Security audit

Thunder Download

Security checks for vulnerabilities and agentic risk

Overview

This is a small Windows Thunder download helper whose file-writing behavior is expected for its purpose, with no hidden startup, persistence, or unrelated data access found.

Install only if you want an agent to create and manage Thunder download tasks on Windows. Review each URL, save path, and any cookie/header values before use, and avoid running the Python file directly unless you intend its built-in sample download task.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The usage examples instruct users to download content directly to a local filesystem path but do not warn that invoking this skill causes file writes on the host. In a tool explicitly designed to download files, this is contextually expected, but the lack of disclosure can still mislead users or agents into performing persistent changes without adequate notice or validation of destination paths and download sources.

Static analysis

No suspicious patterns detected.