Aria2 Downloader

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:46 AM UTC
• Version: 1.0.2

Overview

This aria2 skill is a download controller, but it exposes a fixed RPC token and under-documents automatic cloud transfer and local deletion, so it needs review before installation.

Install only if you control the aria2 daemon and the 115 transfer hook, replace and rotate the published RPC token, bind RPC to localhost or otherwise restrict access, and require explicit confirmation before cloud transfer or local deletion. Review any host-side completion script separately because it is not included in this skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18

Finding

Hardcoded aria2 RPC Secret Exposes Download-Service Control

Content

View full analysis

` 或配置环境变量 - **下载目录**: 根据主机情况调整 ## 添加下载任务 ### 磁力链接或 HTTP ```bash # 请将 替换为实际密钥 curl -s http://localhost:6800/jsonrpc -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":"1","method":"aria2.addUri","params":["token:e603c18b871468e81ec2b2458d3356e5",[""]]}' ``` ``` The same credential is also embedded in all other documented RPC operations, including torrent submission, task enumeration, status queries, pause, resume, removal, and version checks. ### Technical Analysis The Skill claims that users should supply `` or use an environment variable, but its operational examples instead contain the fixed secret: ```text e603c18b871468e81ec2b2458d3356e5 ``` Publishing a reusable authentication secret in Skill instructions exposes it to everyone who can read the package. It may also be copied into generated commands, shell history, Agent logs, and conversation transcripts. If a deployed aria2 instance uses this credential, possession of the Skill is sufficient to authenticate to that service. The commands submit the credential through `http://localhost:6800`, without transport encryption. Loopback binding limits network exposure when correctly enforced, but the credential can still be observed in process activity, logs, command history, or by local processes. The risk increases substantially if aria2 is bound to a non-loopback interface, exposed through a container port, or forwarded through a reverse proxy. ### Attack Path 1. An attacker obtains the published Skill file, a transcript containing one of its commands, or shell history generated from the instructions. 2. The ...[truncated 1063 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:21

Finding

Unsafe Textual Substitution in Shell Commands Can Enable Command Injection

Content

View full analysis

替换为实际密钥 curl -s http://localhost:6800/jsonrpc -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":"1","method":"aria2.addUri","params":["token:e603c18b871468e81ec2b2458d3356e5",[""]]}' ``` ### 种子文件 ```bash # 先 base64 编码 TORRENT_B64=$(base64 -w0 /path/to/file.torrent) curl -s http://localhost:6800/jsonrpc -H "Content-Type: application/json" \ -d "{\"jsonrpc\":\"2.0\",\"id\":\"1\",\"method\":\"aria2.addTorrent\",\"params\":[\"token:e603c18b871468e81ec2b2458d3356e5\",\"$TORRENT_B64\"]}" ``` ``` ### Technical Analysis The Skill directs the Agent to replace `` and `/path/to/file.torrent` inside shell command templates. It does not define validation or safe argument construction. The URL is positioned inside a single-quoted shell argument. If an untrusted URL containing a single quote is inserted through direct textual substitution, the quote terminates the intended JSON argument. Subsequent shell metacharacters can then be interpreted as command syntax rather than URL data. The torrent path is also shown as an unquoted shell operand: ```bash base64 -w0 /path/to/file.torrent ``` Replacing it with an untrusted path permits word splitting, wildcard expansion, option injection, and interpretation of shell metacharacters. Prefixing an attacker-controlled filename with `-` may additionally cause it to be interpreted as a command option unless `--` is used. The base64 value itself is substantially less dangerous because standard base64 output does not contain shell quotes, but the surrounding pattern still relies on hand-built JSON and shell interpolation rather than a structured JSON encoder. ### Attack Path 1. An attacker submits a download request containing a spec ...[truncated 1422 chars]

Remediation

View remediation

` or file-path placeholders. 2. Build JSON with a structured encoder such as `jq`, passing untrusted data through `--arg`: ```bash payload=$(jq -n \ --arg token "token:${ARIA2_RPC_SECRET:?ARIA2_RPC_SECRET is required}" \ --arg url "$url" \ '{jsonrpc:"2.0", id:"1", method:"aria2.addUri", params:[$token, [$url]]}') curl --silent --show-error \ --header "Content-Type: application/json" \ --data-binary "$payload" \ http://127.0.0.1:6800/jsonrpc ``` 3. Quote torrent paths and terminate option parsing: ```bash TORRENT_B64=$(base64 -w0 -- "$torrent_path") ``` 4. Validate URL schemes against an explicit allowlist, such as `https`, `http`, and `magnet`, before submitting data to aria2. 5. Resolve and validate torrent paths against an approved directory. Reject paths containing unexpected control characters and prevent traversal outside the permitted location. 6. Prefer direct process execution with an argument array rather than invoking a shell. 7. If a shell is unavoidable, keep all untrusted values in variables, quote every expansion, and use a JSON encoder rather than manual escaping. 8. Run the Agent and aria2 daemon under dedicated, minimally privileged accounts with restricted filesystem and network access to limit the impact of any injection flaw. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description mentions automatic transfer to 115 cloud and local file deletion but does not present them as a prominent warning requiring explicit user acknowledgment. Automatic exfiltration to cloud storage and deletion of local artifacts are high-sensitivity actions, and omission of a clear warning can lead to unintended data movement or loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest promises automatic upload to 115 cloud and deletion of local files, but the skill itself only documents aria2 RPC usage and defers those actions to an unspecified host-side script. This mismatch can mislead users and operators about what code actually performs data transfer and deletion, reducing reviewability and creating hidden-risk behavior outside the skill boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger scope includes broad requests like '要求下载文件时触发', which can cause the skill to activate on generic download requests without clear user intent or safety gating. In a skill that can fetch arbitrary remote content and initiate downstream upload/deletion workflows, overbroad invocation increases the chance of accidental or unsafe operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

bash

# 请将 <YOUR_RPC_SECRET> 替换为实际密钥
curl -s http://localhost:6800/jsonrpc -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":"1","method":"aria2.addUri","params":["token:e603c18b871468e81ec2b2458d3356e5",["<URL>"]]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

指定任务 (用 GID)

bash

curl -s http://localhost:6800/jsonrpc -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":"1","method":"aria2.tellStatus","params":["token:e603c18b871468e81ec2b2458d3356e5","<GID>"]}' | jq '{status, completedLength, totalLength, downloadSpeed}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

等待中的任务

bash

curl -s http://localhost:6800/jsonrpc -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":"1","method":"aria2.tellWaiting","params":["token:e603c18b871468e81ec2b2458d3356e5",0,10]}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The markdown includes a delete operation for removing tasks but provides no warning about its effect or whether removal may interrupt downloads or discard task state. For destructive actions, the skill description should make the risk visible to the user.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation says to substitute a secret, but the examples embed a concrete RPC token directly in multiple commands. Hardcoded credentials in published skill content can be copied into deployments unchanged, exposing control of the aria2 daemon to anyone with local or proxied access to the RPC endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.