得到 Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:26 PM UTC
• Version: 0.1.1

Overview

This skill appears intended to use a Dedao downloader, but it installs and runs an unverified third-party executable and may expose login cookies, so it should be reviewed before installation.

Install only if you are comfortable running a third-party native downloader with your local user privileges. Prefer QR login over pasting cookies, do not provide Dedao cookies unless you understand they are account secrets, and verify or pin the downloaded dedao-dl binary before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install_dedao_dl.py:25

Finding

Unverified Mutable Third-Party Executable Download and Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/install_dedao_dl.py:25-29, 64-76; execution requirement in SKILL.md:12-22
Vulnerability Type: Unverified remote executable retrieval and supply-chain risk
Risk Level: High

Vulnerable Code

python

api_url = "https://api.github.com/repos/yann0917/dedao-dl/releases/latest"
try:
    req = urllib.request.Request(api_url, headers={'User-Agent': 'Mozilla/5.0'})
    with urllib.request.urlopen(req) as response:
        data = json.loads(response.read().decode())

python

download_url = download_asset["browser_download_url"]
file_name = download_asset["name"]
print(f"Downloading {file_name} from {download_url}...")

try:
    urllib.request.urlretrieve(download_url, target_exe)
    print("Download complete.")

    # Make script executable on Unix systems
    if system != "windows":
        st = os.stat(target_exe)
        os.chmod(target_exe, st.st_mode | stat.S_IEXEC)

    print(f"Setup successful. You can now use ./{target_exe} (or .\\{target_exe} on Windows)")

The corresponding mandatory instruction is:

markdown

**MANDATORY FIRST STEP:** Before using any `dedao-dl` commands for the first time, you MUST run the installation script and verify the CLI is available.

Run the script to download the latest binary for the current OS:
```bash
python scripts/install_dedao_dl.py

text

### Technical Analysis

The installer resolves the mutable GitHub `latest` release and downloads an executable selected from release metadata. It does not pin a reviewed release version or asset, verify a hard-coded cryptographic checksum, validate a publisher signature, enforce an expected download size, or otherwise authenticate the downloaded binary independently of the distribution channel.

The downloaded file is subsequently granted executable permission. Because the effective program is obtained after review and can change whenever th
...[truncated 1904 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an explicitly reviewed dedao-dl release version rather than resolving releases/latest.
2. Pin the exact expected asset name for each supported operating system and architecture.
3. Store an independently obtained SHA-256 or stronger digest for each approved asset and verify it before renaming or executing the download.
4. Prefer signed release artifacts and verify the signature against a pinned, trusted publisher key.
5. Download into a newly created temporary file with restrictive permissions, validate it, and atomically move it into the fixed installation location only after all checks succeed.
6. Reject unexpected redirects, final hosts, content types, file sizes, and platform formats.
7. Require explicit user approval before downloading or executing third-party native code; do not make installation an unconditional mandatory action.
8. Run the executable in a sandbox with minimal filesystem and network access. Avoid exposing unrelated environment variables or credentials.
9. Document the precise upstream version, digest, signer identity, and update procedure so dependency updates receive security review.

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/run_dedao.py:47

Finding

Executable Search and Existing-File Trust Permit Local Tool Hijacking

Content

View full analysis

Vulnerability Details

File Location: scripts/install_dedao_dl.py:22-24; scripts/run_dedao.py:47-60
Vulnerability Type: Local executable substitution through unsafe lookup and trust rules
Risk Level: High

Vulnerable Code

The installer silently accepts any existing same-named file:

python

target_exe = "dedao-dl.exe" if system == "windows" else "dedao-dl"
if os.path.exists(target_exe):
    print(f"'{target_exe}' already exists in current directory. Setup complete.")
    return

The execution wrapper falls back to the current working directory and then to executable lookup through the process environment:

python

# Determine executable name
exe_name = "dedao-dl.exe" if platform.system().lower() == "windows" else "./dedao-dl"

# Find the executable in the parent directory of this script
script_dir = os.path.dirname(os.path.abspath(__file__))
parent_dir = os.path.dirname(script_dir)
exe_path = os.path.join(parent_dir, exe_name)

if not os.path.exists(exe_path):
    # Try current working directory
    exe_path = os.path.join(os.getcwd(), exe_name)
    if not os.path.exists(exe_path):
        exe_path = exe_name # Fallback to looking in PATH

command = [exe_path] + sys.argv[1:]

The selected executable is then launched:

python

result = subprocess.run(
    command,
    stdout=subprocess.PIPE,
    stderr=subprocess.STDOUT,
    text=True,
    encoding='utf-8',
    errors='replace'
)

Technical Analysis

The installer treats the existence of a same-named file in its current working directory as proof that installation is complete. It performs no checksum, signature, ownership, regular-file, permission, or symbolic-link validation.

The wrapper initially targets the project-root executable. If that file is absent, it searches the caller's current working directory and ultimately relies on executable resolution through the environment. These fall ...[truncated 2116 chars]

Remediation

View remediation

Remediation Suggestions

1. Install and execute the binary only from one canonical absolute path derived from the trusted Skill directory.
2. Remove current-working-directory and environment-based executable lookup fallbacks.
3. Do not treat file existence as successful installation. Verify the approved cryptographic digest and publisher signature before every execution.
4. Use os.lstat or equivalent checks to reject symbolic links, non-regular files, unexpected owners, and unsafe writable permissions.
5. Ensure the installation directory is not writable by untrusted users and create installed files with restrictive permissions.
6. If an existing file fails verification, stop with a clear security error rather than executing it or silently replacing it.
7. Keep argument-vector execution without shell=True, as the existing subprocess invocation appropriately avoids direct shell interpretation.
8. Avoid passing authentication cookies on the command line where feasible. Prefer protected standard input, a restrictive credential file, or another mechanism that does not expose secrets through process arguments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is content interaction, but the skill's mandatory first step is to download and install a binary from external sources via a script. This hidden setup behavior expands the trust boundary to remote release infrastructure and local shell execution, creating supply-chain and remote code execution risk that is not apparent from the description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to run installation and CLI commands with shell and network effects, but it declares no explicit tool scope or permissions boundaries. That creates an authorization gap where a reviewer or runtime may not realize the skill can execute commands and fetch remote content, increasing the chance of unsafe or unintended execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells the agent to pass a raw cookie string on the command line without warning about its sensitivity. Command-line credentials can be exposed through shell history, process listings, logs, transcripts, or agent telemetry, enabling account takeover for the user's Dedao account.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/install_dedao_dl.py (reported line 27)May include surrounding context.

python

print(f"'{target_exe}' already exists in current directory. Setup complete.")
        return

    api_url = "https://api.github.com/repos/yann0917/dedao-dl/releases/latest"
    try:
        req = urllib.request.Request(api_url, headers={'User-Agent': 'Mozilla/5.0'})
        with urllib.request.urlopen(req) as response:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script downloads a release asset from the internet and saves it directly as an executable in the current directory, then marks it executable on Unix. There is no integrity verification, signature/checksum validation, or explicit warning/confirmation before writing a runnable binary, so a compromised upstream release, repository, or network trust boundary could lead to execution of malicious code.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_dedao.py (reported line 63)May include surrounding context.

python

try:
        # Run process
        result = subprocess.run(
            command,
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT, # Merge stderr into stdout

Static analysis

No suspicious patterns detected.