T08 · Insecure Dependencies
Warning
- Location
SKILL.md:19- Finding
Unpinned and Unnecessary Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Movie Advisor
Security checks for vulnerabilities and agentic risk
Overview
The skill is a movie-advisor stub, but it silently stores user queries locally and asks users to install unused unpinned dependencies.
Review this skill before installing. It does not appear malicious or destructive, but users should know that its CLI is mostly a stub, it retains local query history in plaintext, and the documented dependency install adds avoidable supply-chain exposure unless the implementation is changed or dependencies are pinned and actually used.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/movie_advisor_tool.py:44- Finding
Undisclosed Plaintext Retention of Raw Command Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger keywords are very broad and include common terms like 'movie,' 'film,' and 'what to watch,' which can cause the skill to activate for generic entertainment queries that do not clearly request this specific tool. That can lead to inappropriate routing, reduced user control, and accidental invocation of external-data workflows, though it does not by itself enable code execution or direct data compromise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill defines a platform scope centered on major global services and explicitly excludes mainland China's domestic apps without user opt-in or contextual justification. This can bias results, omit relevant local options, and produce misleading availability guidance for users in excluded regions, making the skill less trustworthy and less aligned with user needs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
User-provided search terms are persisted to disk in a JSON file without notice, consent, retention controls, or minimization. In an agent skill context, queries may contain sensitive preferences, private titles, account-related details, or other personal data, so silent local logging creates a privacy exposure if the host is shared, the data directory is backed up, or logs are later repurposed.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level documentation claims a movie advisor CLI with recommend, search, and detail flows, which implies those operations are actually implemented. In code, each command only appends the raw input to a local JSON file and returns a generic success message plus reference URLs, so the documented behavior materially overstates what the tool does.
- Content