Security audit

Video Fetch Download

Security checks for vulnerabilities and agentic risk

Overview

This skill broadly matches its stated download-to-cloud purpose, but its setup instructions and installer include high-impact, under-scoped security risks that users should review before installing.

Review the install script before running it, avoid the documented `curl | sudo bash` rclone install command, and only use this skill in an account/environment where cloud credentials, torrent searches, and local staging-directory cleanup are acceptable. Prefer manual dependency installation or a sandboxed environment, and keep rclone and Quark credential files private.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:187
Finding: Root-Level Execution of a Mutable Remote Installation Script
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:187-190
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet:

bash
# Windows: download from https://rclone.org/install/ # Linux curl https://rclone.org/install.sh | sudo bash

Technical Analysis

The documentation directs users to retrieve a mutable script from an external URL and immediately execute it through a privileged shell. The downloaded content is neither pinned to a specific version nor verified using a locally trusted checksum or cryptographic signature.

HTTPS protects the connection in transit, but it does not protect against compromise of the upstream server, release infrastructure, domain, signing account, or other trusted distribution components. Because the response is streamed directly to sudo bash, the user cannot inspect the effective payload before execution.

Although this command appears in instructions for configuring rclone on another machine rather than in the primary installer, commands presented by a Skill are part of its effective execution workflow.

Attack Path

An attacker compromises the remote installer, its hosting infrastructure, or another trusted part of its delivery chain.

The response served by https://rclone.org/install.sh is changed to contain malicious shell commands.

A user follows the Skill documentation and runs the provided pipeline.

curl streams the attacker-controlled response directly into sudo bash.

The malicious payload executes with root privileges before the user can review it.

Impact Assessment

Successful exploitation provides arbitrary command execution as root. The resulting payload could read or alter credentials and files belonging to all users, install persistent services, modify system binaries, weaken access controls, or fully compromise the host.

The privilege level substantially exceeds what is ne ...[truncated 121 chars]
Remediation: View remediation
Remediation Suggestions

Remove the direct curl | sudo bash instruction.

Prefer an operating-system package manager or a user-local installation that does not require root.

If a downloaded release is necessary, pin it to a specific version and immutable URL.

Publish and verify a cryptographic signature or checksum obtained through an independently trusted channel.

Download the artifact to disk first, verify it, and allow the user to inspect it before execution.

Explicitly document the files and privileges required by the installation procedure.

T08 · Insecure Dependencies

Warning

Location: scripts/install.sh:162
Finding: Unpinned Python Dependency Installed Without Integrity Enforcement
Content: View full analysis
Vulnerability Details

File Location: scripts/install.sh:162-173
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash
# ── 4. Python 3.12 + p115client ────────────────────────────────── if python3.12 -c 'import p115client' &>/dev/null 2&>&1; then ok "p115client already installed" else info "Installing Python 3.12 + p115client ..." if ! command -v python3.12 &>/dev/null; then if command -v yum &>/dev/null; then yum install -y python3.12 &>/dev/null elif command -v apt-get &>/dev/null; then apt-get install -y python3.12 &>/dev/null else fail "Cannot install Python 3.12 — please install it manually and re-run" fi fi python3.12 -m ensurepip 2>/dev/null || true python3.12 -m pip install -q p115client ok "p115client installed" fi

Technical Analysis

The installer requests p115client without pinning an audited version and without enforcing package hashes. Consequently, the installed package can change between otherwise identical executions of the Skill.

Python package installation may execute build backend or setup logic under the identity of the user running the installer. The script also does not isolate the dependency in a virtual environment. If the installer is invoked with elevated privileges, package installation may affect a privileged Python environment.

This behavior contrasts with the explicit checksum verification applied to the downloaded yt-dlp and rclone artifacts elsewhere in the same installer.

Attack Path

The package publisher account, package registry, release process, or a future dependency release is compromised.

A malicious or vulnerable version becomes the version selected by pip.

A user runs scripts/install.sh.

The unpinned pip install p115client command retri ...[truncated 561 chars]
Remediation: View remediation
Remediation Suggestions

Pin p115client to a specifically audited version.

Use a locked requirements file containing SHA-256 hashes and install it with pip install --require-hashes.

Review and lock transitive dependencies as well as the direct dependency.

Install dependencies into a dedicated virtual environment rather than the user's general Python environment.

Refuse to run the pip installation as root.

