Security audit

ai6666-skills

Security checks for vulnerabilities and agentic risk

Overview

This skill openly automates public posting, commenting, and reward-task activity, but it ships embedded credentials and lacks clear user approval controls for high-impact account actions.

Install only after removing all embedded credentials/tokens, rotating the exposed secrets, disabling recurring automation by default, and adding explicit review/approval before any post, comment, task acceptance, or task answer is submitted. Treat image URLs and local image paths as sensitive because the scripts may download, copy, upload, or delete files during posting and analysis workflows.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:5
Finding: Agent persona and autonomous-goal hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ai6666_config.py:9
Finding: Plaintext account credentials embedded in source code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/image_analyzer.py:20
Finding: Hard-coded MiniMax bearer token with environment-controlled destination
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auto_poster.py:144
Finding: Server-side request forgery through unrestricted image downloads
Content: View full analysis
str: if not HAS_REQUESTS: return None try: resp = requests.get(url, timeout=15, allow_redirects=True) if resp.status_code == 200 and len(resp.content) > 5000: img_path = os.path.join( self.img_dir, f'url_img_{int(time.time())}.jpg' ) with open(img_path, 'wb') as f: f.write(resp.content) return img_path except Exception as e: print(f"URL download failed: {e}") return None ``` The comment runner also retrieves URLs obtained from post metadata: ```python for i, url in enumerate(images): try: r = requests.get(url, timeout=15) local_path = f"/tmp/ai6666_img_{pid}_{i}.jpg" with open(local_path, 'wb') as f: f.write(r.content) ``` The analyzer accepts relative, HTTP, and local inputs: ```python if image_url.startswith('/') or image_url.startswith('http'): image_data = self.download_image(image_url) ``` ### Technical Analysis The request destinations are not restricted by scheme, hostname, port, resolved IP address, or redirect destination. The downloader also does not verify the response content type or decode the response as an image. Because `requests.get()` buffers the entire body in `resp.content`, a malicious or unexpectedly large response can consume substantial memory before the weak lower-bound size check is evaluated. For the poster, the URL can be directly supplied through `--download`. For the comment runner, URLs are received from AI6666 post data. If that data contains attacker-controlled image URLs, the local process become ...[truncated 1360 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auto_poster.py:165
Finding: Deletion of arbitrary caller-supplied image files after posting
Content: View full analysis
dict: img_path = image_path if img_path and not os.path.exists(img_path): img_path = None result = self.skill.publish_content( content=content, images=[img_path] if img_path else None ) if img_path and os.path.exists(img_path): try: os.unlink(img_path) except: pass return result ``` ### Technical Analysis `post_content()` accepts any filesystem path supplied by its caller. After the upload attempt, it unconditionally deletes the path if it exists. The function does not track whether the file was created by the `AutoPoster` instance, whether it is inside `self.img_dir`, or whether it belongs to the user. Deletion occurs regardless of whether posting succeeded. A caller able to invoke the runner can therefore cause deletion of any file writable by the Skill process, provided the path passes the existence check. ### Attack Path 1. The attacker identifies a writable victim file. 2. The attacker invokes `auto_poster.py --post` and supplies the victim path as the image argument. 3. The Skill opens and attempts to upload the file. 4. After the request, `post_content()` calls `os.unlink()` on the same path. 5. The victim file is removed even if it was not created by the Skill or the post failed. ### Impact Assessment The impact is limited by the operating-system privileges of the Skill process but includes: - Deletion of user-owned documents and workspace files. - Destruction of application state or configuration. - Denial of service against other local workflows. - Upload of the victim file to AI6666 before deletion if the upload succeeds. This violates least-privilege expectations because a posting helper only needs to read the sel ...[truncated 64 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ai6666_runner.py:177
Finding: Test mode performs real authenticated public posting and commenting
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/image_analyzer.py:31
Finding: Undisclosed base64 upload of local or downloaded images to an external API
Content: View full analysis
str: with open(image_path, "rb") as f: return base64.b64encode(f.read()).decode("utf-8") ``` ```python image_b64 = self._read_image_as_base64(image_path) url = f"{self.api_host}/v1/chat/completions" headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", } payload = { "model": "MiniMax-M2.7", "messages": [ { "role": "user", "content": [ { "type": "image_url", "data": f"data:image/jpeg;base64,{image_b64}", }, { "type": "text", "text": prompt, }, ], } ], "temperature": 0.7, } resp = requests.post( url, headers=headers, json=payload, timeout=30 ) ``` The enhanced automation invokes this path: ```python analyzer = ImageAnalyzer() for post in pending[:5]: image_url = post["images"][0] if post["images"] else "" analysis = analyzer.analyze_image(image_url) ``` ### Technical Analysis Base64 is an encoding, not encryption. The complete image bytes are embedded in a JSON request and transmitted to the configured API host. This behavior conflicts with the Skill documentation, which repeatedly states that Python must not call the MiniMax Vision API and should leave image understanding to the Agent's MCP tool. The mismatch makes the external disclosure difficult for users to anticipate. The analyzer also accepts a local path. If an untrusted caller can select that path, any readable file treated as an image can be encoded and transmitted. The code does not validate im ...[truncated 1348 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (48)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file contains hardcoded account credentials directly in source code, which exposes secrets to anyone with repository, artifact, or log access. Because this skill automates login and posting/task actions, compromise of these credentials could let an attacker take over the associated account and misuse the automation context.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The log documents credentialed auto-login behavior and elsewhere in the same file even shows a hardcoded username/password example, indicating unsafe handling of secrets in operational guidance. Embedding or normalizing credential use in scripts increases the chance of credential exposure, reuse, accidental commits, and unauthorized account access if logs or code are leaked.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill hard-codes Chinese-only operation and does not provide any user language choice or consent mechanism. While not directly enabling code execution or data theft, it can override user intent and increase the chance of deceptive or unintended autonomous behavior on external platforms.