T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:74- Finding
Bearer API Key Disclosure Through Unrestricted Custom Base URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Wan3.0 视频生成与编辑
Security checks for vulnerabilities and agentic risk
Overview
This video-generation skill is mostly purpose-aligned, but it has credential-handling and file-write risks that should be reviewed before installation.
Install only if you trust the AI Hive endpoint and are comfortable uploading selected media to it. Do not set --base-url, AI_HIVE_BASE_URL, or config base_url to an untrusted or plaintext endpoint, and keep generated downloads confined to a disposable output folder until the filename handling is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:400- Finding
Arbitrary File Write Through Unsanitized API-Controlled Task Type
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises and documents capabilities that include network access, shell execution, environment-variable access, and file read/write, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can lead to overbroad execution authority, making it easier for the skill to access secrets, write files, upload local media, or invoke commands beyond what the user reasonably expects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description uses very broad trigger terms spanning generic video creation, editing, competitor products, APIs, pricing, and large e-commerce ecosystems. This can cause the skill to activate for loosely related user requests, increasing the chance that a high-privilege skill is invoked in contexts where the user did not intend file uploads, network activity, or task submission to an external service.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation guidance repeatedly claims that many unrelated competitor, platform, and commerce searches should also match the skill, without clear constraints. In context, this broadens routing for a skill that can read files, use API keys, upload media, and contact external services, creating an unnecessary pathway from ordinary discovery/comparison queries to privileged execution.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is presented as a Wan3.0 video-generation/editing skill, but the implementation includes a broad generic AI Hive client with unrelated capabilities. This creates scope expansion: a caller expecting a narrowly-scoped video tool may unknowingly gain access to additional API actions, increasing the chance of misuse, privilege overreach, and policy bypass in agentic workflows.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring explicitly describes a general AI capability tool, which contradicts the narrow Wan3.0-specific skill metadata. This mismatch is dangerous because operators and orchestrators may trust the metadata for risk decisions while the actual code exposes materially broader actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and all user-facing guidance are written exclusively in Chinese, and the script later continues presenting prompts and errors only in Chinese. For a general-purpose skill, this constitutes a language/locale policy issue because users are not given an opt-in choice or an explicit documented justification for the language restriction.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill contains a generic text-chat endpoint even though the advertised capability is Wan3.0 video generation/editing. This allows prompt-driven use outside the intended scope and may let downstream agents route arbitrary text tasks through a credentialed API client, undermining capability boundaries and auditing expectations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Standalone image generation is broader than the stated Wan3.0 video-only purpose and expands what a caller can do with the configured API key. In agent ecosystems, this kind of undocumented capability broadening can be abused to bypass tool selection controls, consume credits, or produce outputs outside approved content pathways.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file’s natural-language content is presented entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific. Under the policy for language/locale constraints, this can be a natural-language policy violation when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The description states the skill is suitable for "中文或英文用户," but the document otherwise strongly centers a Chinese-language usage context and does not explicitly state that outputs or interaction language will follow user preference. This can create a locale/language expectation without a clear opt-in or user choice mechanism.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The example API key placeholder contains Chinese text ("请替换为你的APIKey"), which imposes a specific language in a user-facing configuration example. The file does not offer a language choice or document a justified locale-specific constraint, so this is a natural-language locale policy issue.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Exposing account-information retrieval in a media-generation skill violates least privilege and reveals wallet or account metadata unrelated to the declared purpose. In an agent setting, this can leak billing or tenant information to prompts or users who should only be able to generate/edit video.
- Content
Static analysis
No suspicious patterns detected.