Security audit

Instagram Downloader

Security checks for vulnerabilities and agentic risk

Overview

This Instagram downloader is mostly coherent, but it handles live account session cookies and installs agent files in ways that need careful review before use.

Install only if you are comfortable giving this tool access to an Instagram session cookie. Prefer reviewing and running from a pinned source checkout, avoid curl|bash or iex installers, use a dedicated/least-privileged Instagram account, do not pass session cookies or API tokens on the command line, and remove ~/.ig-downloader credentials when done. Avoid processing untrusted Apify/toon datasets until URL and path validation are fixed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:27
Finding: Mutable Remote Installer Is Downloaded and Executed Without Verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: pyproject.toml:15
Finding: Unpinned Dependencies and Mutable Git Installation Create Supply-Chain Exposure
Content: View full analysis
=2.31.0", "instagrapi>=2.0.0", "playwright>=1.48.0", ] ``` The same lower-bound-only constraints appear in `requirements.txt`: ```text requests>=2.31.0 instagrapi>=2.0.0 playwright>=1.48.0 ``` The shell installer installs the newest matching packages and may install the project directly from the repository: ```bash $pip_cmd install instagrapi requests playwright 2>/dev/null || \ warn "Some dependencies failed. Try: ${pip_cmd} install instagrapi requests" $pip_cmd install "git+${REPO_URL}" 2>/dev/null ``` ### Technical Analysis All dependencies use open-ended lower bounds. A fresh installation can therefore resolve to versions that did not exist when the Skill was audited. There is no lock file, hash verification, constraints file, or reproducible environment. The installer further bypasses an immutable package artifact by using `pip install git+https://github.com/...`, without a tag or commit SHA. The resulting installed code depends on the repository state at installation time. These dependencies are highly privileged in context: - `requests` performs arbitrary network operations. - `instagrapi` receives an Instagram authentication session. - `playwright` controls a browser context containing a valid login. - The project itself is installed as an executable CLI. A malicious or compromised future dependency release could access the session cookie, filesystem, network, or Agent configuration during installation or runtime. ### Attack Path 1. An attacker compromises a dependency publisher account, package release process, or project repository. 2. The attacker publishes a newer package version satis ...[truncated 841 chars]
Remediation: View remediation
``` 4. Prefer signed release artifacts from a trusted registry over direct VCS installation. 5. Install into a dedicated virtual environment instead of the user's global Python environment. 6. Run automated dependency vulnerability and provenance checks. 7. Review dependency updates explicitly and regenerate hashes through a controlled process. 8. Avoid silently suppressing `pip` output, because doing so hides provenance and installation warnings. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: instagram_downloader.py:213
Finding: Instagram Authentication Session Is Persisted in Plaintext Without Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: instagram_downloader.py:710
Finding: Untrusted Dataset URLs Permit Server-Side Request Forgery and Arbitrary Network Access
Content: View full analysis
bool: """Download a file with retries. Uses instagrapi for fbcdn.net URLs when available.""" for attempt in range(1, max_retries + 1): try: if insta_helper and insta_helper.is_available(): if insta_helper.download_url(url, filepath): size_kb = os.path.getsize(filepath) / 1024 print(f" [OK] {os.path.basename(filepath)} ({size_kb:.1f} KB)") return True resp = requests.get(url, headers={ "User-Agent": DEFAULT_USER_AGENT, "Accept": "*/*", "Referer": "https://www.instagram.com/", }, timeout=60, stream=True, verify=verify) if resp.status_code == 200: os.makedirs(os.path.dirname(filepath), exist_ok=True) with open(filepath, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): f.write(chunk) ``` The values passed as `url` originate from dataset-controlled fields: ```python video_url = raw.get("video_url_no_watermark") # ... "video_url": video_url, "thumbnail_url": raw.get("thumbnail_url"), ``` ### Technical Analysis Apify API responses and local toon files are treated as trusted media catalogs. Their `video_url` and `thumbnail_url` values are passed to `requests.get()` without validating the scheme, hostname, resolved IP address, redirect destination, or expe ...[truncated 2008 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: instagram_downloader.py:806
Finding: Dataset-Controlled Shortcodes Enable Output Directory Traversal and Arbitrary File Writes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: instagram_downloader.py:616
Finding: Apify API Token Is Placed in the Request URL Query String
Content: View full analysis
list[dict]: """Fetch dataset items from Apify API directly.""" url = f"{APIFY_API_BASE}/datasets/{dataset_id}/items" resp = requests.get(url, params={"token": api_token}, timeout=120) resp.raise_for_status() return resp.json() ``` ### Technical Analysis `requests.get(..., params={"token": api_token})` serializes the Apify API token into the URL query string. Although HTTPS protects the request in transit under normal conditions, URLs are commonly captured by: - HTTP client debug logs and exception telemetry. - Forward proxies and security gateways. - Server access logs. - Application performance monitoring. - Diagnostic traces and crash reports. Query-string credentials have broader accidental exposure than authorization headers. The token is necessary for the declared Apify mode, but placing it in the URL is not the least-exposure method. The CLI also accepts the token through `--api-token`, which can expose it in shell history and process listings. ### Attack Path 1. A user invokes the downloader with a valid Apify token. 2. The token is placed in the outgoing request URL. 3. A proxy, HTTP debug logger, telemetry agent, or server access log records the full URL. 4. A user or service with access to those logs recovers the token. 5. The token is reused against the Apify API according to its assigned permissions. ### Impact Assessment Impact is limited to the permissions and lifetime of the exposed Apify token. Depending on its scope, an attacker may read datasets, consume account resources, access Actor data, or incur charges. The code sends the token only to the fixed HTTPS Apify API base, so this is not evidence of intentional exfiltration. It is an avoidable ...[truncated 32 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (52)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · CHANGELOG.md (reported line 44)May include surrounding context.
