T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:91- Finding
Arbitrary API endpoint can receive the bearer API key
- Content
View full analysis
- Remediation
View remediation
Security audit
Walmart 电商视频生成与编辑
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a Walmart video-generation wrapper, but it handles API credentials and network destinations too loosely for automatic installation.
Install only if you are comfortable giving this skill an AI Hive API key and sending selected product media to AI Hive/Seedance services. Avoid custom base URLs unless you fully control the endpoint, inspect ~/.ai-hive/config.json before use, prefer a virtual environment with pinned dependencies, and choose a bounded output directory with enough space.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/videogen.py:280- Finding
Server-controlled media transfer URLs are used without destination or size validation
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:65- Finding
Runtime dependency installation is not version-pinned or hash-verified
- Content
View full analysis
``` ### Technical Analysis The documented installation procedure installs `requests` without a fixed version, lock file, package hash, or isolated environment. The exact package and transitive dependency versions therefore depend on the state of the package index at installation time. There is no evidence that the package name is misspelled, sourced from an untrusted index, or currently malicious. The risk arises from non-reproducible dependency resolution: a compromised upstream release or an incompatible future version could be selected automatically. Python package installation can execute build-related code, and imported dependencies execute with the privileges of the user running the Skill. ### Attack Path 1. An upstream package account, release process, package index, or dependency is compromised, or a future incompatible release is published. 2. A user follows the documented command: ```bash pip3 install requests ``` 3. Package resolution selects the affected current release because no approved version or hash is specified. 4. Malicious installation or import-time code executes in the user's environment when the package is installed or the Skill starts. This attack path requires a supply-chain compromise or unsafe package-index configuration; the project does not itself provide a malicious dependency. ### Impact Assessment A malicious dependency could execute code with the privileges of the user performing the installation or running the script. This may expose local files, environment variables, the AI Hive API key, and network-accessible resources available to that u ...[truncated 200 chars]- Remediation
View remediation
``` 2. Pin all transitive dependencies through a lock file generated by a tool such as `pip-tools`, Poetry, or uv. 3. Record and verify package hashes: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Install dependencies in a dedicated virtual environment rather than modifying the user's global Python environment: ```bash python3 -m venv .venv .venv/bin/python -m pip install --require-hashes -r requirements.txt ``` 5. Configure an approved package index explicitly and prevent unintended fallback to untrusted indexes. 6. Periodically update pinned versions through a controlled review process that includes vulnerability scanning and regression testing. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains operational descriptions entirely in Chinese, but does not state that the skill is intended only for Chinese-speaking users or offer any language/locale choice. Under the policy rule, forcing a specific language without documented opt-in or justified regional scope is a natural-language policy concern.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes a Python script with package installation and task execution commands, implying shell, network, file, and environment access, but it declares no explicit tool scope or permissions boundary. In an agent environment, this can cause overbroad capability exposure, making it easier for the skill to read local files, access secrets, install packages, or make arbitrary network calls beyond the user’s intended video-generation task.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description says "Use this skill for" followed by a wide list of video-related tasks in English and Chinese, but it does not define specific trigger phrases, activation constraints, or negative examples. In a markdown skill file, this broad natural-language phrasing can overlap with many ordinary requests about videos or retail media and may cause unintended invocation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file is presented as a Walmart-specific video generation/editing skill, but the implementation is a broad AI Hive client supporting generic chat, image generation, model enumeration, uploads, task polling, and account inspection. This scope mismatch violates least privilege and increases the attack surface: users invoking a narrowly branded skill may unknowingly grant access to unrelated capabilities and send data to a generic external AI service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language descriptions and CLI guidance entirely in Chinese, including the module docstring and subsequent user-facing prompts. The skill does not offer a language/locale option or indicate that the locale restriction is intentional for a region-specific compliance purpose, which violates the language-choice policy.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Exposing user-info and wallet balance retrieval is unrelated to Walmart video editing and unnecessarily expands access to account metadata. In a skill context, this can leak sensitive billing or account details to users or downstream logs without a business need, making the overbroad functionality more dangerous because the skill is branded as a specialized media tool.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Generic text chat is outside the declared Walmart video-generation/editing scope and enables arbitrary prompt submission to the external AI provider. That broadens data exfiltration risk because users may send sensitive business content, product data, or internal instructions through a skill they reasonably expect to only perform constrained video operations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Standalone image generation exceeds the advertised Walmart video-editing purpose and creates another unrelated path for arbitrary data submission and content generation. This hidden breadth makes the skill more risky in context because the user may not realize they are invoking a multi-capability AI gateway rather than a narrowly scoped video tool.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The description switches between English and Chinese within the same invocation text, but it does not explain whether language selection is based on user preference or whether multilingual behavior is optional. This can conflict with language/locale policy expectations when a skill implicitly forces or assumes a language without explicit opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The string value for the API key placeholder uses Chinese text ('请替换为你的APIKey'), which imposes a specific language in user-facing configuration content. For a general example config, this is a natural-language locale choice without user opt-in or documented regional justification.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring explicitly describes a generic AI capability tool, which conflicts with the claimed specialized Walmart skill identity. This kind of deceptive or misleading packaging is dangerous because it obscures the true scope of functionality and can cause users or reviewers to underestimate what data and actions the skill can access.
- Content
Static analysis
No suspicious patterns detected.