Security audit

MGTV

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its MGTV search purpose, but it exposes an unsafe user-supplied URL browser launch path that can go beyond MGTV and may be risky on Windows.

Review before installing. Use it only when you explicitly want MGTV search/playback, avoid passing untrusted URLs to --direct-url, and be especially cautious on Windows until direct URL validation and browser launching are tightened. The Playwright install instructions should not be followed unless you separately trust and need that optional dependency.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/search-mgtv.js:202
Finding: Windows Command Injection Through Unvalidated Direct URL
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:32
Finding: Documentation Recommends Installing an Unpinned and Unused Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
node scripts/search-mgtv.js --query "节目名称"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
node scripts/search-mgtv.js --query "节目名称"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
node scripts/search-mgtv.js --query "节目名称"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
node scripts/search-mgtv.js --query "节目名称"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
node scripts/test.js

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language examples are broad enough that a general assistant may invoke this skill on common entertainment-related requests without sufficiently specific user intent. In a tool that performs external network requests and automatically opens a browser, overbroad triggering increases the risk of surprising actions, privacy leakage of queries, and unintended navigation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises very broad natural-language invocations such as '我想看…', '播放…', and '帮我找一下…', which can overlap with normal conversation and cause the skill to trigger when the user did not explicitly intend to invoke this specific capability. Because the skill opens browser content, accidental activation can lead to unintended network access and launching external pages, even though the underlying purpose appears legitimate rather than malicious.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: All user-facing instructions, examples, and usage guidance are written exclusively in Chinese, and the skill does not state that it supports other languages or that Chinese is required due to a documented regional constraint. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example triggers "我想看《乘风破浪的姐姐》" and "帮我找一下《大侦探》最新一期" are common entertainment requests that do not explicitly mention 芒果 TV. In a skill manifest/markdown trigger description, such broad phrasing can overlap with many other video or search skills and may cause unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The summary explicitly states the skill will automatically open playback pages in the system browser and also supports directly opening arbitrary URLs. Launching external pages without an explicit warning or confirmation can expose users to unwanted navigation, tracking, or phishing if search results or provided URLs are unexpected or attacker-influenced.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language examples show the agent automatically searching and opening content in response to conversational input, without disclosing that an external browser action will occur. In an agent setting, implicit external actions increase the risk of surprise navigation and make social-engineering abuse easier, especially when users paste links or ambiguous titles.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented trigger phrases include very broad everyday requests such as '我想看...', '播放...', and '帮我找...', which can cause the skill to activate in contexts the user did not intend for MGTV. Because the skill's action is to open browser pages automatically, overbroad activation creates a real risk of unintended navigation and surprising side effects rather than being merely cosmetic.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · QUICKSTART.md (reported line 242)May include surrounding context.
bash
# Linux 安装 xdg-open sudo apt-get install xdg-utils # Debian/Ubuntu sudo yum install xdg-utils # CentOS/RHEL

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · QUICKSTART.md (reported line 243)May include surrounding context.
bash
# Linux 安装 xdg-open sudo apt-get install xdg-utils # Debian/Ubuntu sudo yum install xdg-utils # CentOS/RHEL

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · USAGE.md (reported line 159)May include surrounding context.
bash
# Linux 安装 xdg-open sudo apt-get install xdg-utils # Debian/Ubuntu sudo yum install xdg-utils # CentOS/RHEL

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · USAGE.md (reported line 160)May include surrounding context.
bash
# Linux 安装 xdg-open sudo apt-get install xdg-utils # Debian/Ubuntu sudo yum install xdg-utils # CentOS/RHEL

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script exposes a --direct-url parameter even though the skill is described as an MGTV search-and-play tool. That allows the caller to use the skill as a generic browser launcher, which expands its capabilities beyond the declared trust boundary and can be abused to open phishing, malware, or tracking URLs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: When parseMgtvUrl fails to normalize an input into an MGTV playback URL, the code falls back to opening the original caller-supplied URL unchanged. This creates an open-ended browser-launch primitive that can direct users to arbitrary external content, defeating the apparent MGTV-only purpose of the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: In the direct URL flow, the skill opens caller-controlled URLs in the system browser, effectively providing a general-purpose URL opener. In an agent ecosystem, that is risky because other components or prompts could misuse this skill to exfiltrate users to deceptive sites under the guise of media playback.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file states that the skill uses MGTV's official search API and automatically opens playback pages in the system browser. Although the behavior is described, it is not presented as a safety/privacy warning to alert users that queries will be sent to a third-party service and links will be opened automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The document presents the skill name, usage examples, and trigger phrases entirely in Chinese and instructs use through Chinese-language examples, without indicating whether other languages are supported or allowing user opt-in to a locale. Under the stated policy, forcing a specific language without choice can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The behavior section says the skill will open search or playback pages in the browser, but the documentation does not present this as a clear up-front warning tied to triggering. Users may invoke the skill expecting a passive search response, while the skill instead launches external pages automatically, which increases the chance of unwanted browsing actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This manifest file only provides a broad description of the skill as a Mango TV video search and playback skill, but it does not define when the skill should be invoked or what phrases should trigger it. Without explicit trigger scope, example invocations, or exclusions, the activation conditions are ambiguous and could overlap with generic media-related requests.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/search-mgtv.js:224