md
- **agents:** replace ASCII decision tree with Mermaid flowchart ([7cd2253](https://github.com/CripterHack/ig-downloader-skill/commit/7cd2253)) - **skill:** replace ASCII architecture with Mermaid diagrams (modes, sessionid flow, setup chain) ([7f4d72e](https://github.com/CripterHack/ig-downloader-skill/commit/7f4d72e)) - **readme:** update README.md to v2.2 — remove login references, add broken login warning, promote Playwright ([9afa78c](https://github.com/CripterHack/ig-downloader-skill/commit/9afa78c)) - **skill:** update SKILL.md to v2.2 — remove login mode, promote sessionid + Playwright setup ([97cf4c9](https://github.com/CripterHack/ig-downloader-skill/commit/97cf4c9)) - bump pyproject.toml to v2.2.0, add playwright dependency ([cb85b59](https://github.com/CripterHack/ig-downloader-skill/commit/cb85b59)) - **agents:** add AGENTS.md with mode selection logic, decision tree, and agent instructions ([88f3793](https://github.com/CripterHack/ig-downloader-skill/commit/88f3793)) - **changelog:** add v2.2.0 entry for Playwright interactive setup ([857fd1c](https://github.com/CripterHack/ig-downloader-skill/commit/857fd1c))

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · CHANGELOG.md (reported line 49)May include surrounding context.
md
- **agents:** replace ASCII decision tree with Mermaid flowchart ([7cd2253](https://github.com/CripterHack/ig-downloader-skill/commit/7cd2253)) - **skill:** replace ASCII architecture with Mermaid diagrams (modes, sessionid flow, setup chain) ([7f4d72e](https://github.com/CripterHack/ig-downloader-skill/commit/7f4d72e)) - **readme:** update README.md to v2.2 — remove login references, add broken login warning, promote Playwright ([9afa78c](https://github.com/CripterHack/ig-downloader-skill/commit/9afa78c)) - **skill:** update SKILL.md to v2.2 — remove login mode, promote sessionid + Playwright setup ([97cf4c9](https://github.com/CripterHack/ig-downloader-skill/commit/97cf4c9)) - bump pyproject.toml to v2.2.0, add playwright dependency ([cb85b59](https://github.com/CripterHack/ig-downloader-skill/commit/cb85b59)) - **agents:** add AGENTS.md with mode selection logic, decision tree, and agent instructions ([88f3793](https://github.com/CripterHack/ig-downloader-skill/commit/88f3793)) - **changelog:** add v2.2.0 entry for Playwright interactive setup ([857fd1c](https://github.com/CripterHack/ig-downloader-skill/commit/857fd1c))

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · CHANGELOG.md (reported line 52)May include surrounding context.
md
- **skill:** update SKILL.md to v2.1 — login mode with 2FA, challenge handling, saved sessions, 4-mode architecture ([af6e105](https://github.com/CripterHack/ig-downloader-skill/commit/af6e105)) - **changelog:** add v2.0.0 entry — sessionid mode, setup wizard, config management, Chrome cookie extraction ([e352843](https://github.com/CripterHack/ig-downloader-skill/commit/e352843)) - **readme:** rewrite README.md for v2.0 — sessionid quick-start, three-mode comparison, setup wizard, cookie extraction guide ([b0ada50](https://github.com/CripterHack/ig-downloader-skill/commit/b0ada50)) - **skill:** rewrite SKILL.md for v2.0 — sessionid mode, setup wizard, three-mode architecture, config management ([4e91ce8](https://github.com/CripterHack/ig-downloader-skill/commit/4e91ce8)) - **script:** update docstring for v2.0 three-mode architecture (sessionid, Apify, setup) ([19129ee](https://github.com/CripterHack/ig-downloader-skill/commit/19129ee)) - remove backup files, add to .gitignore ([5e26048](https://github.com/CripterHack/ig-downloader-skill/commit/5e26048)) - add unit tests for parser, normalizer, and filter logic ([5c1991f](https://github.com/CripterHack/ig-downloader-skill/commit/5c1991f))

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | bash chaining pattern is a classic unsafe bootstrap mechanism because it combines download and execution in one step with no opportunity for inspection. If the fetched content is altered, the user immediately runs attacker-controlled shell commands locally.
