Security audit

Qbittorrent

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent qBittorrent controller, but it deserves review because it can delete downloaded files and stores a reusable WebUI session cookie in a predictable temporary file.

Install only if you want an agent to control your qBittorrent WebUI. Use a non-default password, keep the WebUI bound to localhost or protected by HTTPS, protect the credentials file, and require explicit confirmation before delete --files, all-target control, preferences, or global speed-limit changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill documents execution of shell commands (`./scripts/qbit-api.sh ...`) but does not declare permissions for shell capability. This creates a transparency and governance gap: the agent may invoke local command execution against the qBittorrent API without users or policy layers having an accurate view of the skill's actual capabilities.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description presents the skill as basic torrent management, but the documented behavior includes broader and more sensitive operations such as reading full preferences, manipulating categories/tags, uploading local torrent files, and changing global speed limits. This mismatch can cause an agent or reviewer to authorize the skill under a narrower trust model than the skill actually requires, increasing the risk of unauthorized state changes or information disclosure.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The preferences command returns full qBittorrent application preferences, which can expose broader configuration data than needed for ordinary torrent management, including paths, network settings, and operational defaults. In an agent context, this increases unnecessary data access and may reveal sensitive environment details to downstream consumers.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation includes destructive deletion commands, including deletion of torrent data files, without warning about permanence or requiring confirmation. In an agent setting, this can lead to accidental irreversible data loss if the command is selected or paraphrased from a user request without adequate safeguards.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The delete operation supports permanent torrent removal and optional deletion of downloaded files without any built-in confirmation, dry-run mode, or safety interlock. In an agent-driven workflow, a mistaken or manipulated invocation could cause irreversible data loss quickly and silently.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.