Establish a controlled upgrade process in which new versions are reviewed and their hashes deliberately updated.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/video_fetch.sh:9
Finding: Shared Predictable Staging Directory Permits File Injection and Overbroad Cleanup
Content: View full analysis
Vulnerability Details

File Location: scripts/video_fetch.sh:9-16,47-68
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code Snippet:

bash
TMPDIR="${VIDEOFETCH_TMPDIR:-/tmp/video-fetch}" if [[ -z "$INPUT" ]]; then echo "Usage: video_fetch.sh <url|magnet|.torrent> [remote:path]" >&2 exit 1 fi mkdir -p "$TMPDIR" FILES=$(find "$TMPDIR" -maxdepth 2 \ $ -name '*.mp4' -o -name '*.mkv' -o -name '*.webm' \ -o -name '*.avi' -o -name '*.mov' -o -name '*.flv' \ -o -name '*.ts' -o -name '*.rmvb' $ \ ! -name '*.part' 2>/dev/null) if [[ -z "$FILES" ]]; then echo "[video-fetch] ERROR: no video file found after download" >&2 exit 1 fi echo "[video-fetch] Uploading to $REMOTE ..." while IFS= read -r FILE; do echo " -> $(basename "$FILE")" rclone copy "$FILE" "$REMOTE" --progress done <<< "$FILES" echo "[video-fetch] Cleaning up ..." find "$TMPDIR" -maxdepth 2 \ $ -name '*.mp4' -o -name '*.mkv' -o -name '*.webm' \ -o -name '*.avi' -o -name '*.mov' -o -name '*.flv' \ -o -name '*.ts' -o -name '*.rmvb' -o -name '*.json' \ -o -name '*.torrent' $ -delete

Technical Analysis

The script uses the fixed shared path /tmp/video-fetch by default instead of creating a private directory for each invocation. It then discovers files by extension rather than tracking files produced by the current download.

Every matching pre-existing file within two directory levels is included in the rclone upload. In a multi-user environment, another local user may be able to place files in the staging tree if its permissions permit it. Symlinks or prepared files with accepted extensions may consequently be passed to rclone alongside legitimate output.

Cleanup is also based solely on filename extensions and deletes matching files regardless of whether the current invocation created ...[truncated 1280 chars]
Remediation: View remediation
Remediation Suggestions

Create a private per-run directory with mktemp -d, for example under ${TMPDIR:-/tmp}.

Apply restrictive permissions such as mode 0700.

Reject pre-existing paths and symlinked staging directories.

Track exact output files produced by aria2c or yt-dlp rather than scanning an entire directory by extension.

Validate candidate files with lstat and reject symbolic links before upload.

Use a guarded trap to remove only the private per-run directory on exit.

Validate custom VIDEOFETCH_TMPDIR values and never recursively delete content from a caller-selected existing directory.

Avoid executing the download workflow as root.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (35)

External Script Fetching

High

Category: Supply Chain
Confidence: 92% confidence
Finding: The documentation recommends curl https://rclone.org/install.sh | sudo bash, which executes network-fetched code immediately with root privileges. If the remote script, hosting infrastructure, TLS trust chain, or DNS path is compromised, the user could suffer full system compromise; the skill context increases risk because this is presented as a convenience step during setup.
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
Windows: download from https://rclone.org/install/

Linux

curl https://rclone.org/install.sh | sudo bash

text
**Step 2 — Run the authorization wizard locally:**

Chaining Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: The shell pipeline chains untrusted remote content directly into sudo bash, combining external fetch and privilege escalation in a single step. This pattern is dangerous because it eliminates opportunities for inspection and turns any upstream compromise into immediate arbitrary root code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
Windows: download from https://rclone.org/install/

Linux

curl https://rclone.org/install.sh | sudo bash

text
**Step 2 — Run the authorization wizard locally:**

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The installer claims it does not modify system-wide paths or install outside the user directory, but it later invokes apt-get/yum and appends PATH changes to shell profile files. This kind of deceptive or inaccurate installer messaging can mislead users into granting trust and executing a script with broader-than-disclosed system impact.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The installer UI tells users that all binaries are installed only to ~/.local/bin and that no system paths are modified, yet it installs aria2 and Python 3.12 via apt-get/yum. This discrepancy is dangerous because it conceals privileged or system-level changes behind a user-local safety narrative, impairing informed consent and review.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: video-fetch-download version: 1.1.9 description: Download videos and torrents to cloud storage. Requires python3.12, rclone (115-fork, installed to ~/.local/bin), yt-dlp, and aria2c. Install via scripts/install.sh (installs all deps to user directory, no sudo; may append ~/.local/bin to PATH in shell profile). Writes credentials to ~/.config/rclone/rclone.conf (115 Pan, chmod 600) and ~/.config/video-fetch/quark_cookie.txt (Quark cookie, chmod 600) — stored locally only, never transmitted to third parties. Supports 115 offline download (server-side, zero local bandwidth), Quark Pan offline download and share link transfers, and 1000+ video site downloads via yt-dlp. Torrent search via Knaben API + apibay. Also supports Google Drive, OneDrive, Dropbox, and any rclone-compatible storage. Keywords: 离线下载, 下载视频, 磁力链, 种子, 夸克转存, 夸克离线, 115网盘, yt-dlp, 搜索电影, 磁力搜索. --- # video-fetch-download