Content: Scanner excerpt · README.md (reported line 122)May include surrounding context.
bash
# Option A — Universal installer (recommended) curl -fsSL https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash # Option B — From source git clone https://github.com/cripterhack/ig-downloader-skill.git

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This is the same download-and-execute chaining abuse pattern in another installation section. Given the skill's agent-integration behavior, compromise here could also implant malicious SKILL.md/AGENTS.md content into agent directories in addition to executing arbitrary code.
Content: Scanner excerpt · README.md (reported line 236)May include surrounding context.
bash
# Linux / macOS / Git Bash curl -fsSL https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash # Windows PowerShell iex (iwr -Uri https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.ps1).Content

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

Category: YARA Match
Confidence: 85% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 248)May include surrounding context.
ithubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash

Windows PowerShell

iex (iwr -Uri https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.ps1).Content

text
This installs both the Python CLI **and** the AI agent skill files (SKILL.md). After this, your AI agent can discover and use the skill automatically. ### Manual install (pip only) ```bash pip install git+https://github.com/cripterhack/ig-downloader-skill.git ig-downloader --help

From source

bash
git clone https://github.com/cripterhack/ig-downloader-skill.git cd ig-downloader-skill pip install -e . python instagram_downloader.py --help

Agent-specific install

bash
# Install only for Codex CLI (not auto-detect) ./install.sh --agent codex # Install only in current project directory ./install.sh --project # Install for ALL supported agents ./install.sh --agent all

🤖 AI Agent Integration

This project is a dual-layer tool: a Python CLI

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose frames the skill as a media downloader that does not require password sharing, yet the content describes reading and decrypting Chrome cookies, accessing browser SQLite stores, and handling login/2FA flows. This mismatch is dangerous because users and platforms may approve the skill under a narrower trust model than its actual credential-access behavior warrants.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose frames the skill as a media downloader that does not require password sharing, yet the content describes reading and decrypting Chrome cookies, accessing browser SQLite stores, and handling login/2FA flows. This mismatch is dangerous because users and platforms may approve the skill under a narrower trust model than its actual credential-access behavior warrants.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose frames the skill as a media downloader that does not require password sharing, yet the content describes reading and decrypting Chrome cookies, accessing browser SQLite stores, and handling login/2FA flows. This mismatch is dangerous because users and platforms may approve the skill under a narrower trust model than its actual credential-access behavior warrants.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code reads Chrome local state, copies the browser cookie database, decrypts cookies via DPAPI, and extracts Instagram's sessionid automatically. This is credential harvesting behavior: it accesses sensitive authentication material beyond what a downloader strictly needs and could silently take over a logged-in account if misused.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · install.sh (reported line 15)May include surrounding context.
sh
# ./install.sh --agent all # # # One-liner (auto-downloads repo) # curl -fsSL https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash # # # Via npx (if skills.sh registry is enabled) # npx skills add cripterhack/ig-downloader-skill

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions explicitly tell the agent to use highly sensitive credentials such as Instagram sessionid cookies and Apify API tokens, and they describe persisting the sessionid to ~/.ig-downloader/config.json, but they do not include any warning that these secrets grant account access and must be protected. In this skill context, that omission is security-relevant because the whole workflow centers on acquiring, storing, and reusing authentication material, increasing the chance of credential leakage through logs, screenshots, shell history, or insecure file permissions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · CHANGELOG.md (reported line 51)May include surrounding context.
