Trakt Read-only

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:36 AM UTC
• Version: 1.0.3

Overview

This Trakt skill mostly matches its purpose, but its OAuth helper can print account tokens into normal output, so it should be reviewed before installation.

Install only after reviewing the OAuth path. Basic read-only commands using TRAKT_CLIENT_ID and TRAKT_USERNAME are low impact, but avoid the device-token command unless token output is redacted or stored through a secure secret mechanism; rotate any Trakt tokens that may have been printed into logs or transcripts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/trakt-api.sh:313

Finding

OAuth Access and Refresh Tokens Exposed Through Standard Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

Install on Ubuntu/Debian:

text

sudo apt-get update && sudo apt-get install -y jq curl

Setup

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The metadata and description present the skill as a simple read-only Trakt lookup requiring only client ID and username, but the documented behavior also includes OAuth device authorization and token exchange using a client secret. This mismatch can cause users or higher-level agents to supply more sensitive credentials than expected and approve flows with broader security consequences than the advertised purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

## Guardrails

- Never log or expose API keys or access tokens.
- Only call `https://api.trakt.tv`.
- Read-only endpoints only; playback uses OAuth token read access.
- Device OAuth flow is read-only; do not request write scopes.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The script advertises the ability to exchange a device code for an access token, which is credential acquisition behavior. In the context of a skill marketed primarily for read-only activity checks, this is more dangerous because it introduces auth-token procurement capability that could be repurposed for broader account access.

Content

Scanner excerpt · scripts/trakt-api.sh (reported line 19)May include surrounding context.

sh

profile                  User profile info
    playback <type> <start_at> <end_at>   Playback progress (requires token)
    device-code             Start device OAuth (gives user_code)
    device-token <device_code>  Exchange device code for access token

Environment Variables Required:
    TRAKT_CLIENT_ID          Your Trakt API client id

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Declaring and consuming TRAKT_ACCESS_TOKEN and TRAKT_CLIENT_SECRET means the script is designed to handle sensitive credentials. That is a meaningful security concern in this context because the stated skill purpose does not clearly justify secret processing, increasing the risk of over-privileged deployment and accidental exposure of bearer tokens or client secrets.

Content

Scanner excerpt · scripts/trakt-api.sh (reported line 26)May include surrounding context.

sh

TRAKT_USERNAME           Your Trakt username or user slug

Optional (for playback):
    TRAKT_ACCESS_TOKEN       OAuth access token (Bearer)
    TRAKT_CLIENT_SECRET      OAuth client secret (required for device token exchange)

Examples:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

Install on Ubuntu/Debian:

text

sudo apt-get update && sudo apt-get install -y jq curl

Setup

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README expands the skill from simple read-only querying into OAuth device-flow initiation and token exchange, which materially changes the trust and secret-handling model. Even if the resulting token is intended for read access, documenting credential acquisition workflows in a supposedly read-only skill increases the chance of over-privileged use, user confusion, and unsafe handling of OAuth secrets.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README states 'read-only endpoints only' while also including device-token exchange operations, which is a misleading security claim. This inconsistency can cause operators to trust the skill more than warranted and provide client secrets or tokens under false assumptions about capability and risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill exposes shell execution capability through an external script but does not declare any explicit tool scope or allowed-tools boundary. This weakens policy enforcement and reviewability, making it easier for a consuming agent to invoke shell-based behavior without clear restriction, especially in a skill that handles API credentials and OAuth-related flows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The front matter says the skill requires only a client ID and username, yet the command set includes OAuth device-flow token acquisition. That discrepancy is dangerous because it understates the sensitivity of the skill and can mislead users, reviewers, or orchestrators into exposing secrets or enabling auth flows they did not intend to allow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Including device authorization and token exchange in a skill whose stated purpose is checking user activity unnecessarily expands the attack surface. Even if the resulting scope is read-only, token acquisition functionality introduces credential-handling paths and phishing-like approval flows that are more sensitive than passive API reads.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script’s manifest describes a read-only Trakt activity/status skill, but the implementation includes OAuth device-code initiation and token exchange flows. Expanding a supposedly read-only skill to mint access tokens increases privilege and broadens the attack surface, enabling future authenticated API use beyond simple public profile/history reads.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Handling TRAKT_CLIENT_SECRET and performing OAuth token exchange gives this script the ability to process sensitive credentials despite being presented as a read-only status checker. In an agent-skill context, hidden secret-handling is dangerous because it can normalize exposing high-value secrets to code that users and reviewers may assume only performs harmless reads.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/trakt-api.sh (reported line 81)May include surrounding context.

sh

url+="?${params}"
    fi

    curl -s \
      -H "Content-Type: application/json" \
      -H "trakt-api-version: 2" \
      -H "trakt-api-key: ${TRAKT_CLIENT_ID}" \

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation tells the agent not to implement OAuth support unless explicitly requested, but the skill already ships built-in OAuth device-flow commands. This inconsistency can confuse safety logic and make an agent more likely to invoke auth-related actions despite the apparent guardrail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.