Security audit

Dwnldr

Security checks for vulnerabilities and agentic risk

Overview

This downloader skill has a coherent media-download purpose, but it asks the agent to download, strip provenance metadata, send files onward, and use Chrome session cookies without clear user confirmation.

Review before installing. Only use this skill if you are comfortable with automatic downloads, local file writes, metadata removal, and sending files through Telegram or LocalSend. Do not allow browser-cookie access unless you explicitly intend authenticated downloading from a specific profile, and prefer a revision that requires confirmation before downloading, stripping metadata, or forwarding files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:18
Finding: Automatic URL Trigger Overrides Explicit User Intent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:38
Finding: Unsafe Shell Command Construction with Untrusted Values
Content: View full analysis
" ``` ```bash yt-dlp --js-runtimes nodejs \ -f "best" \ --no-playlist \ --output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s" \ "" ``` ```bash ffmpeg -i "/home/rami/.openclaw/workspace/_incoming/" \ -map_metadata -1 \ -fflags +bitexact \ -flags:v +bitexact \ -flags:a +bitexact \ -c copy \ "/home/rami/.openclaw/workspace/_incoming/_clean.mp4" \ && mv "/home/rami/.openclaw/workspace/_incoming/_clean.mp4" \ "/home/rami/.openclaw/workspace/_incoming/" ``` ```bash ls -lh /home/rami/.openclaw/workspace/_incoming/ ``` ```bash openclaw message send \ --channel telegram \ --target \ --message "🎬 Downloaded: " \ --media /home/rami/.openclaw/workspace/_incoming/<filename> ``` ```bash localsend-cli send --to "<user_device>" /home/rami/.openclaw/workspace/_incoming/<filename> ``` The same substitution pattern also appears in the audio-only and playlist commands: ```bash yt-dlp --js-runtimes nodejs \ -x --audio-format mp3 \ --output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s" \ "<URL>" ``` ```bash yt-dlp --js-runtimes nodejs \ -f "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best" \ --merge-output-format mp4 \ --output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s" \ "<URL>" ``` ### Technical Analysis The Skill expresses operations as shell command templates containing placeholders such as `<URL>`, ...[truncated 2963 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:151
Finding: Chrome Session Cookies May Be Accessed Without Explicit Consent
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The description uses language like 'metadata scrubbed clean' and 'No traces, no evidence,' which overtly promotes concealment and evidence removal. In the context of an automated downloader and file-forwarding skill, this materially raises concern that the skill is designed to help users obscure origin and accountability rather than simply download media.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: dwnldr description: "Yarr! Plunder videos from the seven seas of the internet — YouTube, TikTok, Instagram, X, Reddit & 1000+ ports o' call. Drop a link, get full quality loot with metadata scrubbed clean. No traces, no evidence, just pure content booty delivered straight to yer Telegram. Supports MP4, MP3, playlists, and more." metadata: openclaw: emoji: "🏴‍☠️" trigger: "/dl" requires: bins: - yt-dlp - ffmpeg --- # Video Downloader Download videos from **YouTube, TikTok, Instagram, Twitter/X**, and 1000+ sites. Just paste a link — the video gets dow

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 91% confidence
Finding: The cookies-from-browser chrome instruction matches information-stealer patterns because it directs the tool to extract browser-resident authentication material. Although the apparent goal is downloading age-restricted media rather than stealing credentials, the technique still touches sensitive session data and could be abused to access protected content.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
f "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best"
--merge-output-format mp4
--output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s"
""

text
Remove `--no-playlist` flag for playlists. ## Error Handling | Error | Fix | |-------|-----| | "Video unavailable" | Private/deleted video — notify user | | "Sign in to confirm" | Age-restricted — try with `--cookies-from-browser chrome` | | Geographic restriction | Try with `--geo-bypass` | | Rate limited | Wait 30s and retry once | | Merge failed | Fallback to `-f best` (single stream) | ## Callback Reference | callback_data | Action | |---------------|--------| | `dl:another` | Prompt for another URL | | `dl:localsend` | Send last downloaded file via LocalSend | | `dl:delete` | Delete the downloaded file | | `dl:audio` | Re-download as MP3 | ## CLI Reference | Command | Usage | |---------|-------| | Best quality | `yt-dlp -f "bestvideo+bestaudio/best" --merge-output-format mp4 URL` | | Audio

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to auto-trigger on matching URLs and immediately perform downloads, file writes, and onward transmission without confirming user intent or warning about external network access. This increases the risk of unintended actions, SSRF-like retrieval of attacker-chosen resources through supported domains, and surprise exfiltration of content to Telegram or LocalSend.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The metadata-stripping step intentionally removes provenance fields such as source URL, timestamps, and creator information without prominently warning the user. This can facilitate misuse by erasing attribution and traceability, and it may destroy information users expect to preserve for compliance, auditing, or evidentiary purposes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly recommends --cookies-from-browser chrome to bypass age restrictions, which expands behavior from media downloading into accessing local browser session data. Even if intended as a convenience workaround, this creates unnecessary exposure of authenticated cookies and could enable access to private or account-scoped content beyond the downloader's stated purpose.
Content: No source excerpt is available for this finding.