Security audit

文旅素材搜索

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate media-search purpose, but its download and HTML rendering paths are under-scoped enough that users should review it before installing.

Install only if you are comfortable with a skill that contacts data0086.com, opens media links, and writes downloaded videos locally. Before use, tighten URL origin validation, block redirects or revalidate them, force downloads to remain inside downloads/, sanitize API-provided fields before HTML output, and consider requiring confirmation before any batch download.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_video.sh:69
Finding: Trusted Media Origin Validation Can Be Bypassed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_video.sh:23
Finding: Remote Business Code Can Escape the Download Directory
Content: View full analysis
" "" [HLS|MP4]`. ``` The script accepts the resulting path without validating it: ```bash URL="${1:-}" OUTPUT="${2:-}" TYPE="${3:-}" ``` It then creates the supplied parent directory and writes directly to the path: ```bash OUTPUT_DIR="$(dirname "$OUTPUT")" mkdir -p "$OUTPUT_DIR" ``` ```bash if curl -fSL --progress-bar -o "$OUTPUT" "$URL"; then echo "[download] complete: $OUTPUT ($(du -h "$OUTPUT" | cut -f1))" >&2 echo "$OUTPUT" exit 0 fi ``` The HLS path is similarly unsafe: ```bash if ffmpeg -y -i "$URL" -c copy -bsf:a aac_adtstoasc "$OUTPUT" -loglevel warning; then ``` ### Technical Analysis `businessCode` originates in the remote search API response and is used to construct the local output filename. Neither the Skill instructions nor the download script require a safe identifier format. A malicious value containing path separators can therefore escape the intended `downloads/` directory. For example: ```text ../../.config/example ``` could produce a path equivalent to: ```text downloads/../../.config/example.mp4 ``` The script calls `dirname`, creates the resulting directory hierarchy, and writes to the supplied path. There is no canonicalization, base-directory containment check, filename allowlist, or protection against overwriting an existing target. `ffmpeg -y` explicitly enables overwriting. The script also accepts arbitrary output paths when invoked directly, desp ...[truncated 1416 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:266
Finding: API-Controlled Fields Are Inserted into HTML Without Escaping
Content: View full analysis
1 {title}
{id} {resolution}
{duration_seconds}s / {file_size}
Browser playback 2 {title}
{id} {resolution}
{duration_seconds}s / {file_size}
Browser playback ``` The selected-result template has the same behavior: ```html ✅ 1 {title} {resolution}
{duration_seconds}s / {file_size} ``` The field mapping also preserves API-provided rich HTML without defining sanitization: ```text | `explain` | `description` (HTML format, containing resolution/format information) | ``` ### Technical Analysis Fields such as `commodityName` and `explain` originate from the remote API. The Skill directs the Agent to emit static HTML and substitutes `{title}` directly into an HTML context without requiring HTML escaping. An attacker-controlled title such as: ```h ...[truncated 2009 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个完整的文旅视频素材检索与购买下载流程，核心能力包括调用素材接口搜索、展示结果、处理用户选择、模拟交易并下载文件到本地。实际代码仅是一个辅助预览脚本：接收 URL 后按平台调用 Safari/open/xdg-open/cmd start 打开浏览器观看链接。虽然“预览”属于声明流程中的一部分，但该代码既没有实现该流程的大部分核心能力，也没有体现域名白名单、环境变量覆盖、输出格式适配或下载行为。其实际主要用途与声明的整体技能目的相比明显过窄且行为不同，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly allows 购买 1,2 or similar commands to trigger immediate mock purchase and local download with no confirmation step. In a tool-enabled agent, this reduces friction for unintended or socially engineered actions that cause network access and local file writes, increasing the chance of accidental execution and resource misuse.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to execute shell commands such as bash scripts/download_video.sh and bash scripts/open_preview.sh, but the skill metadata does not declare any corresponding tool scope or allowed-tools restriction. This creates an authorization gap: a host agent may expose shell access more broadly than intended, enabling local file writes, network access, and command execution without a clearly bounded permission model.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs automatic video downloads to local storage after a purchase command, but does not provide a prominent safety warning about disk writes, bandwidth use, storage consumption, or the fact that remote media will be fetched and persisted. In an agent setting, silent local writes and large downloads can surprise users and create resource-exhaustion or unwanted data-retention risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language description is entirely in Chinese and directs the agent to guide the workflow in Chinese, but it does not offer the user a language choice or state that the skill is intentionally limited to Chinese-speaking users for a documented regional reason. Under SQP-3, forcing a specific language without opt-in is a policy concern.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill is built around transmitting user queries and retrieved metadata to external domains (data0086.com variants) and later fetching remote media streams for preview/download. External transmission is expected for a search skill, but it is still security-relevant because user input, IP metadata, and potentially local environment behavior are exposed to third-party services; the risk is amplified by configurable origins via environment variables.
Content: Scanner excerpt · SKILL.md (reported line 765)May include surrounding context.
}

text
## curl 示例 **默认站点根须与 [config.json](config.json) 中 `api_origin` 保持一致**（换域名时改 config 并同步下面默认值，或只用 `export`）。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to automatically download video files to local storage after a mock or real purchase, without requiring an additional user confirmation or clearly warning about filesystem side effects. This creates an unsafe side effect boundary: a user interaction that appears to be a content selection or mock transaction can cause persistent local writes and potentially large network transfers, increasing the risk of unwanted file creation, storage abuse, and accidental handling of untrusted remote media.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a flow of “预览(HLS/MP4)”, which implies direct media preview behavior. However, this documentation explicitly says clickable "预览" links in rendered tables/cards must use a SPA detail page instead of the media fragmentUrl, which is a different user interaction and contradicts the stated preview modality.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api_reference.md (reported line 109)May include surrounding context.
bash
ORIGIN="${WENLV_API_ORIGIN:-https://test.data0086.com}" curl "${ORIGIN}/ms-base/home/getList?pageNum=1&pageSize=5" \ -H 'Content-Type: application/json' \ -H "Origin: ${ORIGIN}" \ -H "Referer: ${ORIGIN}/" \

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: At L133 the main path says each search request defaults to pageSize=3, matching the manifest description. But later sections state the skill-side default pageSize is 5 (for example L248, L560, L605, L797), which actively contradicts the earlier procedural requirement and changes actual retrieval behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's comments, usage/help text, and fallback user-facing messages are written only in Chinese, which imposes a specific language on users without offering a choice. This can violate language/locale policy when the skill is not clearly documented as region-specific or multilingual.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This shell script launches the provided URL via platform-specific commands such as open, xdg-open, sensible-browser, and cmd //c start, which triggers external application execution and network access in the user's browser. Although there are comments describing usage, there is no explicit user-facing warning, confirmation, or disclosure at runtime about opening the URL on the local system.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.