ClawHub
Back to skill

Security audit

Stremio CLI

Security checks for vulnerabilities and agentic risk

Overview

This Stremio automation is mostly aligned with media playback, but it should be reviewed because it exposes account details and ships a legacy script with under-disclosed casting, unsafe browser flags, and stream URL handling.

Install only if you are comfortable with a skill that can use an existing Stremio login on the Mac Mini. Before use, remove the exposed account email from the skill text, require explicit confirmation before playback, and either delete the legacy script or document and constrain its casting behavior, stream URL handling, and browser security settings.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/stremio_cast.py:13
Finding

Chromium Sandbox and TLS Certificate Validation Disabled

Content
View full analysis

Vulnerability Details

File Location: scripts/stremio_cast.py, line 13
Vulnerability Type: Unsafe browser security configuration
Risk Level: High

Vulnerable Code

python
browser = await p.chromium.launch(headless=True, args=['--no-sandbox', '--disable-setuid-sandbox', '--ignore-certificate-errors'])

Technical Analysis

The script launches Chromium with three security-sensitive options:

  • --no-sandbox disables Chromium's process sandbox.
  • --disable-setuid-sandbox disables the setuid sandbox mechanism.
  • --ignore-certificate-errors accepts TLS certificates that would ordinarily fail validation.

Disabling certificate validation permits the browser to connect to an unauthenticated or intercepted HTTPS endpoint. Disabling both sandbox mechanisms then weakens containment if remotely supplied browser content exploits a Chromium vulnerability.

This does not independently grant code execution, but it removes defense-in-depth controls from a browser that processes remote, potentially attacker-influenced content.

Attack Path

  1. An attacker compromises a remote service loaded by the automated browser, controls a relevant network path, or redirects the browser to attacker-controlled content.
  2. The attacker presents an invalid or untrusted TLS certificate that Chromium accepts because --ignore-certificate-errors is enabled.
  3. Malicious web content is delivered to the browser.
  4. The content exploits a compatible Chromium or browser-component vulnerability.
  5. Because browser sandboxing is disabled, the exploit has fewer containment boundaries and may execute with the privileges of the account running the script.

Exploitation requires a suitable browser vulnerability or another means of executing code in the browser process; the insecure flags materially increase the resulting likelihood and impact.

Impact Assessment

A successful exploit could affect files, credentials, pr ...[truncated 326 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove --no-sandbox, --disable-setuid-sandbox, and --ignore-certificate-errors.
  • Run Chromium with its default sandbox enabled under a dedicated, non-privileged operating-system account.
  • Require valid, trusted TLS certificates for every remote endpoint.
  • If a private service requires a private certificate authority, install and trust only that specific CA instead of globally suppressing certificate errors.
  • Keep Playwright and its Chromium distribution updated with supported security patches.
  • Restrict browser egress to the minimum required domains and reject unexpected redirects.
  • Fail closed when certificate validation or browser initialization fails.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/stremio_cast.py:20
Finding

Full Stream URLs Disclosed Through Application Logs

Content
View full analysis

Vulnerability Details

File Location: scripts/stremio_cast.py, lines 20–24
Vulnerability Type: Sensitive information exposure and insufficient URL validation
Risk Level: Medium

Vulnerable Code

python
async def handle_request(request):
    nonlocal stream_url
    url = request.url
    if 'stremio.rocks' in url and ('/stream/' in url or url.endswith('.mp4')):
        stream_url = url
        print(f"[Moltbot] URL de stream encontrada: {stream_url}")

Technical Analysis

The request handler records and prints the complete URL of any matching media request. Full stream URLs can contain opaque resource identifiers, temporary access tokens, query parameters, internal routing information, or private service addresses. Standard output may subsequently be retained by shell redirection, service managers, automation platforms, monitoring systems, or centralized log collectors.

The domain check also uses a substring comparison:

python
'stremio.rocks' in url

This does not verify the parsed hostname. An attacker-controlled URL such as https://stremio.rocks.attacker.example/stream/... or https://attacker.example/?next=stremio.rocks/stream/... may satisfy the condition. Consequently, an unrelated URL can be treated as a trusted stream URL, logged, and passed to catt later in the workflow.

