Security audit

Internet Archive Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Internet Archive helper; it has real install, download, credentialed metadata, and documented upload-related risks, but I found no hidden, deceptive, or unrelated behavior.

Install only if you want an agent to work with archive.org through the ia CLI. Review package installation, keep IA keys private, prefer dry-run for downloads, and explicitly verify item identifiers, local file paths, and metadata changes before any credentialed operation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README advertises upload and metadata modification features that can change remote Archive.org account state, but it does not warn users that these actions are not read-only and may publish, alter, or overwrite content tied to their account. In an agent-skill context, unclear documentation around state-changing operations increases the risk of accidental destructive or unauthorized actions when a user assumes the skill is primarily for search/download.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README tells users to configure Archive.org credentials and retrieve keys, but it does not include any guidance on protecting API secrets, avoiding accidental logging, or limiting exposure in shared environments. Because this skill supports authenticated upload/metadata operations, poor credential-handling guidance can lead to account compromise and unauthorized modification of Archive.org content.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger phrases include broad terms like `存档相关` and `archive.org`, which can cause the skill to activate on ordinary conversation rather than clear user intent. In a skill that can install software, download content, upload files, and modify remote metadata, accidental invocation raises the risk of unintended side effects and user-impacting actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises automatic installation, uploads, and metadata modification without clearly stating that these actions can change the local environment or alter remote account data. In context, this is more dangerous because the skill supports authenticated actions against a user's Internet Archive account and package installation on the host, so a misunderstood or ambiguous request could lead to unwanted changes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill can install software automatically by invoking uv, pipx, or pip with no confirmation, warning, or policy check. In an agent context, this is dangerous because it changes the host environment, may pull code from external package indexes, and expands the attack surface without explicit user consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The download intent writes remote content to local disk, including an arbitrary user-supplied destination directory, without any user-facing warning, allowlist, or path safety control. In an agent setting, this can fill disk, place untrusted files in sensitive locations, or stage later exploitation by dropping malicious content into accessible directories.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The upload intent transmits local files and metadata to a remote service with no confirmation, preview, or data-loss prevention guardrails. In an agent environment, this creates a clear exfiltration path: a prompt or higher-level tool misuse could cause sensitive local files to be uploaded externally using configured archive credentials.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The metadata intent can alter remote item state using modify, append, remove, and related options without explicit warning or approval. Because the skill may operate with stored credentials, unintended prompts or misuse could deface items, corrupt metadata, or cause irreversible remote changes.

Static analysis

No suspicious patterns detected.