T09 · Insecure Skill Coding Practices
Warning
- Location
x-aria-download.sh:75- Finding
Hardcoded Aria2 RPC Credential and Private-Network Endpoint Override User Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
X Media Parser
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but its downloader can control an Aria2 service using hardcoded private-network settings and a hardcoded RPC secret.
Review this skill carefully before installing. Parser-only use is relatively straightforward, but do not run the Aria2 downloader unless you have audited and changed the RPC endpoint, secret, download directory, temporary-file handling, and URL validation. Rotate the exposed Aria2 token if it has ever been used.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
x-aria-download.sh:18- Finding
Predictable Shared Temporary File Enables Symlink Overwrite and Race Conditions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
x-aria-download.sh:54- Finding
Unvalidated Third-Party Media URLs Are Delegated to a Network-Capable Aria2 Service
- Content
View full analysis
1 else ('video' if videos else ('images' if len(images) > 1 else ('image' if images else 'unknown')))) ``` ```python for i, url in enumerate(all_urls, 1): ext = url.split('.')[-1].split('?')[0] if ext not in ['jpg', 'jpeg', 'png', 'mp4', 'webm']: ext = 'mp4' if 'video' in typ else 'jpg' filename = f"{prefix}_{i}.{ext}" print(f"添加: {filename}") params = [f"token:{secret}", [url], {"max-connection-per-server": 16, "split": 16, "min-split-size": "1M", "dir": dir_path, "out": filename}] payload = json.dumps({"jsonrpc": "2.0", "method": "aria2.addUri", "id": 1, "params": params}) result = subprocess.run(['curl', '-s', '-X', 'POST', rpc_url, '-H', 'Content-Type: application/json', '-d', payload], capture_output=True, text=True) ``` ### Technical Analysis Media URLs obtained from the external vxtwitter API are submitted directly to `aria2.addUri`. The script does not validate the URL scheme, hostname, port, embedded credentials, resolved IP address, or redirect destination. The substring check for `pbs.twimg.com/media/` only changes image formatting; it is not an authorization check. URLs failing that condition are still accepted through the `elif u` branch. Video URLs receive no domain check at all. Aria2 performs the resulting request from the Aria2 host, which may have access to network destinations unavailable to the original caller. This creates an SSRF-like network pivot if ...[truncated 1775 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented behavior goes beyond media parsing and includes triggering Aria2 downloads, potentially writing files to disk and interacting with RPC services, while the skill description claims it only fetches direct links. This mismatch is dangerous because users and policy systems may authorize a low-risk parser while actually enabling network actions and file downloads with broader security implications.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ## 依赖 - curl - python3 ## 配合 Aria2 使用
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh fi # Call vxtwitter API, then parse with Python to handle special characters curl -s "https://api.vxtwitter.com/Twitter/status/${TWEET_ID}" | python3 -c " import sys, json, re try:
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill description says it parses X/Twitter posts and returns direct media links, but the script goes further and automatically submits those URLs to an aria2 JSON-RPC server for downloading. This is dangerous because it performs undisclosed side effects on local infrastructure, can trigger unexpected downloads/storage consumption, and may interact with an internal service the user did not intend to expose to the skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises shell-based usage and companion scripts but does not declare any tool scope or allowed tools, which weakens policy enforcement and user understanding of what the skill can execute. In an agent environment, undeclared shell capability increases the chance of unexpected command execution or unsafe composition with other tools.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill depends on an external API endpoint, which means user-provided tweet identifiers and request metadata leave the local trust boundary. External transmission is risky when undocumented or unnecessary because it exposes user activity to a third party and adds supply-chain and availability dependencies.
- Content
md ## 底层实现 使用 vxtwitter API: `https://api.vxtwitter.com/Twitter/status/{tweetId}` ## 依赖
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill sends tweet URLs and associated metadata to a third-party API but does not warn users that their inputs are transmitted externally. This creates privacy and compliance risk, especially if tweet links, account names, or surrounding metadata are sensitive in the user's environment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script emits error text in Chinese such as '无法提取推文 ID', and later includes additional Chinese-only messages and labels. This imposes a language choice on users without opt-in or explanation, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Several error and title strings in the embedded Python code are hard-coded in Chinese, including 'API 请求失败', '该推文没有媒体内容', and '的推文'. Because the file does not offer a language selection or explain a region-specific requirement, this is a natural-language policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The shell section advertises configurable RPC URL, secret, and download directory via environment variables, but the embedded Python ignores them and instead hard-codes an internal endpoint (10.0.0.1), a fixed secret, and a fixed path. This is dangerous because it can silently direct requests to an unintended internal service using embedded credentials, defeating operator expectations and potentially exposing or abusing internal download infrastructure.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi curl -s "https://api.vxtwitter.com/Twitter/status/${TWEET_ID}" -o /tmp/tweet.json if [ ! -s /tmp/tweet.json ]; then echo "Error: API request failed"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi curl -s "https://api.vxtwitter.com/Twitter/status/${TWEET_ID}" -o /tmp/tweet.json if [ ! -s /tmp/tweet.json ]; then echo "Error: API request failed"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script sends the supplied tweet-derived identifier to a third-party service using curl, but does not warn the user that data will be transmitted off-host. Although networking is part of the workflow, the file contains no explicit disclosure about contacting an external API provider.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Submitting download jobs to an aria2 JSON-RPC endpoint without explicit disclosure is a meaningful security issue because it causes hidden side effects on another service, not just local parsing. In this skill context, the risk is elevated because the manifest suggests passive parsing, while the implementation actively controls a downloader and writes files to storage.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description and primary usage text are presented in Chinese, with no indication that other languages are supported or that the locale restriction is intentional. This creates a natural-language policy concern because the skill effectively imposes a language choice without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This shell script sends data derived from the user-provided URL to api.vxtwitter.com via curl. While network access is central to the parser's function, the file itself does not include any user-facing notice that a third-party service will be contacted or that tweet-related data will be transmitted.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The code performs a file write to /tmp/tweet.json after fetching tweet metadata, but there is no prior comment, prompt, or user-facing notice that local filesystem data will be created. For this file, the write is not disclosed until after it has already happened.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's status and error messages are presented in Chinese only, such as the parsing and download progress text, with no opt-in or documented locale requirement. This can violate a language/locale policy when a skill imposes a specific language on users without choice.
- Content