Searchables Video Intelligence

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:11 AM UTC
• Version: 1.0.0

Overview

This skill has a legitimate video-analysis purpose, but it can proactively search a private video library and send sensitive queries or file paths to a configurable API endpoint without enough user control.

Install only if you trust the Searchables desktop app and want the agent to use your private video library. Before use, keep the API endpoint pinned to the expected local address or another trusted configured origin, do not let prompt text choose an arbitrary IP:port, and require explicit confirmation before searching private videos, processing local files, using browser-cookie-backed private content, or exporting anything to Notion.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Mandatory API Routing and Proactive Tool Invocation Hijack Agent Behavior

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34

Finding

User-Controlled API Base URL Permits Server-Side Request Forgery

Content

View full analysis

/dev/null | grep -o '"localUrl":"[^"]*"' | cut -d'"' -f4)}" ``` If the command returns empty, use default: `http://127.0.0.1:37622` If a user explicitly specifies an IP:port, use that instead. ### Step 2: Check setup status ```bash curl -s {baseUrl}/agent-api/health ``` ``` Subsequent endpoint examples use the same destination for requests containing user-controlled data: ```bash curl -s -X POST {baseUrl}/agent-api/videos/search \ -H "Content-Type: application/json" \ -d '{"query": "GPU specs and pricing", "limit": 10}' ``` ```bash curl -s -X POST {baseUrl}/agent-api/videos/process-local \ -H "Content-Type: application/json" \ -d '{"filePath": "/Users/me/Videos/lecture.mp4", "language": "en"}' ``` ### Technical Analysis The skill explicitly permits a user-supplied IP address and port to replace the expected loopback Searchables endpoint. It does not define any validation for the destination, allowed port, scheme, redirects, or network range. As a result, an attacker who can influence the user request can direct the agent's `curl` operations to an arbitrary IP and port reachable from the agent environment. This creates a server-side request forgery primitive. The documented API paths can be used to probe local, private, container, cloud-metadata, or other network services. The risk is compounded because later requests may contain sensitive user-derived information, including: - Search queries. - Video identifiers and URLs. - Local absolute file paths. - Questions submitted for analysis. - Article-generation instructions. - Library and account-related API ...[truncated 1997 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation text is overly broad, instructing the agent to use this skill whenever the user mentions generic video-related concepts. This can cause unnecessary invocation of a capability that accesses a local library and external API, increasing privacy risk and reducing user control over when sensitive video metadata or content is searched.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to always use this skill for any mention of YouTube, Bilibili, or generic video terms mandates automatic activation without meaningful exclusions. In context, this is more dangerous because the skill can inspect the user's local video library and interact with an external service, even when the user did not explicitly request that behavior.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

cation required. Returns app, account, platform login, library, and credit state. Use this on first connection to guide user onboarding.

bash

curl -s {baseUrl}/agent-api/setup/status

Response (fully set up):

json

{
  "app": { "version": "1.5.0", "status": "running" },
  "account": { "authenticated": true, "user": { "email": "[e-mail]", "name": "User" } },
  "platforms": {
    "cookiesSource": "chrome",
    "youtube": { "loggedIn": true },
    "bilibili": { "loggedIn": false }
  },
  "library": { "videoCount": 1 },
  "credits": { "balance": 517.7 }
}

Response (not logged in):

json

{
  "app": { "version": "1.5.0", "status": "running" },
  "account": { "authenticated": false, "user": null },
  "platforms": {
    "cookiesSource": null,
    "youtube": { "loggedIn": false },
    "bilibili": { "loggedIn": false }
  },
  "library": { "videoCount": 0 },
  "credits": null
}

POST /agent-api/videos/search — Semantic Search

Search across all processed video c

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill handles local video files and a semantically indexed local library but does not present a clear privacy notice before transmitting local file paths or content to the API. Users may not understand that sensitive local media and metadata could be processed or sent outside the immediate chat context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill asserts that all video analysis must go through its API while later documenting a subtitle path that falls back to yt-dlp/platform retrieval. That inconsistency can mislead users and reviewers about what data paths are actually used, weakening informed consent and security review of external data access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill's manifest centers on video search and analysis, but it also supports exporting derived content to Notion, an additional external transmission channel. This broadens data exposure beyond the stated purpose and can cause users to send summaries, transcripts, or notes to third-party services without clear scope limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill recommends browser-cookie-based access to age-restricted and private content without an explicit privacy and security warning. Browser cookies are highly sensitive credentials; encouraging their use in this way increases risk of unauthorized access expectations, credential misuse concerns, and inadequate user consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The skill instructs the agent to send data via curl to a local API endpoint, which is an external transmission channel relative to the model/runtime. In context this is expected functionality, but it still creates a real data-flow boundary involving local library metadata, account status, and potentially video-derived content, so it should be treated as sensitive and consent-governed.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

No authentication required.

bash

curl -s {baseUrl}/agent-api/health

Response:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Several mandatory examples and required prompts are written as Chinese user-facing text, including the required confirmation wording and progress messages. The skill does not offer a language choice or state that Chinese is only an example, which may violate language/locale policy by implicitly forcing a specific language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The proactive guidance tells the agent to consider searching the user's video library during unrelated questions, without explicit request or privacy warning. Because the library may contain private local videos and indexed transcripts, unsolicited inspection materially increases the chance of privacy violations and over-collection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.