Security audit

media-info

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed MediaInfo helper, but its installer downloads and runs third-party build code without integrity verification.

Review this before installing. It is not evidence of malicious intent, but run the installer only in a contained environment or after adding checksum/signature verification and pinning the source. Avoid using MEDIAINFO_URL overrides unless you fully trust the archive, and do not run it where developer tokens, credentials, or sensitive files are exposed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install_mediainfo_local.sh:10
Finding: Remote source archive is downloaded and executed without integrity verification
Content: View full analysis
/dev/null bash ./CLI_Compile.sh ``` ### Technical Analysis The installation script downloads a source archive and executes the archive-provided `CLI_Compile.sh` without first verifying a cryptographic checksum or trusted digital signature. HTTPS protects the connection in transit under normal conditions, but it does not establish that the downloaded artifact is the exact dependency reviewed and approved by the project. The effective payload is mutable because both `MEDIAINFO_VERSION` and `MEDIAINFO_URL` can be supplied through environment variables. The use of `curl -L` also permits redirects. In addition, if an archive already exists at the calculated cache path, the script skips downloading it and trusts the local file without validation. After extraction, the script explicitly invokes the downloaded build script with Bash. Therefore, a malicious archive can run arbitrary shell commands rather than merely supplying compiled dependency source. ### Attack Path 1. An attacker controls the `MEDIAINFO_URL` environme ...[truncated 1359 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a media inspection utility, but its primary behavior includes downloading a remote archive, compiling source code, and installing a local binary. That mismatch is dangerous because users or orchestration systems may authorize it expecting passive metadata analysis, while it actually performs network retrieval and code build steps that expand the attack surface to supply-chain compromise and unexpected system changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script executes CLI_Compile.sh from a remotely downloaded and extracted archive, effectively running untrusted code during installation. This is dangerous because compromise of the upstream archive, DNS/TLS trust, or an overridden MEDIAINFO_URL could lead to arbitrary command execution on the host performing the install.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to run shell commands, build software locally, and write files into a vendor directory, but it does not declare any explicit tool scope or permissions. This weakens containment and review because the operational capabilities exceed what the manifest communicates, increasing the chance of unintended command execution or file modification in environments that rely on declared scope for safety decisions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installer fetches a source archive from a remote URL and builds it locally, which introduces a software supply-chain risk beyond the stated runtime purpose of media inspection. Because the URL and version are environment-overridable and there is no checksum or signature verification, an attacker who can influence the download source, network path, or environment could cause untrusted code to be built and later used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script runs the downloaded build script without any explicit warning or consent prompt that remote code will be executed. In the context of an agent skill for media analysis, this makes the behavior more dangerous because users may reasonably expect file inspection, not installation-time execution of third-party build logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script performs destructive file operations with rm -rf on extracted and output directories and then replaces the installation contents. While some status messages are printed, none explicitly warn the user that existing directories under vendor will be removed and recreated.
Content: No source excerpt is available for this finding.