T09 · Insecure Skill Coding Practices
Error
- Location
scripts/understand.cjs:43- Finding
Arbitrary Local File Disclosure Through Unrestricted Image Path Handling
- Content
View full analysis
- Remediation
View remediation
Security audit
understand-image-minimax
Security checks for vulnerabilities and agentic risk
Overview
This image-analysis skill is purpose-aligned, but needs Review because it can send arbitrary local files or arbitrary URL responses to Minimax without tight validation or user confirmation.
Review before installing. Use this only for images you are comfortable sending to Minimax, avoid passing sensitive local paths or untrusted URLs, and prefer running it in a restricted environment with a dedicated API key until the skill adds explicit upload consent, real image validation, URL/IP protections, and file/response size limits.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/understand.cjs:69- Finding
Server-Side Request Forgery and Data Exfiltration Through Unrestricted Image URLs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes Node, reads an API key from the environment, and sends data to an external network endpoint, but it declares no explicit tool scope or permissions. This weakens least-privilege controls and makes it harder for users or the platform to understand that the skill can access secrets and exfiltrate image data to a third party.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill description is written as a Chinese-only instruction set and does not offer any language or locale choice to the user. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description and usage omit a clear warning that supplied images, including local files, may be transmitted to the external Minimax API. This is dangerous because users may unknowingly expose sensitive personal, proprietary, or regulated image content to a third party.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to 'always use this skill' whenever a user sends an image or asks about image content is overly broad and can trigger the skill for routine requests without necessity checks. In context, that increases the chance that local files or user-provided image URLs are sent to an external API unexpectedly, creating privacy and consent risks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s usage examples and error example strings present Chinese-only prompt examples such as "描述这张图片" and "这张图片有什么" without indicating that language selection is optional or that the skill is intended for a Chinese-only context. This creates a natural-language locale bias that can conflict with organizational language-choice policies.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/understand.cjs:17