Security audit

Pathé Movie Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Pathé Netherlands movie lookup helper, with disclosed network use and a minor temp-file media handling caveat.

Before installing, be aware that movie queries are sent to Pathé's website, default cinema behavior is centered on selected Netherlands venues, and WhatsApp poster delivery may temporarily save public poster images locally. Prefer explicit user requests for WhatsApp sending and clean up downloaded media after use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill uses network access and references local file handling, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent may use broader capabilities than the skill metadata communicates, increasing the chance of unintended file or network actions during activation.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest says to trigger when the user "mentions a Pathé movie/show, wants a poster, asks about a description/rating, or requests showtimes for a specific cinema," but it does not clearly constrain activation to explicitly Pathé-specific requests in all listed cases. Phrases like wanting a poster or asking about a description/rating are common movie-related intents and may overlap with requests that are not meant for this skill.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The instructions require `/api/show/{slug}?language=nl`, `/api/show/{slug}/cinemas?language=nl`, and `/api/show/{slug}/showtimes/{cinema}?language=en`, which forces specific locales in responses. The skill does not state that users can opt into another language or that the locale restriction is intentional and justified, creating a language/locale policy issue.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill's stated purpose is Pathé API lookup, but the instructions extend behavior into downloading media locally for WhatsApp delivery. This broadens the operational scope from passive retrieval to file acquisition and local handling, which increases attack surface and can enable unsafe content fetching or unintended persistence on the host.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Local download and storage are not necessary for a simple movie lookup skill and are insufficiently justified in the specification. Unnecessary file write capability increases risk of disk misuse, retention of untrusted content, and abuse through malformed or oversized media responses.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The markdown directs the agent to download and save media files locally without any warnings or controls around file writes, temporary storage, cleanup, or validation. This normalizes local persistence of externally fetched content and can lead to unsafe handling, data retention, or resource exhaustion in environments where filesystem access is sensitive.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: Several API helper functions force specific language values, using Dutch ("nl") for some endpoints and English ("en") for another, with no indication of user opt-in or locale selection. This is a natural-language policy concern because the skill constrains language/locale behavior implicitly rather than allowing user choice or clearly documenting a justified regional limitation.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The config fixes cinema selection to specific Pathé venues in the Netherlands, which implies a locale-specific behavior. Because no accompanying opt-in, user choice, or justification appears in this file, it may conflict with the policy against forcing a specific locale without user consent.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The reference specifies `language=nl` for several endpoints and `language=en` for showtimes, which imposes fixed locales in the skill guidance. This can violate language/locale policy when no user opt-in or justification is provided for forcing those languages.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The helper performs HTTP requests to an external API using urllib without any visible confirmation prompt, logging, print statement, or explanatory comment/docstring describing that user-provided movie queries will be sent over the network. Because this is a code file, external data transmission should have some form of disclosure unless clearly communicated elsewhere.

Static analysis

No suspicious patterns detected.