ClawHub
Back to skill

Security audit

gallery-dl

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its authentication guidance can expose account passwords through command-line arguments and plaintext credential files without adequate warnings.

Install only if you are comfortable managing gallery-dl and its credentials yourself. Avoid putting real passwords on the command line, prefer restricted tokens or safer auth methods where possible, and if you use .netrc or config files, protect them with owner-only permissions and remove or rotate credentials when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:35
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gallery.py:28
Finding

Authentication Password Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:149
Finding

Plaintext Credential Files Recommended Without Permission Hardening

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

Listing --username, --password, and --netrc as routine options normalizes credential entry mechanisms that are unsafe in many agent and CLI environments. Command-line credentials are commonly exposed through shell history, process inspection, audit logs, and agent execution traces, making this a real credential-access risk.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
| `--limit N` | Limit number of downloads | no limit |
| `--username USER` | Login username | - |
| `--password PASS` | Login password | - |
| `--netrc` | Use .netrc for auth | false |

---

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The example explicitly instructs users to supply credentials on the command line, which is a well-known secret-handling weakness. In a tool-using agent context, those credentials may be captured in transcripts, command logs, observability pipelines, or visible to other local users via process metadata.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

gallery-dl "URL" --username USER --password PASS

text

### 2. .netrc File

Create `~/.netrc`:

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Creating ~/.netrc introduces persistent plaintext credentials on disk, which can be harvested if file permissions are weak, backups are exposed, or the host is shared. While .netrc can be acceptable in some Unix workflows, the skill omits critical safeguards and therefore presents a real credential-handling risk.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

2. .netrc File

Create ~/.netrc:

text
machine twitter.com

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gallery.py (reported line 30)May include surrounding context.

python
parser.add_argument('-v', '--verbose', action='store_true', help='Verbose output')
    parser.add_argument('--username', help='Username for authentication')
    parser.add_argument('--password', help='Password for authentication')
    parser.add_argument('--netrc', action='store_true', help='Use .netrc for authentication')
    parser.add_argument('--config', help='Custom config file')
    
    args = parser.parse_args()

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gallery.py (reported line 50)May include surrounding context.

python
parser.add_argument('-v', '--verbose', action='store_true', help='Verbose output')
    parser.add_argument('--username', help='Username for authentication')
    parser.add_argument('--password', help='Password for authentication')
    parser.add_argument('--netrc', action='store_true', help='Use .netrc for authentication')
    parser.add_argument('--config', help='Custom config file')
    
    args = parser.parse_args()

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation criteria are broad enough to match many generic image-download requests, which can cause the agent to invoke this skill in contexts the user did not explicitly intend. That increases the chance of unnecessary package installation, network access to third-party sites, or guidance for downloading content from services with legal, privacy, or policy constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents passing usernames and passwords directly on the command line and storing credentials in plaintext config files without warning about process-list exposure, shell history retention, file-permission requirements, or safer alternatives. In an agent setting, this can lead to credential leakage into logs, transcripts, telemetry, or multi-user system artifacts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The guidance to create ~/.netrc and a persistent config file encourages long-lived session or credential persistence on the local machine. In an agent environment, this can outlast the immediate task, broaden the blast radius of host compromise, and create unintended cross-task access to third-party accounts.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

2. .netrc File

Create ~/.netrc:

text
machine twitter.com

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gallery.py (reported line 12)May include surrounding context.

python
def run_gallery_dl(args_list):
    """Run gallery-dl command"""
    # Check if gallery-dl is installed
    result = subprocess.run(['which', 'gallery-dl'], capture_output=True)
    if result.returncode != 0:
        print("❌ gallery-dl not found. Install with: pip install gallery-dl")
        sys.exit(1)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gallery.py (reported line 17)May include surrounding context.

python
print("❌ gallery-dl not found. Install with: pip install gallery-dl")
        sys.exit(1)
    
    result = subprocess.run(['gallery-dl'] + args_list, capture_output=True, text=True)
    return result.returncode, result.stdout, result.stderr

def main():

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This wrapper accepts usernames and passwords as command-line arguments, which can expose secrets through shell history, process listings, audit logs, and orchestration tooling. In an agent or multi-user environment, that significantly increases the chance of credential disclosure beyond the intended destination service.

Content

No source excerpt is available for this finding.