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
md
--- name: video-fetch-download version: 1.1.9 description: Download videos and torrents to cloud storage. Requires python3.12, rclone (115-fork, installed to ~/.local/bin), yt-dlp, and aria2c. Install via scripts/install.sh (installs all deps to user directory, no sudo; may append ~/.local/bin to PATH in shell profile). Writes credentials to ~/.config/rclone/rclone.conf (115 Pan, chmod 600) and ~/.config/video-fetch/quark_cookie.txt (Quark cookie, chmod 600) — stored locally only, never transmitted to third parties. Supports 115 offline download (server-side, zero local bandwidth), Quark Pan offline download and share link transfers, and 1000+ video site downloads via yt-dlp. Torrent search via Knaben API + apibay. Also supports Google Drive, OneDrive, Dropbox, and any rclone-compatible storage. Keywords: 离线下载, 下载视频, 磁力链, 种子, 夸克转存, 夸克离线, 115网盘, yt-dlp, 搜索电影, 磁力搜索. --- # video-fetch-download

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.
md
--- name: video-fetch-download version: 1.1.9 description: Download videos and torrents to cloud storage. Requires python3.12, rclone (115-fork, installed to ~/.local/bin), yt-dlp, and aria2c. Install via scripts/install.sh (installs all deps to user directory, no sudo; may append ~/.local/bin to PATH in shell profile). Writes credentials to ~/.config/rclone/rclone.conf (115 Pan, chmod 600) and ~/.config/video-fetch/quark_cookie.txt (Quark cookie, chmod 600) — stored locally only, never transmitted to third parties. Supports 115 offline download (server-side, zero local bandwidth), Quark Pan offline download and share link transfers, and 1000+ video site downloads via yt-dlp. Torrent search via Knaben API + apibay. Also supports Google Drive, OneDrive, Dropbox, and any rclone-compatible storage. Keywords: 离线下载, 下载视频, 磁力链, 种子, 夸克转存, 夸克离线, 115网盘, yt-dlp, 搜索电影, 磁力搜索. --- # video-fetch-download

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/115_qrlogin.py (reported line 19)May include surrounding context.
python
--- name: video-fetch-download version: 1.1.9 description: Download videos and torrents to cloud storage. Requires python3.12, rclone (115-fork, installed to ~/.local/bin), yt-dlp, and aria2c. Install via scripts/install.sh (installs all deps to user directory, no sudo; may append ~/.local/bin to PATH in shell profile). Writes credentials to ~/.config/rclone/rclone.conf (115 Pan, chmod 600) and ~/.config/video-fetch/quark_cookie.txt (Quark cookie, chmod 600) — stored locally only, never transmitted to third parties. Supports 115 offline download (server-side, zero local bandwidth), Quark Pan offline download and share link transfers, and 1000+ video site downloads via yt-dlp. Torrent search via Knaben API + apibay. Also supports Google Drive, OneDrive, Dropbox, and any rclone-compatible storage. Keywords: 离线下载, 下载视频, 磁力链, 种子, 夸克转存, 夸克离线, 115网盘, yt-dlp, 搜索电影, 磁力搜索. --- # video-fetch-download

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/quark_login.py (reported line 25)May include surrounding context.
python
--- name: video-fetch-download version: 1.1.9 description: Download videos and torrents to cloud storage. Requires python3.12, rclone (115-fork, installed to ~/.local/bin), yt-dlp, and aria2c. Install via scripts/install.sh (installs all deps to user directory, no sudo; may append ~/.local/bin to PATH in shell profile). Writes credentials to ~/.config/rclone/rclone.conf (115 Pan, chmod 600) and ~/.config/video-fetch/quark_cookie.txt (Quark cookie, chmod 600) — stored locally only, never transmitted to third parties. Supports 115 offline download (server-side, zero local bandwidth), Quark Pan offline download and share link transfers, and 1000+ video site downloads via yt-dlp. Torrent search via Knaben API + apibay. Also supports Google Drive, OneDrive, Dropbox, and any rclone-compatible storage. Keywords: 离线下载, 下载视频, 磁力链, 种子, 夸克转存, 夸克离线, 115网盘, yt-dlp, 搜索电影, 磁力搜索. --- # video-fetch-download

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
bash
python3 scripts/115_qrlogin.py # Scan the QR code with 115 App → confirm → done # Credentials are saved securely to rclone config (chmod 600)

Re-login when cookie expires: python3 scripts/115_qrlogin.py

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
bash
python3 scripts/115_qrlogin.py # Scan the QR code with 115 App → confirm → done # Credentials are saved securely to rclone config (chmod 600)