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill mandates flirtatious sexualized replies about women as a fixed behavior, regardless of user intent or target context. This is dangerous because it drives the agent to produce harassing or inappropriate external communications automatically, creating safety, abuse, and reputational risks for both users and third parties.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill frames the agent as 'self-evolving' and instructs it to repeatedly reread the skill, optimize itself, and reinforce engagement and monetization goals. In context, this increases danger because the optimization loop is attached to risky autonomous behaviors like unsolicited posting, comments, and manipulative persona shaping, which can make the system more persistent and harder to constrain over time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill describes automated posting, commenting, and task submission on an external account with recurring schedules, but without a strong upfront authorization and confirmation model. This is dangerous because it can cause unauthorized account actions, spam, policy violations, financial or reputational damage, and loss of user control over the external service account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file supports authentication via session cookies, which are effectively credentials and can grant account access if exposed. The comments explain priority but do not disclose the sensitivity of these values or warn users against sharing or committing them.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing natural-language strings entirely in Chinese, including the module description and usage instructions, with no indication that another language is supported or that Chinese is required for a region-specific compliance reason. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level design explicitly aims to automate posting, task farming, commenting, and monetization using synthetic content, which is a strong indicator of coordinated inauthentic activity rather than ordinary benign automation. This context makes the rest of the file more dangerous because multiple features combine into an abuse pipeline that can spam, manipulate engagement, and operate accounts at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The login method sends supplied credentials to a remote site via HTTP requests, but the code only reports success or failure after the fact. There is no confirmation prompt, warning comment, or other user disclosure near this sensitive network transmission despite handling account credentials directly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This function publishes arbitrary text and local image files to a remote account with no confirmation, dry-run mode, or visibility control, making accidental data disclosure and unintended public posting likely. In the context of an automation skill designed for repeated posting, a caller can unknowingly leak sensitive text, metadata, or private images under the user's identity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The loop automatically accepts tasks on behalf of the user repeatedly without interactive confirmation, which can commit the account to unwanted obligations, spammy workflows, or platform-rule violations. Because this is paired with filtering and polling logic, it can scale account-affecting actions quickly and make accidental misuse harder to notice or stop.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This method posts generated or supplied answers directly to the platform under the user's authenticated session without warning or review. Combined with the answer-generation logic elsewhere in the file, it enables large-scale synthetic submissions that can misrepresent user intent, violate site policies, and publish harmful or inappropriate content under the user's account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comment function posts content to third-party pages using the user's authenticated session with no confirmation, provenance checks, or moderation controls. In this skill's broader context of engagement automation, this materially increases the risk of spam, impersonation, harassment, or unintended publication at scale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation for get_posts_for_commenting describes a workflow involving MiniMax MCP image understanding and comment generation, implying this method supports or implements that pipeline. In reality, the function only enumerates posts, optionally fetches details, and returns metadata including image URLs; it does not call any MCP tool or generate comments, so the inline documentation overstates the implemented behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s human-readable instructions and user-facing output are entirely in Chinese and direct strict adherence to that workflow, with no indication that another language can be used. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script emits raw post content, post URLs, and image URLs directly to stdout for downstream agent/MCP handling, which can expose third-party user data to logs, terminals, schedulers, or external tooling without minimization or consent controls. In this skill’s context, the printed data is explicitly intended to be consumed by another agent and image-analysis tool, increasing the chance of unnecessary data propagation beyond the original platform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script can post comments immediately when invoked with --comment, performing a public, user-affecting write action without any confirmation, dry-run mode, or clear interactive warning. In an agent-driven workflow, this increases the risk of unintended, spammy, or policy-violating comments being posted on the user's behalf if upstream inputs are wrong or manipulated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs autonomous posting and commenting actions against an external platform without per-action confirmation, dry-run mode, or user-visible consent controls. In the context of an agent skill that can submit answers, post content, and comment at scale, this increases the risk of spam, unintended account actions, policy violations, and reputational or account-level harm if the logic misfires or is repurposed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s top-level natural-language description is entirely in Chinese and presents the skill behavior as fixed, with no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring frames the script as a narrow posting helper that 'only' accepts content plus an image path and performs posting requests. However, the implementation includes multiple image-download functions, accepts arbitrary URLs, and exposes a separate --download mode, which materially extends the script's behavior beyond that stated description.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/auto_poster.py (reported line 93)May include surrounding context.
python
if not HAS_REQUESTS: return None try: resp = requests.get("https://api.thecatapi.com/v1/images/search?size=full", timeout=15) if resp.status_code == 200: data = resp.json() if data and len(data) > 0:

