批量下载工作流

• Outcome: Review
• Latest audit: Aug 30, 2026 · 10:23 AM UTC
• Version: 1.0.0

Overview

This skill is a bulk downloader that openly handles live account cookies and documents bypassing provider limits, so users should review it carefully before installing.

Install only if you fully understand that it automates high-risk downloading workflows, extracts live Quark browser cookies, stores those cookies locally in plaintext, and includes provider-limit circumvention guidance. Use it only for content you are authorized to access, avoid storing cookies in shared or synced folders, restrict file permissions, and review manifests before running the downloader because unsafe paths could overwrite files outside the intended download directory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# aria2c 高并发 + 断点续传 + 16 分片
    cmd = ["aria2c", "-x", "16", "-s", "16", "--continue", "--dir", outdir,
           "--out", relpath, "--file-allocation=none", "--summary-interval=0", url]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)
    if r.returncode != 0 or not is_complete(target):
        # 空壳清理：分片残留 .aria2
        for p in [target + ".aria2", tmp]:

• Confidence: 92% confidence
• Finding: The script passes a manifest-controlled relpath directly to aria2c via '--out', allowing path traversal or option-style filenames to influence where files are written. While this is not shell command execution, it is still dangerous because an attacker-controlled TSV can overwrite files outside the intended output tree or cause unexpected behavior in the downloader.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises operational use of network, shell, file-read, and likely credential handling capabilities but declares no explicit permissions or constraints. That mismatch increases the chance of silent overreach, unsafe invocation, and inadequate review of what the skill can access or execute.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This skill explicitly documents techniques to bypass Quark download limits using a specific client UA and includes tooling to detect recovery after account risk controls or bans. In the context of a generic downloader, that is not normal compatibility guidance; it is evasion of platform restrictions and encourages continued abuse after enforcement.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill claims credential safety while instructing operators to export live Quark cookies via CDP and persist them in workspace state, creating a contradiction between stated safety and actual handling. Exported session cookies are equivalent to bearer tokens and can enable account takeover or unauthorized downloads if exposed.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This section contains operational guidance for bypassing platform download restrictions and anti-abuse controls, including a specific client UA used to evade size limits, IP-binding behavior, and ban-trigger observations. In a downloader skill, that moves beyond normal interoperability documentation into enabling circumvention of service protections, which can facilitate unauthorized mass acquisition of copyrighted or restricted content.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The playbook documents third-party transfer/save API calls together with anti-bot headers, token acquisition, and a local reference implementation path, which provides a recipe for automating protected share-to-drive workflows. In context, this expands the skill from ordinary downloading into replicating guarded platform actions, increasing the risk of abuse, account compromise, and unauthorized content handling.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This script attaches to Chrome's remote debugging interface and invokes Network.getAllCookies to extract authenticated cookies for quark.cn, then serializes them to a reusable Netscape cookie file. That is credential harvesting behavior: anyone with the exported file can potentially replay the victim's authenticated session, bypassing normal login controls and gaining account access.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger scenarios are very broad and cover multiple download sources and media types without clear authorization, ownership, or compliance boundaries. That makes accidental or inappropriate invocation more likely, especially for high-risk workflows involving cookies, BT/magnet links, and bulk acquisition.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill directs users to export and use live account cookies but does not prominently warn that these cookies grant active session access and may expose the account to misuse, suspension, or theft. In this context, the omission is dangerous because the workflow also includes restriction evasion and persistent storage of session material.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The guidance explicitly mentions exporting live cookies via CDP and notes their validity window, but provides no safeguards for storing, redacting, rotating, or limiting access to those session credentials. Session cookies can grant direct account access, so documenting their extraction without security handling guidance materially increases the chance of credential leakage or misuse.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: Recommending proxy use for BT access without any warning about privacy, legal exposure, or traffic leakage omits important safety constraints for a high-risk networking activity. Users may incorrectly assume the proxy meaningfully protects them, while misconfiguration can expose their IP, activity metadata, or violate local policy and law.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The script writes live authenticated Quark cookies directly to disk as plaintext without an explicit sensitivity warning, access controls, or secure handling guidance. Plaintext session cookies are bearer credentials, so leakage through backups, logs, shared directories, or other local users can enable account takeover until the cookies expire or are revoked.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The TSV manifest controls relpath, which is joined with the user-specified output directory and later used for directory creation and aria2 output naming without any path safety checks. An attacker-supplied manifest can use '../' segments or absolute paths to write outside the intended directory, potentially overwriting user files or planting content in sensitive locations.

Unvalidated Output Injection

High

• Category: Output Handling

Content

import sys

def probe_duration(path):
    r = subprocess.run(["ffprobe", "-v", "quiet", "-show_entries", "format=duration",
                        "-of", "csv=p=0", path], capture_output=True, text=True, timeout=60)
    if r.returncode != 0:
        return None

• Confidence: 87% confidence
• Finding: The script passes a user-controlled file path directly to ffprobe. Because external tools often parse leading '-' arguments as options, a crafted filename such as '-f lavfi ...' or similar could cause ffprobe to interpret the filename as flags rather than data, potentially altering behavior, causing denial of service, or making the validation step inspect unintended inputs. In this media-processing context, the risk is elevated because the script recursively processes untrusted downloaded files whose names are attacker-controlled.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"""ffprobe 校验：duration 非空且 > 0 视为完整（防 moov atom 缺失空壳）"""
    if not os.path.exists(path) or os.path.getsize(path) < 1024:
        return False
    r = subprocess.run(["ffprobe", "-v", "quiet", "-show_entries", "format=duration",
                        "-of", "csv=p=0", path], capture_output=True, text=True, timeout=60)
    if r.returncode != 0:
        return False

• Confidence: 87% confidence
• Finding: The file path supplied to ffprobe is derived from untrusted manifest input and is passed without an end-of-options separator. A crafted filename beginning with '-' may be parsed by ffprobe as an option rather than a file, causing unexpected behavior, denial of service, or misuse of the helper tool even though it is not classic shell injection.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# aria2c 高并发 + 断点续传 + 16 分片
    cmd = ["aria2c", "-x", "16", "-s", "16", "--continue", "--dir", outdir,
           "--out", relpath, "--file-allocation=none", "--summary-interval=0", url]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)
    if r.returncode != 0 or not is_complete(target):
        # 空壳清理：分片残留 .aria2
        for p in [target + ".aria2", tmp]:

• Confidence: 94% confidence
• Finding: Both relpath and the downloaded URL influence the aria2c invocation, and relpath is untrusted manifest input passed directly as the value to '--out'. This enables argument-style abuse through special filenames and, more importantly in this script's context, arbitrary file write/path traversal when combined with directory creation under attacker-chosen nested paths.

Static analysis

No suspicious patterns detected.