T09 · Insecure Skill Coding Practices
Error
- Location
scripts/opensubtitles-api.sh:5- Finding
Unvalidated API Host Can Receive OpenSubtitles Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenSubtitles Read-only
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with OpenSubtitles lookup and subtitle context use, but it has credential-handling and file-boundary weaknesses users should review before installing.
Install only if you are comfortable giving the agent an OpenSubtitles API key and, for downloads, account credentials or a token. Keep OPENSUBTITLES_BASE_URL unset unless you verified it came directly from OpenSubtitles, do not use shared or writable subtitle cache directories, and treat download-link requests as account actions that may consume quota.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/subtitle-context.sh:24- Finding
Cache-Only File Restriction Can Be Bypassed Through Symlinks or Non-Canonical Paths
- Content
View full analysis
&2; exit 1;; esac # Normalize to absolute path if [[ "$srt_file" != /* ]]; then srt_file="$PWD/$srt_file" fi if [[ "$srt_file" != "$cache_dir"/* ]]; then echo "Error: subtitle file must be inside $cache_dir" >&2 exit 1 fi if [[ ! -f "$srt_file" ]]; then echo "Error: subtitle file not found" >&2 exit 1 fi ``` The accepted path is subsequently opened by `awk`: ```bash awk -v target="$norm_ts" -v wmins="$window_mins" ' function to_ms(ts, h,m,s,ms) { split(ts, a, ":"); h=a[1]; m=a[2]; split(a[3], b, ","); s=b[1]; ms=b[2]; return (h*3600000)+(m*60000)+(s*1000)+ms; } BEGIN { target_ms = to_ms(target); window_ms = wmins * 60 * 1000; start_window = target_ms - window_ms; if (start_window < 0) start_window = 0; } /^[0-9]+$/ { idx=$0; next } /^[0-9][0-9]:[0-9][0-9]:[0-9][0-9],[0-9][0-9][0-9] --> / { start=$1; end=$3; start_ms=to_ms(start); end_ms=to_ms(end); in_block=1; text=""; next } /^$/ { if (in_block) { if (end_ms >= start_window && start_ms <= target_ms) { printf("[%s --> %s]\n%s\n\n", start, end, text); found=1; } } in_block=0; text=""; next } { if (in_block) { if (text == "") text=$0; else text=text"\n"$0; } } END { if (!found) print "No subtitles found in window"; } ' "$srt_file" ``` ### Technical Analysis The cache containment check compares path strings rather than canonical filesystem paths. A path can begin with the expected cache prefix while resolving outside that directory through `..` components or ...[truncated 2095 chars]- Remediation
View remediation
&2; exit 1 ;; esac ``` 3. Apply the `.srt` extension check to the canonical path as well as, if desired, the user-supplied name. 4. Reject symbolic links when they are unnecessary: ```bash [[ -L "$srt_file" ]] && exit 1 ``` 5. Verify the canonical target is a regular file after containment validation. 6. Protect the cache directory from writes by untrusted users and avoid group/world-writable permissions. 7. Where race conditions are in scope, open files using a mechanism that prevents symlink following, or run the parser in a sandbox restricted to the cache directory. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is framed as read-only subtitle/context retrieval, but it also performs authenticated login and obtains download links using credentials or tokens. Even if these actions are not destructive, the mismatch can mislead operators and downstream policy systems into granting trust or permissions under an incomplete description, which is dangerous in security-sensitive environments.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is framed as read-only subtitle/context retrieval, but it also performs authenticated login and obtains download links using credentials or tokens. Even if these actions are not destructive, the mismatch can mislead operators and downstream policy systems into granting trust or permissions under an incomplete description, which is dangerous in security-sensitive environments.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
OPENSUBTITLES_TOKEN=... {baseDir}/scripts/opensubtitles-api.sh download-link --file-id 123
text ### Extract context at timestamp After downloading an `.srt` file (default window: 10 minutes before timestamp):
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### Login / Logout (token) `POST /login` (username + password) returns `token` and `base_url`. `DELETE /logout` destroys token. Rate limits for login: **1 req/sec, 10/min, 30/hour**. If 401, stop retrying. If `base_url` is `vip-api.opensubtitles.com`, include JWT token on all requests.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares shell-based capabilities and provides executable command examples, but does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens governance and review because the runtime may permit broader shell access than the skill’s read-only description suggests, increasing the chance of unintended command execution or misuse.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md set -euo pipefail API_ROOT="https://api.opensubtitles.com/api/v1" base_url() { if [[ -n "${OPENSUBTITLES_BASE_URL:-}" ]]; then
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md set -euo pipefail API_ROOT="https://api.opensubtitles.com/api/v1" base_url() { if [[ -n "${OPENSUBTITLES_BASE_URL:-}" ]]; then
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh set -euo pipefail API_ROOT="https://api.opensubtitles.com/api/v1" base_url() { if [[ -n "${OPENSUBTITLES_BASE_URL:-}" ]]; then
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill metadata and usage text present this as a read-only subtitle/context capability, but the script also supports authenticated login and download-link generation. That mismatch expands the skill's effective privileges and can mislead downstream agents or users into providing credentials or invoking capabilities they did not intend to enable.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Labeling the tool as read-only while documenting login and download-link operations is a security-signaling flaw that can cause users, orchestrators, or policy systems to treat the skill as lower risk than it really is. In an agent setting, this kind of capability misrepresentation increases the chance of unauthorized credential use or data transfer.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh url+="?${qs}" fi curl -s -L \ -H "Accept: application/json" \ -H "Api-Key: ${OPENSUBTITLES_API_KEY}" \ -H "User-Agent: ${OPENSUBTITLES_USER_AGENT}" \
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This is a markdown file, so SQP-2 applies to omissions in the skill description. The document describes sending usernames, passwords, and bearer/JWT tokens but does not include any warning about sensitive credential handling, storage, or transmission, which affects user privacy and account security.
- Content
Static analysis
No suspicious patterns detected.