md
- **readme:** update README.md to v2.1 — login mode, authentication docs, updated FAQ ([a160c42](https://github.com/CripterHack/ig-downloader-skill/commit/a160c42)) - **skill:** update SKILL.md to v2.1 — login mode with 2FA, challenge handling, saved sessions, 4-mode architecture ([af6e105](https://github.com/CripterHack/ig-downloader-skill/commit/af6e105)) - **changelog:** add v2.0.0 entry — sessionid mode, setup wizard, config management, Chrome cookie extraction ([e352843](https://github.com/CripterHack/ig-downloader-skill/commit/e352843)) - **readme:** rewrite README.md for v2.0 — sessionid quick-start, three-mode comparison, setup wizard, cookie extraction guide ([b0ada50](https://github.com/CripterHack/ig-downloader-skill/commit/b0ada50)) - **skill:** rewrite SKILL.md for v2.0 — sessionid mode, setup wizard, three-mode architecture, config management ([4e91ce8](https://github.com/CripterHack/ig-downloader-skill/commit/4e91ce8)) - **script:** update docstring for v2.0 three-mode architecture (sessionid, Apify, setup) ([19129ee](https://github.com/CripterHack/ig-downloader-skill/commit/19129ee)) - remove backup files, add to .gitignore ([5e26048](https://github.com/CripterHack/ig-downloader-skill/commit/5e26048))

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 327)May include surrounding context.
bash
# Check if skill files exist ls ~/.config/opencode/skills/instagram-downloader/SKILL.md # Check if the CLI works ig-downloader --version

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises behavior that clearly requires sensitive capabilities like filesystem access, environment-variable access, network access, and likely shell/package installation flows, but it does not declare any tool scope or permission boundaries. In an agent environment, this weakens reviewability and can cause the skill to run with broader privileges than users expect, increasing the chance of unauthorized local access or data exfiltration.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document strongly states that login flags are broken and should not be used, but later troubleshooting and known-issues sections still direct users toward username/password/TOTP login flows. Conflicting security-relevant instructions can cause users or agents to invoke deprecated authentication paths, potentially exposing credentials to nonfunctional or unstable code paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill normalizes capturing and storing a live Instagram session cookie in config.json without strong warnings that a sessionid is effectively an account bearer token. If the file, logs, shell history, or environment are exposed, an attacker could hijack the Instagram account session without needing the user's password.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The setup flow describes polling Chrome's cookie database and decrypting browser-stored cookies, which is highly sensitive local credential access. Without an explicit privacy/system-access warning and consent gate, users may not realize the skill is accessing unrelated browser credential stores and local encryption material, creating serious privacy and account-compromise risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description claims no password sharing is required, yet the code still supports direct username/password login and persists authenticated session state to disk. This mismatch can mislead users into supplying sensitive credentials they did not expect to entrust to the tool, increasing the risk of credential theft or account compromise if the host is unsafe.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation states that --login is broken and should not be used, but the executable code still attempts full credential-based login. That inconsistency can lower user vigilance and obscure the fact that the script still collects passwords and 2FA codes, which is dangerous in a tool that already handles session persistence.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · instagram_downloader.py (reported line 90)May include surrounding context.
python
CONFIG_DIR = Path.home() / ".ig-downloader" CONFIG_FILE = CONFIG_DIR / "config.json" SETTINGS_FILE = CONFIG_DIR / "settings.json" APIFY_API_BASE = "https://api.apify.com/v2" DEFAULT_USER_AGENT = ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) "

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The browser cookie extraction path accesses and decrypts a sensitive session credential without an explicit warning or consent prompt at the point where it is used. Even if intended as convenience, silently pulling authentication secrets from the user's browser materially increases the chance of unauthorized account access and violates the principle of least surprise.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: Persisting session material across runs increases exposure because a stolen or leaked config/settings file can grant ongoing authenticated access without a password. In this skill, session persistence is especially risky because the session may be sourced from browser cookies or full login, making the downloader a long-lived credential holder.
Content: Scanner excerpt · instagram_downloader.py (reported line 205)May include surrounding context.
python
# ═══════════════════════════════════════════════════════════════ def load_config(): """Load saved sessionid from config file.""" if CONFIG_FILE.exists(): try: return json.loads(CONFIG_FILE.read_text(encoding='utf-8'))

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code writes the Instagram sessionid to a config file in the user's home directory without any strong warning, encryption, or permission hardening. A session cookie is effectively a bearer token, so local compromise, backup leakage, or multi-user access could allow reuse of the account session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: During interactive setup, the tool falls back from Playwright to automatic Chrome cookie extraction without separately obtaining informed consent for that more invasive step. This broadens the trust boundary unexpectedly and can capture sensitive credentials from the local browser when the user may only have intended to log in through the visible setup flow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Self-Modification

Self-Modification

Self-Modification

Chaining Abuse

Chaining Abuse

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

Windows PowerShell

From source

Agent-specific install

🤖 AI Agent Integration

Tp4

Tp4

Tp4

Context-Inappropriate Capability

Chaining Abuse

Missing User Warnings

Session Persistence

Skill Enumeration

Undeclared Tool Scope

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch

Intent-Code Divergence

External Transmission

Missing User Warnings

Session Persistence

Missing User Warnings

Missing User Warnings

Static analysis