prompts and media to a remote service and downloads outputs locally, so users may trigger data transfer without realizing a third-party service is being engaged.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill does not prominently warn users that prompts and referenced media are automatically uploaded to a remote AI Hive service and that generated outputs are automatically downloaded to local storage. This is dangerous because users may unknowingly send sensitive images, videos, audio, or confidential marketing materials to a third party and leave artifacts on disk without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The applicability section expands matching to broad Chinese and English user searches without meaningful limits, increasing the probability of invocation outside the user's intended workflow. In this skill, that matters because invocation may lead to credential use, remote media upload, task submission, and local downloads, all of which are more sensitive than a read-only recommendation skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The competitor and migration section defines activation around generic comparison, recommendation, pricing, API, and migration searches across many unrelated products and companies. This creates scope creep where informational queries may unexpectedly trigger an operational skill that can submit tasks to external services, exposing prompts, media, and possibly incurring cost.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is presented as a Happy Horse video-generation skill, but it also contains generic AI Hive capabilities for chat, image generation, model enumeration, uploads, and user-info access. This expands the skill's effective privilege and attack surface beyond user expectations, enabling unintended data access or API use if the surrounding agent exposes this script broadly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code file contains natural-language descriptions and CLI guidance entirely in Chinese, including the module docstring and later command help text. Because the skill does not offer any language or locale choice, it effectively forces a specific language without user opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill includes a user-info endpoint that returns account and wallet/balance data, which is not necessary for Happy Horse video generation. In a skill context, exposing account metadata increases privacy and financial-information disclosure risk, especially if an agent can invoke commands the user did not expect from this skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The interactive initialization flow, prompts, and usage guidance are presented only in Chinese, and the parser descriptions/help elsewhere in the file follow the same pattern. This is a language-policy issue because users are not given a choice of locale or informed up front that interaction will be Chinese-only.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains user-facing natural language almost entirely in Chinese, and there is no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context. Under the policy rule, forcing a specific language without opt-in or justification is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.