Video Dl

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:09 PM UTC
• Version: 1.1.0

Overview

This video downloader is purpose-aligned overall, with disclosed local downloads and compression, but users should be aware of the optional background compression workflow and fixed temporary log path.

Install only if you are comfortable with videos being saved locally under ~/Downloads/videos/ by default. Treat the Telegram section as a manual compression helper, not a secure sending workflow, and avoid the documented /tmp/compress.log pattern on shared machines; use a private log path and keep track of any background compression jobs you start.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:70

Finding

Predictable Temporary Log Path Enables Symlink-Based File Truncation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 70
Vulnerability Type: Unsafe predictable temporary file path
Risk Level: Medium

Vulnerable Code:

bash

nohup {baseDir}/scripts/compress-and-send.sh "/path/to/video.mp4" "CHAT_ID" > /tmp/compress.log 2>&1 &

Technical Analysis

The documented command redirects standard output and standard error to the fixed, predictable path /tmp/compress.log. Shared temporary directories are generally writable by other local users. Before executing compress-and-send.sh, the invoking shell opens this path with truncation enabled.

An attacker with local access can pre-create /tmp/compress.log as a symbolic link to another file. If the user running the command has permission to write to the symlink target, shell redirection follows the link and truncates that target. The script itself does not need elevated privileges; the operation occurs with the invoking user's permissions.

Attack Path

1. A local attacker predicts that the documented compression workflow will be used.
2. The attacker creates /tmp/compress.log as a symbolic link to a file writable by the intended victim.
3. The victim or AI agent invokes the exact background command documented in SKILL.md.
4. The shell resolves the symbolic link while opening the redirection target.
5. The linked file is truncated and subsequently receives the script's log output.

Exploitation requires local filesystem access, the ability to create the predictable path before invocation, and a target file writable by the victim account.

Impact Assessment

Successful exploitation can overwrite or destroy the contents of files writable by the invoking account. The scope is limited to that account's existing filesystem privileges; this issue does not independently provide privilege escalation or access to otherwise protected files. Depending on the chosen target, impact may include loss of user data, corru ...[truncated 65 chars]

Remediation

View remediation

Remediation Suggestions

Replace the fixed shared path with a securely generated private log file or directory:

bash

LOG_DIR="$(mktemp -d "${TMPDIR:-/tmp}/video-dl.XXXXXX")" || exit 1
chmod 700 "$LOG_DIR"
LOG_FILE="$LOG_DIR/compress.log"

nohup {baseDir}/scripts/compress-and-send.sh \
  "/path/to/video.mp4" "CHAT_ID" >"$LOG_FILE" 2>&1 &

Additionally:

• Set a restrictive umask, such as umask 077, before creating logs.
• Verify that the generated log location is owned by the invoking user and is not a symbolic link.
• Prefer a user-private runtime or state directory when available.
• Remove temporary logs and directories when they are no longer needed.
• Do not restore a fixed filename by combining mktemp with a later predictable rename.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented scope is a simple video downloader, but the skill also advertises a separate compression-and-Telegram workflow that processes local files and uses a chat identifier. That hidden scope expansion matters because users and calling agents may consent to local downloading but not to post-processing and external delivery, increasing the chance of unintended data handling or exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation broadens the skill from downloading remote videos to a workflow that prepares media for Telegram delivery. This creates a security-relevant mismatch because it introduces external sharing behavior not implied by the core downloader purpose, which can lead to accidental disclosure of downloaded or local video content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A Telegram delivery path is not justified by a downloader-only description and therefore increases the chance that an operator or agent invokes functionality beyond what the user intended. In security terms, unjustified outbound-sharing features raise exfiltration risk even if presented as a convenience feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Telegram workflow omits an explicit warning that the compressed video may be transmitted to an external service and associated with a provided chat ID. Without clear disclosure, users may approve a 'compression' step without realizing it can enable outbound sharing of potentially sensitive media.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

Using nohup with background execution creates a persistent detached process that continues after the initiating session ends. In an agent environment, that reduces oversight, can bypass normal interaction boundaries, and may continue processing or transmitting files without timely user visibility or control.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

1. Download the video normally
2. Run compression in background:

   bash

   nohup {baseDir}/scripts/compress-and-send.sh "/path/to/video.mp4" "CHAT_ID" > /tmp/compress.log 2>&1 &
   

3. Check back after estimated time (duration ÷ 4)
4. Send the resulting -telegram.mp4 file

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This skill explicitly states that downloads are saved to ~/Downloads/videos/, which affects the user's filesystem. The documentation provides usage details but does not include any warning or disclosure about local file creation, disk usage, or overwriting/retention implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.