nas-media-assistant

• Outcome: Review
• Latest audit: Aug 4, 2026 · 4:09 PM UTC
• Version: 0.1.0

Overview

The skill is coherent for NAS media automation, but it can start downloads, use external services, and move or delete NAS files with only partially enforced safeguards.

Review before installing on a real NAS. Use a dedicated download inbox and media-library path, keep backups, disable or avoid --purge-junk until you have inspected dry-run reports, and assume search terms, candidate links, and download URLs may be visible to configured public sources, Xunlei Cloud, qBittorrent, local logs, and caches.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill orchestrates sensitive capabilities including shell execution, network access, environment-variable use, and file read/write, but it does not declare an explicit permission model. That mismatch makes it harder for a host platform or reviewer to enforce least privilege and increases the chance that broad operational power is granted implicitly to a chat-triggered workflow.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script can delete files from the source tree when --purge-junk is used, and its junk classification includes broad heuristics such as ad-word matching and treating several document types as always disposable. In a NAS assistant whose workflow includes automated download and organization, this expands scope from organizing media to destructive cleanup and can remove user files that were not intended to be deleted if the root path or heuristics are wrong.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The comment asserts the state file contains 'zero privacy information', but the implementation persists arbitrary failure reasons and session identifiers to disk. In this NAS/media-assistant context, failure reasons may include upstream URLs, query terms, tracker names, auth errors, or other user/activity-derived data, so the misleading claim can cause operators to under-protect the file and unintentionally expose sensitive usage metadata.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill is described as activating from broadly phrased download/search requests across many chat endpoints, which creates ambiguous invocation boundaries. In practice, this can cause accidental triggering from normal conversation, increase exposure to prompt injection through external chat connectors, and allow high-impact actions like search/download flows to start without sufficiently precise intent validation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The routing table relies on loose keyword matching such as '下载/搞个/帮我下' and '查/找/搜', with command execution semantics attached to those matches. This is dangerous because small variations in ordinary chat text may be misclassified as actionable commands, potentially leading to unauthorized downloads or downstream file operations in a privileged NAS environment.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README describes an automation flow that can search, download, organize files, clean up content, and refresh a media library across mounted NAS paths, but it does not prominently warn users that these actions may modify or remove files. In a chat-triggered skill exposed through many endpoints, missing warnings and confirmation expectations increase the risk of unintended destructive actions or unsafe operation by users who do not understand the consequences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The end-to-end example explicitly includes cleanup, migration, and automatic library ingestion, yet does not warn that these operations may be irreversible if files are moved, renamed, or deleted incorrectly. Because the skill is designed for conversational triggering, users may treat the workflow as low-risk and initiate actions without realizing they affect persistent NAS storage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document specifies automatic deletion of an existing 迅雷 task during failover without requiring user confirmation, backup, or explicit warning about the destructive action. In this skill's context, which performs real download management on a NAS, that can cause unintended data loss, loss of task state, or user confusion if a download is removed and recreated elsewhere automatically.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The adapter sends user-supplied download URLs to a remote Thunder Cloud service via MCP without any visible consent, warning, or privacy boundary enforcement in this code path. In this skill's context, users may provide magnet, ed2k, HTTP, or thunder links that can reveal viewing interests or potentially sensitive resource identifiers to a third party, making the undisclosed transmission a real privacy/security issue.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The monitor logic automatically cancels an in-progress 迅雷 task and recreates it in qBittorrent when the transfer appears stalled or slow, without any explicit user confirmation or dry-run step. In a NAS media-management skill, this can cause unintended deletion of active download state, loss of partial progress, or movement of a job to a different backend with different retention, visibility, and security characteristics.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger section uses broad natural-language intents such as “搜索/下载/找资源 + 片名”, which can overlap with ordinary conversation and cause the skill to activate unexpectedly. In this skill’s context, accidental activation is more dangerous because the workflow can lead to resource retrieval and downstream download dispatch, turning a benign chat into an unintended acquisition action.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The document explicitly allows skipping the candidate list and directly dispatching a download when heuristic thresholds are met, but it does not require an explicit user confirmation or present any warning about the consequences. In a media-search skill that handles magnets/torrents/direct links, this increases the chance of unauthorized, risky, or illegal downloads and makes prompt injection or misclassification materially more harmful.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The dispatcher writes user query details and source metadata to stderr logs, including title, year, type, searched tiers, and per-source counts. In a media-download assistant exposed through chat endpoints, these logs can reveal sensitive user interests, potentially illegal download activity, and operational data to operators, log collectors, or anyone with access to centralized logging.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Search results are cached to local JSON files without any user notice or visible retention controls. Because this skill handles media search and download requests, disk cache entries can persist sensitive search history and candidate links, exposing private preferences or piracy-related activity to other local users, backups, or forensic review if the NAS is shared or compromised.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This function sends the user-supplied search term directly to a third-party torrent index (nyaa.si), which exposes user intent and potentially sensitive media interests to an external service. In the context of a NAS media assistant that brokers searches/downloads on behalf of users across chat platforms, the privacy risk is more significant because users may not realize their requests are being disclosed off-device to external sites.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This lifecycle explicitly instructs the agent to automatically search for media resources, enqueue downloads, move files across filesystems, delete source files after copy/verify, purge 'junk', and trigger downstream library refreshes, but it does not present a prominent safety gate describing the system and data impact of those actions. In this skill context, those actions can materially alter storage contents and external services, so the lack of a clear high-level warning and explicit confirmation boundaries increases the risk of unintended downloads, destructive file operations, and broad side effects from a casual chat command.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The download-mode trigger phrases are intentionally broad and the documented behavior says a top candidate can be dispatched directly to the downloader without presenting a confirmation list. In a skill whose purpose is to search and download media across many chat endpoints, this creates a real risk of unintended downloads from casual or ambiguous phrasing, which can lead to unauthorized content acquisition and execution of downstream file-handling workflows.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Treating a pure media title as a search command is ambiguous because ordinary conversation can mention titles without intending tool execution. In this skill context, that ambiguity is more dangerous because search results can feed directly into later selection and download flows, enabling accidental resource retrieval or user confusion across messaging platforms.

External Transmission

Medium

• Category: Data Exfiltration

Content

if not self._endpoint:
            return None
        try:
            r = requests.post(self._endpoint, json=payload, timeout=15)
            if r.status_code == 202:
                return {}
            try:

• Confidence: 77% confidence
• Finding: requests.post(self._endpoint, json=

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. 解析分类  classify(): parse_media()->title/year/[信息]/sea/ep -> 判 kind(movie/tv/anime)+系列检测
4. 归组      finalize_tv_shows(): 剧集按剧名分组 -> 单季独立 / 多季格式2(第N季)/格式3(主题)
5. 降级      单成员系列自动降级为独立电影(避免单部误入系列文件夹)
6. 迁移      finalize_target()+_move_file(): 同FS用mv原子移动; 跨FS用cp->校验->rm; 已存在询问覆盖/跳过
   (附) 自扩充 _save_learned_series(): 本次经元数据解析出的系列沉淀回 .cache/media_cache.json known 段
7. 清垃圾    cleanup_junk_files(): --purge-junk 启用时,移动视频后扫描残留并删广告图/伪装视频/nfo/txt等
   (附) 清空目录 cleanup_empty_dirs(): --commit 后删除本次产生的空目录

• Confidence: 91% confidence
• Finding: rm; 已存在询问覆盖/

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.