Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a legitimate Aholo 3D reconstruction helper, but installing it means letting the agent upload chosen media and use your Aholo API key to create or inspect 3D tasks.
Install this only if you trust Aholo with the media you choose and with task metadata associated with your API key. Create actions may consume credits, and the list action can show accessible Aholo world-task metadata. Do not set AHOLO_INSECURE_SKIP_VERIFY unless you knowingly accept TLS interception risk; prefer a trusted CA bundle. For stronger supply-chain hygiene, pin and audit the Python dependencies before production use.
The top-level description says the skill is for upload, create, and poll/status, but the body also authorizes listing tasks via /global/world/v1/list. That hidden enumeration capability expands behavior beyond the declared purpose and could expose metadata about prior jobs or other accessible world tasks without the user clearly understanding that the skill can browse them.
The skill instructs the agent to use environment variables, local file paths, and network access, but it does not declare any corresponding tool scope or permissions metadata. This weakens reviewability and enforcement because an execution environment may grant broader capabilities than users or policy expect, increasing the risk of unintended file access, secret use, or outbound requests.
The skill documents an environment flag that disables TLS certificate verification, which can expose API keys, uploaded media, and task metadata to man-in-the-middle attacks if used on untrusted networks. Although the text warns against casual use and prefers CA bundles, normalizing an insecure bypass inside the skill still increases the chance that operators will trade security for convenience.
### TLS (script default behavior)
- Script **enables** SSL verification by default (secure by default).
- Corporate/self-signed certs: set `AHOLO_INSECURE_SKIP_VERIFY=1` (or `true` / `yes` / `on`) to explicitly disable verification; prefer `REQUESTS_CA_BUNDLE` to point at your enterprise CA.
- On `CERTIFICATE_VERIFY_FAILED`, configure CA certs first; use `AHOLO_INSECURE_SKIP_VERIFY` only when you accept the risk.
### Responses & errors
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| 11 | **Multiple videos:** ask before create (**do not** choose for user): **A** one 3DGS (one create, all in `videoPaths`); **B** one 3DGS per video (see #9). Only 1 video → skip question |
| 9 | **Create POST (high cost)** — **Default:** one user **single** 3D intent → at most **one** create per conversation round; no retry on same intent after fail/timeout/missing `worldId` unless user **explicitly re-orders**. **Pre-upload failure** (POST not sent) → one first create after fix. **Charged but no worldId** → task list / status/list, not another create. **Multi-video B:** user chose separate 3DGS → create **per video** (`videoPaths` one each), warn N tasks/charges upfront; **no** duplicate create for same video; failed video → no retry, continue with remaining. Use `forbidCreate` only to block accidental **duplicate for the same completed task**, not the next video in B |
| 10 | `projectName` only if user explicitly asks; never invent from folder name or timestamp |
| 5–6 | After each `worldId` → **ask** wait or not; if wait → **sync** `poll` (`intervalSeconds=60`, `timeoutSeconds=14400`); if not → link only. **No** background poll + "I'll notify you"; **no** poll without asking |
### `taskQuality` display names (API values unchanged)
The skill defines a world listing endpoint in addition to the manifest-described upload/create/status workflow. That expands capability from single-task handling to account-wide enumeration, which can expose unrelated project metadata and violates least privilege for the stated purpose.
The client can disable TLS certificate verification via the AHOLO_INSECURE_SKIP_VERIFY environment variable, which enables man-in-the-middle interception or tampering of API requests, upload tokens, and uploaded media. Even though this is opt-in, it creates an insecure execution mode for a skill that handles credentials and potentially sensitive user files.
insecure_skip = str(os.environ.get("AHOLO_INSECURE_SKIP_VERIFY", "")).strip().lower()
if insecure_skip in {"1", "true", "yes", "on"}:
# Explicit opt-out only (e.g. corporate self-signed certs).
self.verify_ssl = False
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
else:
self.verify_ssl = True
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
results.append({"success": True, "url": item, "originalPath": item, "isUrl": True})
else:
print(f"Uploading {input_label}: {item}")
up = self.upload_file(item)
if up.get("success"):
print(f"{input_label} upload succeeded: {item}")
else:
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
results.append({"success": True, "url": item, "originalPath": item, "isUrl": True})
else:
print(f"Uploading {input_label}: {item}")
up = self.upload_file(item)
if up.get("success"):
print(f"{input_label} upload succeeded: {item}")
else:
The list_worlds method enables enumeration of all worlds available to the API key, which is not necessary for a single-intent reconstruction/generation skill. In context, this broadens the data-access surface from operating on a user-specified worldId to discovering unrelated tasks and their metadata.
The CLI advertises a list action even though the skill description only promises upload, create, and poll/status. Hidden or undocumented account-wide operations are dangerous because they enable broader data access than users and reviewers expect.
Main dispatch includes a top-level list operation that permits account-wide querying outside the core create/status flow. This increases abuse potential because any caller who can run the skill with the API key can enumerate projects without first knowing a worldId.
The dependency specifier requests>=2.28.0 is unpinned, so builds may resolve to different versions over time and can silently pick up vulnerable or breaking releases. For a skill that performs network/API operations, this weakens supply-chain integrity and makes security posture non-reproducible.
requests>=2.28.0
urllib3>=2.0.0
requests has known security advisories, and because the manifest does not pin a specific version, it is impossible to verify whether deployed environments are using a safe release. In a skill that interacts with remote APIs, an affected HTTP client could enable credential leakage, TLS/request handling flaws, or other network-layer weaknesses depending on the resolved version.
The dependency specifier urllib3>=2.0.0 is unpinned, which allows environment-dependent resolution and undermines reproducible, auditable installs. Because urllib3 is a core HTTP transport library, unexpected version selection can expose the skill to newly introduced vulnerabilities or incompatible TLS/network behavior.
requests>=2.28.0
urllib3>=2.0.0
urllib3 has multiple known advisories, but the unpinned requirement prevents determining whether installations are affected. Given this skill's reliance on outbound HTTP communication, a vulnerable transport library could increase exposure to redirect, proxy header, decompression, or other protocol-handling issues if a bad version is resolved.