Apple Media Officialpm 0.1.1

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:32 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it helps discover and control local Apple media devices, with no evidence of hidden exfiltration or persistence.

Install only if you are comfortable granting the workflow visibility into your local Apple/AirPlay devices and using unpinned third-party tooling from pipx/Homebrew. Treat scan results as private network inventory, especially device names, IP addresses, identifiers, services, and any credential-related fields.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-24; duplicated in README.md:25-29
Vulnerability Type: Supply-chain risk from mutable dependency versions
Risk Level: Medium

Vulnerable code:

bash

pipx install pyatv || pipx upgrade pyatv
pipx reinstall pyatv --python python3.12

The README provides equivalent installation instructions:

bash

brew install pipx
pipx install pyatv || pipx upgrade pyatv

# Pin to Python 3.12 to avoid Python 3.14 asyncio issues
pipx reinstall pyatv --python python3.12

Technical Analysis

The setup instructions install or upgrade pyatv without pinning an audited package version or verifying artifact integrity. Pinning the Python interpreter to version 3.12 does not pin the pyatv package itself.

The pipx install pyatv || pipx upgrade pyatv command retrieves whichever package release is current when the instructions are executed. The upgrade fallback can also replace an existing installation with a newly published version that was not reviewed as part of this skill audit. Python package installation may execute package installation logic, and the installed CLI subsequently executes with the invoking user's privileges.

No evidence indicates that the current pyatv package is malicious. The vulnerability is the reliance on mutable, unverified third-party package releases.

Attack Path

1. An attacker compromises the upstream package publication account, package registry, release process, or another relevant supply-chain component.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the skill's setup instructions.
4. pipx install or pipx upgrade retrieves the mutable malicious release because no version or hash is specified.
5. Malicious installation or runtime code executes in the user's environment.
6. The payload gains access to resources available to that user, potentially including ...[truncated 537 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pyatv to a specific version that has been tested and audited, for example:

   bash

   pipx install 'pyatv==<audited-version>' --python python3.12
   

2. Remove the automatic pipx upgrade pyatv fallback from normal setup instructions.
3. Record dependency versions in a locked dependency manifest and review upgrades explicitly.
4. Verify downloaded artifacts using trusted hashes or signatures where supported.
5. Document the expected canonical package registry and upstream project.
6. Establish a controlled dependency-update process that includes changelog review, vulnerability scanning, and regression testing before changing the pinned version.

other

Note

• Location: scripts/scan-json.js:31

Finding

Local-Network Device and Service Enumeration Exposes Sensitive Inventory Data

Content

View full analysis

Vulnerability Details

File Location: scripts/scan.sh:4-7, scripts/scan-hosts.sh:6-9, and scripts/scan-json.js:31-77
Vulnerability Type: Local-network reconnaissance and sensitive inventory disclosure
Risk Level: Low

Network scanning code:

bash

TIMEOUT="${1:-5}"

# atvremote uses -t / --scan-timeout
atvremote scan -t "$TIMEOUT"

Targeted host scanning code:

bash

# Faster scan when you know IP(s)
# Usage: scan-hosts.sh <ip[,ip...]> [timeout]
HOSTS="${1:?hosts (ip or ip,ip) required}"
TIMEOUT="${2:-3}"

atvremote --scan-hosts "$HOSTS" -t "$TIMEOUT" scan

Inventory extraction code:

js

const nameMatch = line.match(/^Name:\s*(.+)$/)
if (nameMatch) {
  if (cur) devices.push(cur)
  cur = { name: nameMatch[1].trim(), address: null, model: null, os: null, ids: [], services: [] }
  inServices = false
  inIdentifiers = false
  continue
}

if (!cur) continue

const modelMatch = line.match(/^Model\/SW:\s*(.+)$/)
if (modelMatch) {
  cur.model = modelMatch[1].trim()
  continue
}

const addrMatch = line.match(/^Address:\s*(.+)$/)
if (addrMatch) {
  cur.address = addrMatch[1].trim()
  continue
}

if (line.startsWith('Identifiers:')) {
  inIdentifiers = true
  inServices = false
  continue
}
if (line.startsWith('Services:')) {
  inServices = true
  inIdentifiers = false
  continue
}

if (inIdentifiers) {
  const idMatch = line.match(/^-\s*(.+)$/)
  if (idMatch) cur.ids.push(idMatch[1].trim())
  continue
}

if (inServices) {
  // Example:
  // - Protocol: AirPlay, Port: 7000, Credentials: None, Requires Password: False, Password: None, Pairing: Disabled
  const svcMatch = line.match(/^-\s*Protocol:\s*([^,]+),\s*Port:\s*(\d+),\s*Credentials:\s*([^,]+),\s*Requires Password:\s*([^,]+),\s*Password:\s*([^,]+),\s*Pairing:\s*(.+)$/)
  if (svcMatch) {
    cur.services.push({
      protocol: svcMatch[1].trim(),

...[truncated 2227 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before broad local-network discovery.
2. Prefer targeted scans and validate that supplied hosts belong to an authorized scope.
3. Exclude credentials and password fields from JSON output by default.
4. Redact or hash stable device identifiers unless the caller explicitly requests them.
5. Provide a minimal-output mode that returns only the fields required for device selection.
6. Clearly mark generated scan output as sensitive and warn users not to commit, publish, or retain it unnecessarily.
7. Avoid logging complete scan results in agent transcripts or shared logging systems.
8. If full diagnostic output is needed, require an explicit option and write it with restrictive file permissions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.