T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:44- Finding
Unrestricted UPnP Device URL Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
find and control DLNA devices
Security checks for vulnerabilities and agentic risk
Overview
The skill is for legitimate DLNA media control, but its sample code is under-scoped in ways that could cause unintended local-network requests or malformed device commands.
Review this before installing or using it as implementation guidance. Keep DLNA control limited to devices found through trusted discovery, confirm the target device before playback or volume changes, and add URL validation plus XML escaping before copying the sample code into a real CLI or agent workflow.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:50- Finding
Unescaped User-Controlled Values Permit DIDL-Lite XML Injection
- Content
View full analysis
{title or 'Media'} {media_url} ''' ``` ### Technical Analysis The function constructs DIDL-Lite XML through direct string interpolation. Both `title` and `media_url` may be caller-controlled, but neither value is escaped before being placed in XML text nodes. XML metacharacters such as `<`, `>`, and `&` can terminate the intended element content or introduce attacker-selected XML elements. For example, a crafted title could close the `dc:title` element and add additional metadata nodes before reopening it. Even when an injected document is rejected, malformed values can reliably disrupt playback operations. This issue is XML injection rather than XML External Entity injection: the shown code constructs XML but does not itself parse attacker-provided XML or declare an external entity. Device-specific parsers may nevertheless react unpredictably to malformed or unexpected metadata. ### Attack Path 1. An attacker controls the `title` or `media_url` argument passed to `play_media`. 2. The attacker includes XML metacharacters and crafted closing or opening tags in the value. 3. The f-string inserts the value into the DIDL-Lite document without escaping it. 4. The function sends the resulting metadata through the `SetAVTransportURI` action. 5. The DLNA renderer parses attacker-influenced XML. 6. The injected markup may alter metadata structure, cause the request to fail, disrupt play ...[truncated 613 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
1. Device Discovery
python from async_upnp_client import SsdpListener async def discover_media_renderers(timeout: float = 5.0) -> list[DeviceInfo]: """Discover all MediaRenderer devices on network"""
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
1. Device Discovery
python from async_upnp_client import SsdpListener async def discover_media_renderers(timeout: float = 5.0) -> list[DeviceInfo]: """Discover all MediaRenderer devices on network"""
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
1. Device Discovery
python from async_upnp_client import SsdpListener async def discover_media_renderers(timeout: float = 5.0) -> list[DeviceInfo]: """Discover all MediaRenderer devices on network"""
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes LAN device discovery and playback control without warning that it actively scans the local network and can send commands to other devices on the user's LAN. While this is expected functionality for a DLNA control skill, the missing disclosure can lead to surprising network activity and unintended control of shared devices, which is a security/privacy usability issue.
- Content