T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:74- Finding
Bearer API Credential Can Be Transmitted to an Arbitrary Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Instagram INS 电商视频生成与编辑
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly an AI Hive Instagram video tool, but its API client can send the user's bearer API key to an arbitrary configured base URL, which needs review before installation.
Review this skill before installing. Use it only if you trust AI Hive with the API key and uploaded media, avoid custom base URLs or inherited AI_HIVE_BASE_URL values, and prefer a pinned dependency install in an isolated environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:69- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
``` ### Technical Analysis The setup documentation instructs users to install `requests` without a version constraint or package-integrity hash. Installation therefore resolves whichever release and dependency graph the package index serves at installation time. The package name is legitimate and no suspicious custom package source or misspelling was identified. Nevertheless, the absence of a reviewed version lock and cryptographic hashes reduces build reproducibility and means future upstream changes or a package-index compromise could alter the code installed into the Skill's runtime environment without a corresponding change to the audited project. This is a supply-chain hardening weakness rather than evidence that the current `requests` package is malicious. ### Attack Path 1. A user follows the runtime instructions and executes `pip3 install requests`. 2. `pip` queries its configured package index and resolves the latest compatible package release and transitive dependencies. 3. If a future release, dependency, configured package source, or package-index response is compromised, the affected package is downloaded. 4. Package installation processes run, and the resulting code is imported when `videogen.py` executes. 5. Malicious dependency code would execute with the privileges of the user running the installation or Skill. Exploitation depends on compromise or manipulation of the package supply chain; the repository itself does not provide a malicious dependency. ### Impact Assessment A compromised dependency could execute arbitrary Python code with the invoking user's ...[truncated 331 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file exposes substantially broader capabilities than the advertised Instagram e-commerce video skill: general text chat, image generation, model discovery, account info lookup, and arbitrary media upload. In a skill ecosystem, this scope expansion is dangerous because users and policy layers may trust the skill as narrowly bounded, while it can actually be used as a generic AI/API wrapper to access unrelated platform functions and exfiltrate account/context data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill includes executable command examples that invoke Python, install packages, and interact with scripts, yet it declares no explicit tool restrictions or permission scope. In an agent environment, this can lead to broader-than-necessary access to shell, filesystem, environment variables, and network resources, increasing the risk of misuse if the skill or its supporting scripts are modified or invoked unsafely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring explicitly describes a general-purpose AI Hive tool, which contradicts the declared specialized Instagram video purpose. That mismatch increases the chance that reviewers, orchestrators, or end users will misclassify the skill's privilege and acceptable behavior, enabling capability smuggling under a narrower trust label.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code file contains user-facing natural-language descriptions entirely in Chinese and labels the tool as a general-purpose skill, but it does not state that Chinese is optional or provide any language/locale selection. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The user-info and models endpoints provide account/platform introspection that is not necessary for a narrowly scoped Instagram video generation skill. Exposing them broadens data access and reconnaissance capability, which can leak wallet/account details and facilitate discovery of other available models or unsupported uses of the API.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents substantive skill information only in Chinese, which effectively forces a specific language on readers without any opt-in or alternative. The stated policy forbids language or locale constraints unless they are optional or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The description includes Chinese terms alongside English to define when the skill should be used, but it does not indicate that language is optional or user-selectable. This can be a locale/language policy issue because the skill implicitly assumes multilingual usage without explicit opt-in or language preference handling.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The placeholder value includes the Chinese phrase '请替换为你的APIKey', which imposes a specific language in user-facing configuration content. The file does not provide an opt-in, alternative locale, or justification for restricting the skill to Chinese-language users.
- Content
Static analysis
No suspicious patterns detected.