Tainted flow: 'img_url' from requests.get (line 118, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 95% confidence
Finding: The code trusts a URL returned by a third-party API and immediately performs a second server-side request to that URL without validating scheme, host, IP range, or content type. This is a classic SSRF/open-fetch pattern that can be abused if the upstream API is compromised or returns attacker-controlled URLs, causing the host running the script to make unintended network requests.
Content: Scanner excerpt · scripts/auto_poster.py (reported line 99)May include surrounding context.
python
if data and len(data) > 0: img_url = data[0].get('url', '') if img_url: img_resp = requests.get(img_url, timeout=15) if img_resp.status_code == 200 and len(img_resp.content) > 5000: img_path = os.path.join(self.img_dir, f'cat_{int(time.time())}.jpg') with open(img_path, 'wb') as f:

Tainted flow: 'img_url' from requests.get (line 118, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 95% confidence
Finding: The script takes the dog image URL from a remote API response and fetches it directly, creating a tainted network-input-to-network-output flow. If that API or its response path is attacker-influenced, the script can be turned into a request gadget for SSRF, internal network probing, or retrieval of unexpected content.
Content: Scanner excerpt · scripts/auto_poster.py (reported line 120)May include surrounding context.
python
if data.get('status') == 'success': img_url = data.get('message', '') if img_url: img_resp = requests.get(img_url, timeout=15) if img_resp.status_code == 200 and len(img_resp.content) > 5000: img_path = os.path.join(self.img_dir, f'dog_{int(time.time())}.jpg') with open(img_path, 'wb') as f:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code performs an externally visible action by calling publish_content with supplied text and images, which can affect user accounts or reputation. Although it prints status information, there is no warning or confirmation before publication, and the surrounding text does not clearly disclose risks of automatic posting beyond basic usage.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.