Most alerts are false positives involving Markdown backticks, multilingual prose, ordinary Python indexing, and documented application configuration. Confirmed risks concern quota tokens in GET URLs and token files created without restrictive permissions. Configurable endpoints also lack HTTPS enforcement; no evidence found for prompt injection, obfuscated execution, or deliberate credential exfiltration.
Quota Credentials Can Be Sent to Insecure Configured Endpoints
env_base accepts FS_API_BASE without HTTPS validation. Quota and image commands reuse saved bearer tokens against that endpoint, exposing credentials over plaintext HTTP.
The code directly concatenates the configured base with authenticated routes without checking its scheme. Exploitation requires an insecure endpoint configuration; the default uses HTTPS.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
save_quota writes bearer tokens using ordinary open without enforcing private permissions. Under permissive umasks, other local users can read accessible credential files.
The GET helper accepts quota_url output containing the bearer token in its query string. Token validation and balance requests expose credentials to URL logging.
with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
urlopen transmits GET requests used by quota validation and balance commands. Their URLs include bearer tokens, creating credential exposure through server or proxy logs.
Most static alerts are false positives from Markdown backticks, multilingual documentation, normal cache operations, and documented API access. Quota tokens lack explicit restrictive file permissions, appear in request URLs, and lack transport origin protections. No evidence found of malicious exfiltration intent, prompt injection, hidden command execution, or code obfuscation.
FS_API_BASE accepts HTTP, and default urllib redirects can forward X-FS-Quota headers across origins. Misconfigured endpoints or unsafe redirects can expose quota credentials.
Endpoint configuration has no scheme validation, and both transports use urllib defaults without redirect restrictions. Exploitation requires unsafe configuration or a cross-origin redirect.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Most alerts are false positives involving Markdown backticks, Chinese documentation, ordinary indexing, and expected cache operations. Confirmed risks involve quota-token forwarding across redirects and an endpoint override that permits plaintext HTTP. No evidence found of malware, prompt injection, or unrelated credential collection.
3
Files scanned
869
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
Authenticated style and image requests reach this urlopen with X-FS-Quota as a regular header. Default redirects can forward that credential across origins or to HTTP.
return (os.environ.get("FS_API_BASE") or DEFAULT_BASE).rstrip("/")
FS_API_BASE is accepted without HTTPS validation and feeds authenticated requests. A plaintext HTTP override exposes the quota token and cloud input to network interception.
Most flags reflect Markdown formatting, readable Chinese documentation, normal dictionary caching, and expected API configuration. Both HTTP helpers can forward quota credentials across host redirects or HTTPS downgrades, creating a conditional credential-disclosure risk. No evidence found of malicious intent, prompt injection, shell execution, or unrelated secret collection.
3
Files scanned
854
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
Paid GET callers supply X-FS-Quota, and default urllib redirects retain this custom header across hosts and HTTPS downgrades. A redirect can expose quota credentials.