Security audit

Queenshow Detail Page Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for Queenshow page generation, but it handles API keys, uploads local files, and can send credentials to any user-supplied endpoint without strong safeguards.

Review before installing. Use this only with a trusted Queenshow endpoint, avoid copying --base-url values from untrusted instructions, prefer HTTPS except for localhost testing, and avoid placing real API keys directly in shell commands or logs. Upload only product media you intend to transmit to Queenshow, and check account quota before batch runs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/detail_page_client.py:525
Finding: API Credential Exposure Through Command-Line Arguments
Content: View full analysis
argparse.ArgumentParser: parser = argparse.ArgumentParser(description="Queenshow detail page OpenAPI client") parser.add_argument("--base-url", required=True, help="Example: https://host/api/promotion") parser.add_argument("--api-key", required=True) parser.add_argument("--summary", action="store_true", help="Print a compact verification-friendly summary") parser.add_argument("--show-sensitive", action="store_true", help="Do not redact sensitive fields in output") ``` The documented invocation directly encourages passing the secret on the command line: ```bash python .codex/skills/queenshow-detail-page/scripts/detail_page_client.py \ --base-url https://your-host/api/promotion \ --api-key qs_live_xxx \ --summary \ run \ --title "Running Shoes Detail Page" \ --main-image https://example.com/shoe-1.png \ --intro "Lightweight running shoes with breathable mesh and rebound foam." \ --detail-style "clean, premium, high contrast product photography" ``` ### Technical Analysis The client requires the Queenshow API key through the `--api-key` command-line option. Secrets supplied as process arguments may be exposed through: - Shell command history. - Process inspection tools available to other local users. - CI/CD and automation logs. - Terminal session recording. - Debugging and process-monitoring systems. - Wrapper scripts that log the complete command. The response-redaction mechanism does not mitigate this issue because it only processes API response data before printing it. It does not remove the API key from the original command line, process metadata, or shell history. ### Attack Path 1. A user follows the documented e ...[truncated 1184 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/detail_page_client.py:54
Finding: Bearer Credential and User Data Can Be Sent to an Arbitrary or Cleartext Endpoint
Content: View full analysis
str: url = base_url.rstrip("/") + path if query: clean = {k: v for k, v in query.items() if v not in (None, "")} if clean: url += "?" + urlencode(clean) return url def request_json( base_url: str, api_key: str, method: str, path: str, body: dict[str, Any] | None = None, query: dict[str, Any] | None = None, ) -> Any: data = None headers = { "Authorization": f"Bearer {api_key}", "Accept": "application/json", } if body is not None: data = json.dumps(body, ensure_ascii=False).encode("utf-8") headers["Content-Type"] = "application/json; charset=utf-8" req = request.Request(openapi_url(base_url, path, query), data=data, headers=headers, method=method) try: with request.urlopen(req, timeout=60) as resp: return unwrap_response(resp.read()) except HTTPError as exc: raise RuntimeError(f"HTTP {exc.code}: {exc.read().decode('utf-8', errors='replace')}") from exc except URLError as exc: raise RuntimeError(str(exc.reason)) from exc ``` The upload path applies the same unrestricted destination behavior to complete local file contents: ```python def request_multipart( base_url: str, api_key: str, path: str, files: list[Path], fields: dict[str, str], ) -> Any: boundary = "----queenshow-" + uuid.uuid4().hex chunks: list[bytes] = [] for name, value in fields.items(): chunks.extend( [ f"--{boundary}\r\n".encode(), ...[truncated 4185 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill performs sensitive operations that require file reads and outbound network access, including reading local files for upload and calling external OpenAPI endpoints, but it does not declare an explicit tool scope such as permissions or allowed-tools. This increases the risk that an agent may invoke broader capabilities than intended, making review, sandboxing, and policy enforcement weaker for a skill that handles API keys and remote content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The upload command reads local files and sends their contents in a multipart HTTP request to the configured base URL. Although this is the command's purpose, the script provides no runtime notice, confirmation, or explicit warning that selected local files will be transmitted off-host.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.