Re-login when cookie expires: python3 scripts/115_qrlogin.py

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
Windows: download from https://rclone.org/install/

Linux

curl https://rclone.org/install.sh | sudo bash

text
**Step 2 — Run the authorization wizard locally:**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document states that authentication credentials are automatically written into the user's rclone configuration, but it does not warn that this creates locally stored long-lived access material. If users are unaware of where the credentials are stored or how to protect that file, they may expose account access through weak file permissions, backups, logs, or accidental sharing of the config.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring presents the tool as a 115 offline-download task manager that adds or lists offline tasks. However, the implementation shells out to rclone config file to discover a local config file path, introducing process-execution capability beyond the documented task-management behavior.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/115_offline.py (reported line 19)May include surrounding context.
python
def get_rclone_config_path(): """动态获取 rclone 配置文件路径，兼容所有用户和平台""" try: result = subprocess.run( ["rclone", "config", "file"], capture_output=True, text=True, check=True )

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script reads sensitive credential material from the user's rclone configuration and reconstructs an authenticated 115 cookie without any explicit consent prompt or clear disclosure at runtime. Even if intended for legitimate automation, accessing and repurposing stored credentials increases the risk of silent credential misuse or accidental exposure if the script is run in a broader agent context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script silently consumes stored uid, cid, seid, and kid values from rclone configuration to authenticate as the user. In an agent or shared environment, this lack of user-facing warning reduces informed consent and makes unauthorized use of existing local credentials more likely.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module description says it is a QR login script, but the code also persists long-lived authentication material into the user's rclone configuration. That mismatch can mislead users about the security-sensitive side effect, causing them to authorize and store credentials without informed consent or awareness of local persistence.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/115_qrlogin.py (reported line 104)May include surrounding context.
python
_rclone_cmd = None for _candidate in _rclone_candidates: try: _test = subprocess.run([_candidate, "--version"], capture_output=True) if _test.returncode == 0: _rclone_cmd = _candidate break

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/115_qrlogin.py (reported line 114)May include surrounding context.
python
cfg_path = "" if _rclone_cmd: try: cfg_result = subprocess.run([_rclone_cmd, "config", "file"], capture_output=True, text=True) for line in cfg_result.stdout.splitlines(): line = line.strip()

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script states that no credentials are collected during installation and that authentication is handled separately, but it launches 115 Pan authorization as part of the installer flow. Even if QR-based auth avoids password entry, this still initiates account authorization during install and misrepresents the security-sensitive behavior of the script.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/install.sh (reported line 9)May include surrounding context.
sh
# - MAY append ~/.local/bin to PATH in shell profile files (~/.bashrc, ~/.profile) if not already present # - No credentials are collected during installation; auth is handled separately # User-local install directory (no root/sudo required) INSTALL_DIR="${HOME}/.local/bin" mkdir -p "${INSTALL_DIR}" [[ ":${PATH}:" != *":${INSTALL_DIR}:"* ]] && export PATH="${INSTALL_DIR}:${PATH}"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install.sh (reported line 11)May include surrounding context.
sh
# User-local install directory (no root/sudo required) INSTALL_DIR="${HOME}/.local/bin" mkdir -p "${INSTALL_DIR}" [[ ":${PATH}:" != *":${INSTALL_DIR}:"* ]] && export PATH="${INSTALL_DIR}:${PATH}" set -euo pipefail

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file contains multiple hard-coded Chinese user-facing strings and a built-in Chinese title mapping, while the CLI interface does not provide any option to select language or opt into Chinese output. This is a natural-language policy concern because the skill imposes a specific locale on users rather than offering a choice or documenting a justified region-specific limitation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The script transmits user-supplied search terms and retrieved magnet-related metadata to external torrent-indexing services, and optionally forwards a magnet URI to another external download service. In this context, external transmission is materially sensitive because it involves piracy-oriented queries and content identifiers, creating privacy, compliance, and trust risks for users or calling agents.
Content: Scanner excerpt · scripts/magnet_search.py (reported line 41)May include surrounding context.
python
'勇敢新世界': 'Captain America Brave New World', } KNABEN_API = 'https://api.knaben.org/v1' APIBAY_API = 'https://apibay.org/q.php'

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Remediation Suggestions

SkillSpector

External Script Fetching

Windows: download from https://rclone.org/install/

Linux

Chaining Abuse

Windows: download from https://rclone.org/install/

Linux

Intent-Code Divergence

Intent-Code Divergence

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Windows: download from https://rclone.org/install/

Linux

Missing User Warnings

Context-Inappropriate Capability

subprocess module call

Context-Inappropriate Capability

Missing User Warnings

Intent-Code Divergence

subprocess module call

subprocess module call

Intent-Code Divergence

Sudo/Root Execution

Session Persistence

Natural-Language Policy Violations

External Transmission

Static analysis