ClawHub
Back to skill

Security audit

idm-downloader

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: launch Internet Download Manager on Windows to download a user-provided URL, without hidden persistence or unrelated data access.

Install only if you want an agent to start IDM downloads on Windows for URLs you provide. Check the URL, filename, and save directory first, because the skill can start IDM immediately and write downloaded content to disk.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill describes capabilities to read system state, access the network, and invoke Windows shell/COM tooling to download arbitrary URLs, but it does not declare any permissions. This creates a transparency and policy gap: an agent may execute privileged behaviors the user or platform cannot pre-review, and in this context the ability to fetch arbitrary content via IDM increases the risk of unsafe downloads or abuse of local tooling.

Static analysis

No suspicious patterns detected.