Security audit

File Downloader

Security checks for vulnerabilities and agentic risk

Overview

This downloader does what it claims, but it gives an agent broad URL-fetching and file-writing power without enough safeguards against unsafe destinations or overwrites.

Install only if you are comfortable with the agent downloading from arbitrary URLs and writing files wherever its process has permission. Use a dedicated downloads directory, avoid sensitive paths, verify the URL source, and do not run it with elevated privileges.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/download.py:14
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
str: """Download a file from url and save to save_path. Returns the absolute path.""" os.makedirs(os.path.dirname(save_path) or ".", exist_ok=True) resp = requests.get(url, stream=True, timeout=120) resp.raise_for_status() with open(save_path, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): f.write(chunk) return os.path.abspath(save_path) ``` ### Technical Analysis The application passes a caller-controlled URL directly to `requests.get()` without validating the scheme, hostname, port, or resolved IP address. It does not block loopback, link-local, private, reserved, or cloud metadata addresses. The `requests` library also follows HTTP redirects by default. Consequently, validating only the initial hostname in a future partial fix would remain insufficient: a public endpoint could redirect the request to an internal address unless every redirect destination and resolved address is validated. The request is made with the network privileges of the process running the Skill. This creates an SSRF primitive capable of reaching services that may be inaccessible from the user’s own network. ### Attack Path 1. An attacker supplies a URL targeting a loopback, private-network, link-local, or cloud metadata endpoint. Alternatively, the attacker supplies a public URL that redirects to such an endpoint. 2. The Skill passes the URL directly to `requests.get()`. 3. The Agent host connects to the destination using its own network access. 4. The endpoint’s response is written to a local file. 5. If the resulting file can be returned, read, or processed later, information exposed by the internal endpoint may become accessible outside its in ...[truncated 409 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/download.py:14
Finding: Caller-Controlled Save Path Allows Arbitrary Writable-File Overwrite
Content: View full analysis
str: """Download a file from url and save to save_path. Returns the absolute path.""" os.makedirs(os.path.dirname(save_path) or ".", exist_ok=True) resp = requests.get(url, stream=True, timeout=120) resp.raise_for_status() with open(save_path, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): f.write(chunk) return os.path.abspath(save_path) ``` ```python if args.save_path: save_path = args.save_path else: save_path = os.path.join(".", _filename_from_url(args.url)) ``` ### Technical Analysis The caller controls `save_path`, which is used for directory creation and then passed directly to `open(..., "wb")`. No canonicalization or confinement check ensures that the destination remains inside a dedicated download directory. Absolute paths and traversal components can therefore target any location writable by the process. Opening an existing file in `wb` mode immediately truncates it. The implementation also does not reject symbolic-link destinations, allowing an attacker to redirect the write to a different writable target where filesystem conditions permit it. ### Attack Path 1. An attacker chooses content hosted at a URL under the attacker’s control. 2. The attacker supplies an absolute path, a path containing traversal components, or a path resolving through a symbolic link as `--save_path`. 3. The script creates missing parent directories where permitted. 4. `open(save_path, "wb")` follows normal path resolution and truncates an existing target or creates a new file. 5. The remote response is written over the selected target. ### Impact Assessment An attacker can create, truncate, or replace files that are ...[truncated 430 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download.py:19
Finding: Unbounded Streaming Download Can Exhaust Local Storage
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:76
Finding: Dependency Installation Guidance Does Not Pin or Verify Requests
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises and enables network-based file downloading but does not declare any explicit tool scope, permissions, or allowed-tools boundary. That omission weakens governance and review because consumers cannot clearly see that the skill performs network access, increasing the chance of unreviewed outbound requests or unsafe reuse in more privileged environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly downloads remote content and writes it to a user-specified local path, yet it does not warn about overwrite risk, sensitive directories, or storage of untrusted files. In context, this is materially dangerous because the skill is specifically designed to save arbitrary remote content to disk, which can lead to accidental clobbering of files or placement of malicious content in trusted locations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.