Download Tools

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:49 PM UTC
• Version: 1.0.0

Overview

This skill appears to be a straightforward pair of command-line download helpers, with some ordinary hardening gaps users should understand before running it.

Install only if you are comfortable with these scripts making outbound requests to URLs you provide and writing local output files. Use trusted YouTube and WeChat URLs, avoid running the scripts with elevated privileges, and consider adding host validation, safer temporary-file handling, and overwrite prompts before routine use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: wechat-dl.sh:9

Finding

Unrestricted URL Retrieval Enables Server-Side Request Forgery

Content

View full analysis

/tmp/wechat_tmp.html ``` ### Technical Analysis The script is documented as a WeChat article downloader, but it passes the first command-line argument directly to `curl`. It does not validate the URL scheme, destination hostname, resolved IP address, or redirect destination. The `-L` option instructs `curl` to follow redirects. Consequently, validating only the initially supplied URL would also be insufficient: an allowed public URL could redirect the request to localhost, a private network address, a link-local service, or a cloud instance metadata endpoint. This creates an SSRF-like request primitive whenever an untrusted party can influence the URL passed to the Skill. The response is stored on the local filesystem and subsequently inspected and processed by the script. There is no evidence that the response is automatically exfiltrated to an external party, which limits the impact compared with a fully interactive SSRF vulnerability. ### Attack Path 1. An attacker causes the Agent or user to invoke `wechat-dl.sh` with an attacker-controlled URL. 2. The supplied URL directly targets an internal resource, or an attacker-controlled public endpoint redirects to one. 3. `curl -L` sends the request from the machine running the Skill and follows the redirect. 4. The internal response is written to `/tmp/wechat_tmp.html`. 5. If the response contains the expected `js_content` marker, portions of it may be extracted into the chosen output file ...[truncated 924 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: wechat-dl.sh:25

Finding

Predictable Shared Temporary File Permits Symlink Overwrite and Race Conditions

Content

View full analysis

/tmp/wechat_tmp.html if ! grep -q "js_content" /tmp/wechat_tmp.html; then echo "❌ 获取页面失败" rm -f /tmp/wechat_tmp.html ``` The same fixed path is also reused later: ```bash sed -n '/id="js_content"/,/<\/div>/p' /tmp/wechat_tmp.html | \ sed 's/<[^>]*>//g' | \ sed 's/ / /g' | \ sed 's/&/\&/g' | \ sed 's/<//g' | \ sed 's/"/"/g' | \ sed 's/[[:space:]]\+/ /g' > "${OUTPUT}.txt" rm -f /tmp/wechat_tmp.html ``` ### Technical Analysis The script always writes downloaded content to `/tmp/wechat_tmp.html`. Shared temporary directories are normally writable by other local users. Shell output redirection follows an existing symbolic link, so an attacker who creates that path as a symlink before execution can redirect the write to another file accessible to the victim. The predictable path also causes a time-of-check/time-of-use and concurrency problem. Multiple instances can overwrite, inspect, or remove the same file, potentially causing one invocation to process content downloaded by another invocation. The later `rm -f` operation does not prevent exploitation because the target has already been opened and truncated by the earlier redirection. ### Attack Path 1. A local attacker predicts the constant path `/tmp/wechat_tmp.html`. 2. Before the victim starts the script, the attacker creates that path as a symbolic link to a file writable by the victim. 3. The victim runs `wechat-dl.sh`. 4. Shell redirection follows the symbolic link and truncates the target file. 5. `curl` writes the downloaded response into that target. 6. Alternatively, concurrent script executions overwrite or remove each other's temporary data, resulting in corrupted or substituted output. ### Impact Assessment The write occur ...[truncated 705 chars]

Remediation

View remediation

"$TMP_FILE" if ! grep -q "js_content" "$TMP_FILE"; then exit 1 fi ``` Additional hardening measures: 1. Quote every reference to the generated temporary filename. 2. Use a private temporary directory created with `mktemp -d` if multiple intermediate files are required. 3. Set `umask 077` so temporary content is readable only by the invoking account. 4. Use an `EXIT` trap so cleanup occurs on success, failure, interruption, or an early exit. 5. Avoid running the downloader with elevated privileges. 6. Consider writing directly to a securely created file descriptor to reduce path-based race opportunities further. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

There is a partial mismatch between the declared description and the actual code chunk. The code clearly implements a WeChat article downloader/extractor, but there is no YouTube functionality in the supplied chunk. Also, the behavior is not just downloading; it parses the page, extracts article text, and saves cleaned plaintext output. That said, the code remains broadly related to WeChat downloading, so the mismatch is about incomplete and somewhat imprecise description rather than unrelated or malicious behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code is clearly a YouTube audio downloader CLI, not a combined YouTube-and-WeChat download tool. It validates dependencies and arguments, then uses yt-dlp and ffmpeg to extract MP3 audio from a YouTube URL with metadata and thumbnail embedding. There is no WeChat handling, no WeChat-specific logic, and no multi-platform support in this chunk. This is a description/behavior mismatch because part of the declared purpose materially overstates the implemented functionality.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · wechat-dl.sh (reported line 32)May include surrounding context.

sh

if ! grep -q "js_content" /tmp/wechat_tmp.html; then
    echo "❌ 获取页面失败"
    rm -f /tmp/wechat_tmp.html
    exit 1
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · wechat-dl.sh (reported line 46)May include surrounding context.

sh

if ! grep -q "js_content" /tmp/wechat_tmp.html; then
    echo "❌ 获取页面失败"
    rm -f /tmp/wechat_tmp.html
    exit 1
fi

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · yt-audio.sh (reported line 130)May include surrounding context.

sh

)/${OUTPUT_NAME}.mp3"
        echo "📊 文件大小: $(ls -lh "${OUTPUT_NAME}.mp3" 2>/dev/null | awk '{print $5}')"
    else
        echo ""
        echo -e "${RED}❌ 下载失败${NC}"
        echo ""
        echo "可能的原因和解决方案:"
        echo ""
        echo "1. YouTube 限制了此视频的下载"
        echo "   - 尝试使用浏览器 cookie"
        echo "   - 使用: --cookies-from-browser chrome"
        echo ""
        echo "2. 需要登录 YouTube Premium"
        echo "   - 部分视频只有 Premium 用户才能下载"
        echo ""
        echo "3. 网络问题"
        echo "   - 尝试使用代理: --proxy \"socks5://127.0.0.1:1080\""
        echo ""
        echo "4. 更新 yt-dlp"
        echo "   - pip install -U yt-dlp"
        echo ""
        
        exit 1
    fi
}

# 主程序
main() {
    check_dependencies
    check_args "$@"
    
    local URL="$1"
    local OUTPUT_NAME="${2:-audio}"
    
    download_audio "$URL" "$OUTPUT_NAME"
}

main "

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises shell-based tooling and installation steps but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, this increases the chance that the skill can invoke broader shell capabilities than reviewers or orchestrators expect, weakening containment and auditability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 header forces a language/locale preference in network requests. Under the policy, locale constraints should not be imposed without user opt-in unless they are clearly documented and justified as region-specific behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-facing title, usage text, status messages, errors, and help output are all written in Chinese throughout the script. For a general-purpose YouTube audio downloader, this imposes a specific language on users without opt-in or any indication that the skill is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This shell script performs a file write to ${OUTPUT}.txt and the only user-facing messaging describes download progress and success, not the fact that local filesystem contents will be created or potentially overwritten. For code files, file writes should have some visible disclosure unless clearly warned elsewhere; the header usage text does not explicitly warn about this side effect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.