Media Crawler

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:19 PM UTC
• Version: 0.1.4

Overview

This is a coherent MediaCrawler helper, but its setup runs mutable internet-fetched code without strong verification or version pinning.

Review this before installing. It is not showing hidden exfiltration or destructive behavior, but running setup gives changing upstream installers, repository code, and dependencies the ability to execute as your user. Install uv manually if possible, pin or review the MediaCrawler commit before running, use a dedicated low-privilege environment, and protect or delete crawler outputs and login/session caches when finished.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:21

Finding

Unverified Remote Installer Is Piped Directly Into a Shell

Content

View full analysis

/dev/null 2>&1; then log "未检测到 uv，开始自动安装..." command -v curl >/dev/null 2>&1 || fail "安装 uv 需要 curl，请先安装 curl。" curl -LsSf https://astral.sh/uv/install.sh | sh export PATH="$HOME/.local/bin:$PATH" command -v uv >/dev/null 2>&1 || fail "uv 安装完成，但当前 shell 仍无法找到 uv。" fi ``` ### Technical Analysis Line 25 downloads a mutable response from `https://astral.sh/uv/install.sh` and passes it directly to `sh`. No pinned version, expected checksum, cryptographic signature, or local inspection step is used before execution. Although `astral.sh` is the expected upstream distribution site for `uv`, HTTPS authenticates only the endpoint at connection time; it does not ensure that the downloaded content matches a previously reviewed installer. A compromise of the upstream website, DNS or certificate infrastructure, deployment pipeline, or associated distribution account could replace the response with arbitrary shell commands. The downloaded script executes with all permissions of the user running `scripts/setup.sh`. Installing `uv` is relevant to the declared functionality, but executing an unverified, mutable shell payload is not the minimum-risk mechanism necessary to perform that installation. ### Attack Path 1. An attacker compromises the installer endpoint, its deployment pipeline, or another component of its delivery chain. 2. The user invokes `bash scripts/setup.sh` on a system where `uv` is unavailable. 3. `curl` retrieves the attacker-controlled response. 4. The shell pipeline immediately executes the response without verification or user review. 5. The payload performs arbitrary actions with the invoking user's privileges. ### Impact Assessment Successful exploitation provides arbitrary command ex ...[truncated 657 chars]

Remediation

View remediation

" curl --fail --location --proto '=https' \ --output uv-release.tar.gz \ "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/" echo " uv-release.tar.gz" | sha256sum --check - # Extract and install only after successful verification. ``` The version, artifact name, and checksum must be fixed to values obtained from the trusted release metadata rather than dynamically accepted from the download endpoint. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/setup.sh:32

Finding

Mutable Upstream Repository Is Automatically Updated and Executed

Content

View full analysis

/dev/null || true)" echo "$REMOTE_URL" | grep -q "NanmiCoder/MediaCrawler" || fail "目录已存在，但不是目标仓库: $PROJECT_DIR" log "检测到已有 MediaCrawler 仓库，尝试更新..." git -C "$PROJECT_DIR" pull --ff-only || fail "git pull 失败，请检查本地改动或网络。" else fail "目录已存在但不是 git 仓库: $PROJECT_DIR" fi else log "开始克隆项目..." git clone "$REPO_URL" "$PROJECT_DIR" || fail "git clone 失败，请检查网络或仓库地址。" fi cd "$PROJECT_DIR" [ -f "pyproject.toml" ] || fail "未找到 pyproject.toml，项目结构异常。" [ -f "main.py" ] || fail "未找到 main.py，项目结构异常。" log "[4/6] 使用 uv 同步依赖 ..." if ! uv sync; then log "首次 uv sync 失败，重试一次..." uv sync || fail "uv sync 执行失败。" fi log "[5/6] 安装 Playwright Chromium ..." uv run playwright install chromium || fail "Playwright Chromium 安装失败。" log "[6/6] 执行健康检查 ..." uv run main.py --help >/dev/null || fail "健康检查失败：无法执行 'uv run main.py --help'。" ``` ### Technical Analysis The setup process clones the current default branch of the external MediaCrawler repository or automatically updates an existing checkout with `git pull --ff-only`. It does not pin a reviewed commit hash, signed tag, or immutable release. After retrieval, the script: 1. Uses dependency metadata from the fetched repository through `uv sync`. 2. Executes the fetched environment through `uv run playwright install chromium`. 3. Executes fetched application code through `uv run main.py --help`. Consequently, code committed upstream after this Skill was reviewed can be install ...[truncated 2697 chars]

