T09 · Insecure Skill Coding Practices
Error
- Location
main.py:128- Finding
M-Team API Key Forwarded to an Unvalidated Download URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Mteam Transmission0.1
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do what it claims, but it can start local torrent downloads and handles credentials and remote download URLs too loosely for automatic installation.
Review before installing. Use environment variables or a secret manager instead of editing credentials into source, use a least-privileged Transmission account, pin dependencies, require a clear confirmation before adding any torrent, validate the returned download URL before fetching it, and remove or replace the Cloudflare bypass framing. Also confirm the M-Team and torrent-download use complies with your legal, privacy, and network policies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
main.py:110- Finding
Predictable User-Influenced Temporary File Path Permits File Overwrite
- Content
View full analysis
str: """工具2：下载种子并推送到 Transmission（两步走 + 代理防封版）""" temp_filepath = f"/tmp/mteam_dl_{torrent_id}.torrent" try: # 1. 获取专属下载链接 (走代理) token_url = f"{MTEAM_API_BASE}/torrent/genDlToken" token_resp = requests.post( token_url, headers=COMMON_HEADERS, data={"id": torrent_id}, proxies=PROXIES, timeout=10 ) token_data = token_resp.json() if str(token_data.get('code')) != '0': return f"❌ 获取下载链接失败，服务器返回: {token_data}" download_url = token_data.get('data') # 2. 真实下载种子文件并写入临时文件 (走代理) dl_resp = requests.get( download_url, headers=COMMON_HEADERS, proxies=PROXIES, timeout=15 ) dl_resp.raise_for_status() if not dl_resp.content.startswith(b'd'): return "❌ 下载失败：获取到的不是合法的种子文件（可能被防火墙拦截）。" with open(temp_filepath, "wb") as f: f.write(dl_resp.content) # 3. 确定保存目录 download_dir = CATEGORY_PATH_MAPPING.get(category, "/volume3/影视/其他") # 4. 添加到 Transmission c = Client(host=TRANS_HOST, port=TRANS_PORT, username=TRANS_USER, password=TRANS_PASS) with open(temp_filepath, "rb") as f: c.add_torrent(f, download_dir=download_dir) # 5. 清理临时文件 if os.path.exists(temp_filepath): os.remove(temp_filepath) ``` ### Technical Analysis The temporary filename is derived directly from the `torrent_id` tool argument and is created in a shared temporary directory. The argument is not restricted to the expected torrent-ID format. Opening the path with `open(temp_fi ...[truncated 2477 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:6- Finding
Credentials Are Configured Directly in Source Code
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:12- Finding
Third-Party Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README describes a workflow that searches for torrents and automatically pushes selected downloads into a local Transmission instance and NAS paths, but it does not warn users about network, storage, privacy, or legal impact. In this context, the skill bridges an external content indexer to a local downloader, so omission of user-consent and impact disclosures increases the chance of unintended downloads, storage misuse, and exposure of local infrastructure credentials.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly advertises 'perfectly bypassing Cloudflare 502 interception,' which signals anti-protection or evasion behavior. Even if only marketing language, documenting a claimed ability to circumvent a service's protective controls is risky because it encourages abuse and may conceal undocumented network behavior not disclosed elsewhere in the skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is written as a Chinese-only role and response specification, including mandated Chinese phrasing and user interaction style, with no opt-in or alternative language path. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill directs the agent to initiate a download to a local Transmission/NAS environment after only a content-selection prompt, but it does not require any explicit user warning or confirmation about system-side effects such as disk writes, network activity, or storage location. This creates a real safety issue because the agent is authorized to cause persistent changes on the user's infrastructure, and users may not understand that selecting an item will immediately trigger local downloads.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The file hardcodes sensitive service configuration, including Transmission host, username, and password placeholders, encouraging credential storage in source code. In real deployments this often leads to secret exposure through source control, logs, backups, or accidental sharing, and the configured internal host reveals local network topology.
- Content
python # ================= 1. 认证、服务与网络配置 ================= MTEAM_API_KEY = "在这里填入你真实的 M-Team API Key" MTEAM_API_BASE = "https://api.m-team.cc/api" # Transmission 配置 TRANS_HOST = '10.1.1.10'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The search function sends the user-provided keyword to an external M-Team API using an authenticated request, but there is no confirmation prompt, print/log disclosure, or explanatory comment warning that user input will be transmitted off-box. This is a safety-relevant network operation involving user data and credentials.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python try: # 加入 headers 伪装和 proxies 代理 response = requests.post( f"{MTEAM_API_BASE}/torrent/search", headers=COMMON_HEADERS, json=payload,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The download workflow performs a chain of privileged actions—remote token retrieval, file download to disk, and submission to a Transmission instance—without any confirmation, validation, or safety checks. In this context, the skill is designed to fetch and enqueue remote content, so an incorrect or manipulated torrent ID/category can trigger unintended downloads and resource consumption on a local service.
- Content
Tainted flow: 'download_url' from requests.post (line 128, network input) → requests.get (network output)
Medium
- Category
- Data Flow
- Confidence
- 87% confidence
- Finding
The code trusts a download URL returned by a remote API and immediately fetches it, creating a server-side request forgery style trust boundary issue. If the API response is compromised, misconfigured, or malicious, the skill could be induced to make unintended outbound requests through the configured proxy and process attacker-controlled content.
- Content
python download_url = token_data.get('data') # 2. 真实下载种子文件并写入临时文件 (走代理) dl_resp = requests.get( download_url, headers=COMMON_HEADERS, proxies=PROXIES,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to push a selected torrent into a local Transmission instance, which changes the user's local system state and can trigger bandwidth, storage, and legal/privacy consequences. Although the tool requires an explicit user selection before download, the manifest does not warn about these side effects or require a clear confirmation step immediately before the system-modifying action.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The comment frames COMMON_HEADERS as browser impersonation for anti-blocking, but the actual headers also carry the x-api-key used for authenticated requests. This is not just incomplete wording: it describes the intent of the header block in a way that omits and softens its real purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Docstrings, comments, and returned user-facing strings are entirely in Chinese, and the skill does not indicate that this locale restriction is optional or region-specific. Under the language policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing manifest text is written as mandatory Chinese instructions, with no indication that the skill supports other languages or that Chinese-only behavior is intentional for a region-specific use case. This can violate language/locale policy when the skill implicitly constrains interactions to a single language without user opt-in.
- Content