ClawHub
Back to skill

Security audit

magic-image2video

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real remote image-to-video client, but it can fetch arbitrary URLs and upload any readable local file when given as an image path.

Install only if you are comfortable sending selected images to the MagicLight remote service. Do not provide sensitive local paths, private documents, credential files, internal URLs, localhost URLs, or cloud metadata URLs as the image input; prefer a known image file in a dedicated folder or a trusted public HTTPS image URL. Use MAGIC_API_KEY from a protected environment variable rather than the --api-key command-line option.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/media_gen_client.py:119
Finding

Unrestricted User-Controlled URL Fetch Enables Blind SSRF

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/media_gen_client.py:122
Finding

Arbitrary Local File Read and Upload Through the Image Path Argument

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/media_gen_client.py:178
Finding

API Key Accepted Through a Command-Line Argument

Content
View full analysis
str: api_key = explicit or os.environ.get("MAGIC_API_KEY") if not api_key: raise ValueError("MAGIC_API_KEY is required (env or --api-key).") return api_key ``` ### Technical Analysis The client permits the bearer credential to be provided as `--api-key`. Command-line arguments commonly remain visible in shell history, process listings, monitoring systems, audit logs, crash reports, and orchestration metadata. The Skill metadata already declares `MAGIC_API_KEY` as its required and primary environment variable. Consequently, accepting the secret through a command-line option is unnecessary for the declared workflow and expands the channels through which the credential may leak. The credential is transmitted to the fixed HTTPS API endpoint in an `Authorization: Bearer` header, which is necessary for the service operation. The issue is not that authenticated HTTPS transmission occurs; it is the avoidable command-line secret input channel. ### Attack Path 1. A user or automated invocation supplies `--api-key SECRET`. 2. The complete command is recorded in shell history or exposed in the process command line while the client is running. 3. Another local user, monitoring agent, diagnostic tool, or log consumer obtains the argument. 4. The exposed bearer key is reused against the MagicLight API until it is revoked or expires. ### Impact Assessment An attacker who obtains the key may act with the API privileges associated with the victim's MagicLight ...[truncated 301 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 124, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/media_gen_client.py (reported line 65)May include surrounding context.

python
req = urllib.request.Request(url, data=data, headers=all_headers, method=method.upper())
    try:
        with urllib.request.urlopen(req, timeout=timeout_s, context=_get_ssl_context()) as resp:
            raw = resp.read().decode("utf-8")
            return json.loads(raw) if raw else {}
    except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 124, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/media_gen_client.py (reported line 125)May include surrounding context.

python
put_url = image_put_url_resp.get("data", {}).get("put_url")
            # put_url是临时上传地址，需要上传图片到put_url
            req = urllib.request.Request(put_url, data=image_content, method="PUT")
            with urllib.request.urlopen(req, context=_get_ssl_context()) as resp:
                status = resp.getcode()
                if status != 200:
                    raise Exception(f"Failed to upload image to put_url, status: {status}")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes a Python client that requires environment access to read MAGIC_API_KEY and performs network requests to a remote video service, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege enforcement and reduces review visibility into what the skill is allowed to access, making unintended credential exposure or unauthorized external communication harder to control.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script directly fetches arbitrary user-supplied URLs before submitting the task, which gives the skill a general-purpose outbound URL retrieval capability. In an agent setting, this can be abused for SSRF-style access to internal services, cloud metadata endpoints, or other network locations reachable from the runtime environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

When given a local file path, the script reads the file and uploads its contents to a remote temporary storage endpoint. That creates remote file-transfer behavior that can expose sensitive local files if an attacker can influence the path or trick a user/agent into supplying one, especially since the manifest frames the skill as media generation rather than generic file upload.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code silently transmits local image data to a remote endpoint without a clear user-facing warning at the moment of upload. In an agent context, that lack of disclosure increases the chance of accidental data exfiltration because users may believe they are only referencing a local file for processing rather than sending it off-host.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.