Security audit
Security checks for vulnerabilities and agentic risk
This downloader needs review because it can use preset proxies and saved logins without clear approval, and its filename protections are incomplete.
Before installing, require removal of unapproved built-in proxies, explicit permission before saved-login use, and corrected filename validation with safe command argument handling. Use temporary Windows proxy settings unless you explicitly want permanent changes affecting other applications.
scripts/proxy_chain.pyAutomatic fallback routes downloads through an unapproved LAN proxy
For HTTP downloads, the intermediary receives full request URLs, including any query-string download tokens, and can read or replace downloaded content. For HTTPS, ordinary certificate validation protects request contents, but the proxy still learns the destination hostname. No TLS bypass is established.
The supplied command invokes unit tests and contains no URL analysis or download operation. Although tests could support a downloader project, the provided chunk establishes no such connection. The internal behavior of evals.test_detect is not shown and cannot be inferred.
The README describes activation whenever a user supplies a URL, without requiring an explicit download request, and then directs the agent to select a destination and download it. This can turn a request to discuss or inspect a link into unintended network access and local file creation, potentially consuming substantial bandwidth or storage. Automatic downloading is appropriate for this skill's purpose, but merely receiving a URL is not sufficient authorization; requiring approval for tool installation does not address that gap.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow automatically retries failed downloads through a proxy chain without requiring advance disclosure or establishing that its entries are user-approved. This can expose destination metadata to an unexpected intermediary and, for plain HTTP, expose full URLs, tokens, and downloaded content; respecting NO_PROXY and reporting proxy use afterward only partially mitigate the risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
按输出 chain 顺序逐条重试，第一条成功即停。
**NO_PROXY 强制规则**：目标域名匹配 `NO_PROXY` 环境变量时**禁用代理**，即使代理链里有可用项。
例：`https://api.sensenova.cn/...` 永远直连，不走任何代理。
**三工具的代理参数**：
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
按输出 chain 顺序逐条重试，第一条成功即停。
**NO_PROXY 强制规则**：目标域名匹配 `NO_PROXY` 时禁用代理，即使代理链里有可用项。
例：`https://api.sensenova.cn/...` 永远直连，不走任何代理。
**三工具的代理参数**：
The proposed workflow automatically retries downloads through hardcoded proxies, including a private-LAN address whose ownership and trustworthiness are not established for other users. A proxy can observe destination metadata and, for unencrypted HTTP downloads, sensitive URLs, headers, and content or modify responses; reporting proxy use afterward does not provide prior consent. Direct-first behavior and NO_PROXY enforcement reduce exposure but do not establish authorization to use these built-in endpoints.
uvx/uv tool run commands without ==version create a rug-pull risk.
The workflow directs the agent to automatically fill saved credentials when a download URL requires login, without requiring user approval or checking that the login page belongs to the intended service. An attacker-controlled URL or login redirect could therefore trigger unintended credential use; credential exposure would depend on the vault tool's origin-matching protections. Authentication can legitimately support downloading, and the instructions prohibit guessing passwords or harvesting cookies, but those safeguards do not address authorization for vault access.
These commands persist HTTP_PROXY, HTTPS_PROXY, and NO_PROXY in the user's environment, affecting future applications that honor those variables. Although configuring a proxy for a download can be appropriate, permanently routing unrelated applications through a fixed local proxy and adding a domain-specific bypass exceeds the stated URL-analysis and download purpose.
The instructions automatically retry failed downloads through a proxy without disclosing the change in network trust or obtaining consent. A proxy can observe destination and traffic metadata, and for unencrypted HTTP may also read sensitive URL tokens or modify downloaded content; HTTPS generally protects URL paths and content unless TLS is intercepted. This is particularly relevant for a downloader handling arbitrary URLs, although the referenced proxy implementation is unavailable and its trustworthiness cannot be determined here.
The curl recipe writes directly to the chosen output path and can truncate an existing file without an overwrite check or confirmation. Confirming the destination directory does not necessarily authorize replacing a file within it, and the filename comes from detection whose collision handling is not shown. A collision can therefore cause loss of existing data, with damage limited by the agent's filesystem permissions.
The instructions automatically retry downloads through a proxy chain after direct connections fail, without requiring disclosure or approval of the proxy operator. This can unexpectedly expose destination metadata to that operator, and unencrypted HTTP downloads can additionally expose URL tokens and downloaded content or permit content modification; normal HTTPS certificate validation limits those risks for HTTPS. Proxy support is legitimate for a downloading skill, and respecting NO_PROXY reduces exposure, but the supplied file does not establish that fallback proxies are trusted or explicitly approved.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Never raises — returns (None, error_msg) on failure.
"""
try:
r = subprocess.run(
cmd, capture_output=True, text=True, timeout=timeout, check=False
)
return (r.stdout or "").strip(), (r.stderr or "").strip()
The docstring at L158-L164 explicitly promises path-traversal prevention and rejection of '..', but L175-L178 checks only for '..'; replacing separators does not transform consecutive dots into that pattern. Consequently, a magnet URL with dn=.. passes through L236-L240 and produces dest_name='..', contradicting the documented safety guarantee for downstream consumers.
L017 states that the checker checks the local filesystem only, but L158 invokes run_version_cmd, which executes each available tool with --version. Executing a discovered executable is materially different from inspecting filesystem metadata, although this code does not establish that network access or writes actually occur.
No suspicious patterns detected.