Attack Path

  1. A remote page, compromised add-on, or intercepted browser response causes the page to request an attacker-selected URL containing both stremio.rocks and /stream/, or ending in .mp4.
  2. The substring filter accepts the URL without validating its scheme and exact hostname.
  3. The script prints the complete URL to standard output.
  4. The URL is retained in terminal, orchestration, service, or monitoring logs.
  5. A party with access to those logs can recover any embedded stream identifier, query parameter, routing information, or bearer-style access material.
  6. If the ac ...[truncated 841 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not print complete stream URLs.
  • Log only a redacted identifier or the validated hostname when diagnostic output is necessary.
  • Remove user information, query strings, fragments, credentials, and sensitive path components before logging.
  • Parse URLs with urllib.parse.urlparse and require an allowed scheme such as https.
  • Compare the normalized parsed hostname against an explicit allowlist rather than using substring matching.
  • Reject URLs containing embedded credentials, unexpected ports, malformed hostnames, or unapproved redirects.
  • Validate the final URL again immediately before passing it to catt.
  • Apply restrictive permissions and short retention periods to any logs that may already contain media URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The documented behavior does not match the actual behavior: the underlying implementation appears to cast to external devices, clicks the first stream rather than selecting by seed quality, and does not implement the described credential flow. This is dangerous because users and reviewers may authorize a benign-seeming media skill while it performs additional network/device actions that could affect privacy, device control, and trust boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description reveals that Stremio account credentials are stored in Keychain but does not present this as sensitive or warn users that the skill may act through saved credentials. This creates a misleading trust model where a user may not realize requests could trigger actions under an existing authenticated account on the Mac Mini.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares no explicit tool scope while the analysis detected code capabilities involving shell access, creating a mismatch between what reviewers/users can see and what the skill may invoke. In a skill that automates playback and references local credentials, undeclared execution capability increases the chance of hidden or over-privileged actions on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill documentation exposes a specific personal email address associated with the Stremio account, which is unnecessary for normal operation. Publishing account identifiers increases privacy risk, enables targeting or phishing, and signals the presence of a reusable authenticated account on the machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill states that account credentials are saved and implies account-backed playback behavior, but it does not warn users that requests may execute through a logged-in account. This can lead to unintentional use of personal subscriptions, history, preferences, or other account-linked actions without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to overlap with ordinary conversation, making accidental invocation more likely. Because this skill can drive a browser, use an authenticated account, and initiate media playback, ambiguous activation expands the chance of unintended actions without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Using vague natural-language triggers like 'watch latest episode' makes the skill easy to activate in contexts where the user may not mean to invoke this specific automation. In this skill, ambiguity is more dangerous because it may leverage saved login state and perform browser-driven playback actions on a real device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script hard-codes a remote streaming server endpoint and automatically connects to it, which can expose viewing activity, identifiers, and potentially account-linked behavior to an external service without explicit runtime disclosure. In this skill, the risk is heightened because it also mentions credentials in Keychain and automates account-backed media access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script can cast media to an arbitrary device name supplied at runtime, which extends its effect beyond local browser automation into direct control of external household devices. In the skill context, this is more sensitive because the metadata emphasizes Stremio playback and stored credentials, while device-side actions are not clearly bounded or disclosed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

Launching a separate system command to control an external playback device is a materially different capability from browser automation for Stremio. The manifest does not mention shelling out or using a local casting utility, so this capability is not clearly within the declared scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/stremio_cast.py (reported line 62)May include surrounding context.

python
print(f"[Moltbot] Transmitindo para {device}...")
            try:
                # Nota: Assume que 'catt' está instalado no ambiente
                subprocess.Popen(['catt', '-d', device, 'cast', stream_url])
                print(f"Sucesso: Reproduzindo '{query}' em {device}.")
                # Mantemos o script rodando por um tempo para garantir que o stream inicie
                # No ambiente real, o processo pai deve gerenciar o ciclo de vida do navegador

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code captures a stream URL from browser traffic and forwards it to an external casting tool, causing content and associated metadata to be sent to another device/process without clear user-facing disclosure. Because the URL is dynamically extracted from network requests, it may also contain sensitive tokens or temporary access parameters that should not be propagated loosely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's printed status and usage messages are written in Portuguese, which imposes a specific language on users. There is no opt-in, fallback, or documentation indicating that this skill is intentionally limited to Portuguese-speaking users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.