Remediation

View remediation

" git clone --no-checkout "$REPO_URL" "$PROJECT_DIR" git -C "$PROJECT_DIR" fetch --depth 1 origin "$PINNED_COMMIT" git -C "$PROJECT_DIR" checkout --detach "$PINNED_COMMIT" ACTUAL_COMMIT="$(git -C "$PROJECT_DIR" rev-parse HEAD)" [ "$ACTUAL_COMMIT" = "$PINNED_COMMIT" ] || exit 1 ``` Dependency installation and health-check execution should proceed only after the pinned source and lockfile integrity have been validated. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh construct is a classic chaining-abuse pattern because it removes any opportunity to inspect downloaded content before execution and turns a network response directly into shell commands. In a setup script for a public-information crawler, this increases risk rather than being justified by the domain, since installation does not inherently require blind execution of third-party code.

Content

Scanner excerpt · scripts/setup.sh (reported line 25)May include surrounding context.

sh

if ! command -v uv >/dev/null 2>&1; then
  log "未检测到 uv，开始自动安装..."
  command -v curl >/dev/null 2>&1 || fail "安装 uv 需要 curl，请先安装 curl。"
  curl -LsSf https://astral.sh/uv/install.sh | sh
  export PATH="$HOME/.local/bin:$PATH"
  command -v uv >/dev/null 2>&1 || fail "uv 安装完成，但当前 shell 仍无法找到 uv。"
fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is for collecting public information across platforms and storing results, but the README lacks a clear privacy and data-handling warning about collecting user-generated content, local retention of search results, and the need to comply with platform rules and applicable privacy laws. In this context, the omission makes misuse more likely and can expose operators and subjects to legal, compliance, and privacy harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to run a setup script that detects tools, installs uv, clones or updates a GitHub repository, installs dependencies and Playwright, and performs a startup check, but it does not clearly warn that this will modify the local system and fetch and execute third-party code. In a skill context, omission of these effects can lead users to run the setup with insufficient scrutiny, increasing supply-chain and local-environment risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes shell commands such as bash scripts/setup.sh, uv run ..., and bash scripts/show_results.sh, but it does not declare any tool scope or permission boundary. That creates an authorization and transparency gap: an agent or user may execute installation and crawler commands with system-level effects without an explicit declaration of shell usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes collection, storage, and login-state caching for platform data, but it does not prominently warn users that public content, possible account-linked session artifacts, and scraped results will be stored on the local system. This can lead to unintentional retention of sensitive browsing/session material or regulated data, especially when users run the crawler with authenticated sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script's user-visible status and error messages are written in Chinese throughout, with no opt-in or documented locale constraint. This can violate language/locale policy when a skill imposes a specific language on users without choice or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script downloads and immediately executes a remote installer with curl ... | sh, which gives the remote server full code-execution ability on the user's machine at install time. Even if the source is legitimate, compromise of the upstream host, DNS/TLS interception, or a malicious script update would turn setup into arbitrary command execution without any integrity verification or explicit consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file presents all user-facing instructional content in Chinese, with no indication that other languages are supported or that Chinese is required for a region-specific compliance reason. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documentation and description are entirely in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

This line fetches an external script from the network and executes it during setup, creating a direct trust boundary violation. In the context of an installation script, this is especially dangerous because users expect provisioning behavior and may run it with elevated trust, allowing compromise of the host if the fetched content is malicious or tampered with.

Content

Scanner excerpt · scripts/setup.sh (reported line 25)May include surrounding context.

sh

if ! command -v uv >/dev/null 2>&1; then
  log "未检测到 uv，开始自动安装..."
  command -v curl >/dev/null 2>&1 || fail "安装 uv 需要 curl，请先安装 curl。"
  curl -LsSf https://astral.sh/uv/install.sh | sh
  export PATH="$HOME/.local/bin:$PATH"
  command -v uv >/dev/null 2>&1 || fail "uv 安装完成，但当前 shell 仍无法找到 uv。"
fi

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-facing messages on these lines are fixed Chinese text, which imposes a specific language on all users. The policy for this category requires flagging language or locale constraints when the skill does not provide user opt-in or justify the locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.