T09 · Insecure Skill Coding Practices
Error
- Location
scripts/M3u8Download.py:119- Finding
Server-Side Request Forgery Through Unrestricted Playlist and Media URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
m3u8 video downloader
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent M3U8 downloader, but its downloader code uses unsafe network and file handling that deserves manual review before installation.
Install only after reviewing or fixing the downloader. Use it only with trusted M3U8 URLs, prefer a sandbox with limited network and filesystem access, avoid sensitive output paths, and remove TLS bypasses and URL/path validation gaps before routine use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/M3u8Download.py:91- Finding
TLS Certificate Verification Disabled for All Downloads
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/M3u8Download.py:78- Finding
Arbitrary File Write and Unsafe Directory Removal Through User-Controlled Output Path
- Content
View full analysis
.m3u8` is overwritten. Segment and key files are also created beneath the user-selected directory. The destination MP4 path is passed directly to ffmpeg. Cleanup uses `os.removedirs(self._file_path)`. Unlike `os.rmdir`, this function attempts to remove the specified directory and then recursively removes empty parent directories. This can affect directories above the intended temporary folder. Symbolic-link and race protections are also absent, so a local attacker with access to the workspace may be able to redirect operations toward other filesystem locations. ### Attack Path 1. An attacker supplies an output name containing an absolute path or traversal components such as `../../target`. 2. The path is accepted without canonical containment validation. 3. The downloader creates a direct ...[truncated 988 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/M3u8Download.py:160- Finding
Untrusted Playlist Directives Passed to ffmpeg With Broad File Acceptance
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs use of filesystem access, network access, and shell execution via Python and ffmpeg, but it does not declare any tool scope or permission boundaries. That makes the skill harder to sandbox and review, and increases the risk of unintended or excessive capability use if invoked automatically or in a permissive agent environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match generic requests like 'download video from URL' or 'download streaming video,' which could cause the skill to activate in contexts the user did not specifically intend. Because the skill performs network fetching, decryption-key retrieval, file writes, and shell-based media processing, unintended invocation materially increases exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly supports downloading remote playlists, TS segments, and AES-128 keys, but it does not warn users that their supplied URLs and related resources will be fetched over the network and written locally. In this context, the missing warning is more significant because key retrieval and remote media processing can expose sensitive URLs, access internal resources if misused, or surprise users about what external requests are being made.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The code disables TLS certificate verification when fetching the M3U8 playlist, allowing an attacker on the network or a malicious proxy to intercept and modify the playlist contents without detection. In this skill's context, that is especially dangerous because the playlist controls subsequent segment and key URLs, enabling silent redirection to attacker-chosen media, keys, or internal endpoints.
- Content
python print("m3u8_url: ", m3u8_url) if m3u8_url.startswith("http"): # is url try: with requests.get(m3u8_url, timeout=(3, 30), verify=False, headers=self._headers) as res: self._front_url = res.url.split(res.request.path_url)[0] print("res: ", res.status_code) if "EXT-X-STREAM-INF" in res.text: # 判定为顶级M3U8文件，则再调用一次本函数
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Disabling TLS verification for TS segment downloads permits tampering with the downloaded media stream in transit. Because this downloader fetches many attacker-influenced URLs from a playlist, a man-in-the-middle can replace segments, corrupt output, or redirect requests to unintended hosts while the user sees a seemingly successful download.
- Content
python try: if not os.path.exists(name): with requests.get(ts_url, stream=True, timeout=(5, 60), verify=False, headers=self._headers) as res: if res.status_code == 200: with open(name, "wb") as ts: # 这里原来是chunk 分块下载 ts.write(res.content)
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Fetching encryption keys with TLS verification disabled is particularly sensitive because the key determines decryption of the media and trust in the final output. A man-in-the-middle attacker can substitute the key or redirect retrieval, causing decryption failure, content tampering, or covert replacement of protected streams.
- Content
python true_key_url = self._m3u8_url.rsplit("/", 1)[0] + '/' + may_key_url try: with requests.get(true_key_url, timeout=(5, 30), verify=False, headers=self._headers) as res: with open(key_path, 'wb') as f: f.write(res.content) # 使用相对路径引用key文件
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python '-c', 'copy', '-f', 'mp4', mp4_path] print(f"\n执行命令: {' '.join(cmd)}\n") print("正在合并视频...") subprocess.run(cmd, check=True) print("视频合并完成！") def delete_file(self):
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language policy issues apply to all file types, including code comments, docstrings, and string literals. This file presents its usage instructions, notices, and interactive prompts entirely in Chinese, with no option for another language and no indication that the tool is intentionally region-specific.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a skill for parsing playlists, downloading segments, handling keys, and merging to MP4. Launching the OS file browser via os.startfile is a separate local-application interaction capability that is not necessary to perform the advertised download task.
- Content
Static analysis
No suspicious patterns detected.