idm-downloader

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Windows IDM downloader with disclosed download behavior and no evidence of hidden persistence, exfiltration, or destructive actions.

Install only if you use IDM on Windows and intend to let the agent start downloads from URLs you provide. Prefer installing pywin32 in a virtual environment with a pinned trusted version, and review the target URL and output path before running the downloader.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:45

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–49
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

markdown

| Dependency | Purpose | Install Command |
|------------|---------|-----------------|
| Python 3.x | Runtime | - |
| pywin32 | COM interface & registry access | `pip install pywin32` |
| win32com.client | IDM COM automation | (included in pywin32) |

Technical Analysis

The documentation instructs users to install pywin32 without specifying an audited version or verifying a package hash. Consequently, package resolution is mutable: the version installed in the future may differ from the version available when this Skill was reviewed.

This is a supply-chain hardening weakness rather than evidence that the current pywin32 package is malicious. Exploitation would require compromise of the package, its distribution channel, the configured Python package index, or the user's dependency-resolution environment.

Attack Path

1. A user follows the documented command and runs pip install pywin32.
2. pip resolves the package from the user's configured package index without a version or hash constraint.
3. If that package source or a subsequently published release has been compromised, the altered package is downloaded.
4. Package installation or later import by scripts/download_idm.py executes attacker-controlled code under the account running Python.
5. The malicious dependency can act with that account's filesystem, network, and Windows API permissions.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user installing or running the dependency. The affected scope may include files, credentials, network resources, and Windows APIs accessible to that account. Administrative impact is possible only if installation or execution occurs from an elevated session; the ...[truncated 227 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pywin32 to a specifically reviewed version, for example through a locked requirements file.
• Record and verify package hashes using a command such as pip install --require-hashes -r requirements.txt.
• Explicitly use a trusted package index and review any organization-level mirror configuration.
• Periodically update the pinned version through a controlled dependency-review process.
• Document that users should install dependencies in an isolated virtual environment and avoid elevated installation unless strictly necessary.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill describes capabilities that involve network access, shell execution, and likely file system interaction, but it does not declare any explicit tool scope or permissions boundaries. This increases the risk that an agent runtime may grant broader-than-necessary access, enabling unintended command execution or arbitrary downloads from untrusted URLs.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_idm.py (reported line 131)May include surrounding context.

python

'/n'  # Start immediately
    ]

    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode == 0:
        print("Download started successfully in IDM")
        return True

Static analysis

No suspicious patterns detected.