other
Warning
- Location
hooks/hooks.json:3- Finding
Unconditional External Network Requests at Every Agent Session Start
- Content
View full analysis
- Remediation
View remediation
Security audit
moviemovie
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly designed to find movie torrents and magnet links, but it also runs network checks automatically, gives unsafe API-key setup advice, and makes an inaccurate privacy claim about third-party data sharing.
Review this skill carefully before installing. It is not a hidden malware package based on the inspected files, but it automatically contacts torrent-related sites on session start, sends movie-search interests to multiple third parties, and encourages risky API-key handling. Only use it in an environment where torrent-site access is acceptable, avoid pasting API keys into chat, and assume searches may be visible to the contacted services and network monitors.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
other
Warning
- Location
SKILL.md:253- Finding
Privacy Disclosure Contradicts Transmission of User-Derived Search Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:95- Finding
TMDb API Key Embedded in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
README.md:128- Finding
Documentation Encourages Users to Paste API Keys into Agent Conversations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
text **Manual setup:** - Claude Code: Add to `.claude/settings.json` or `~/.claude/settings.json`: ```json { "env": { "TORRENTCLAW_API_KEY": "your-key-here" } }
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
text **Manual setup:** - Claude Code: Add to `.claude/settings.json` or `~/.claude/settings.json`: ```json { "env": { "TORRENTCLAW_API_KEY": "your-key-here" } }
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill advertises multi-platform trending aggregation and real-time verification of downloadable resources, but the documented behavior does not substantiate those claims and appears to rely on simpler search and seeder-count heuristics. This is dangerous because users may trust inaccurate provenance and availability claims, which can mislead them into downloading low-quality, fake, or infringing content under false assurances.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill claims it does not send user data to third parties, yet its normal workflow transmits user-provided movie queries to external services such as WebSearch, TMDb, subtitle sites, and torrent-related sources. This is dangerous because it creates a privacy and transparency failure: users may disclose preferences or sensitive queries believing they stay local when they are actually shared externally.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad and overlap with normal entertainment queries such as '最近有什么好看的' or 'recommend movie', which can cause the skill to activate unexpectedly in unrelated conversations. In this skill's context, unexpected activation is more dangerous because the skill is specifically designed to locate torrents and magnet links, potentially steering benign movie chats into piracy-oriented behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to paste API keys into chat for automatic configuration without warning that secrets shared in conversation may be logged, exposed to the model, or mishandled by the agent. This creates unnecessary secret-exposure risk, especially in an agent environment where chat content may be retained or used to trigger additional actions.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README uses role-play framing ('Even if you tell ChatGPT you're an FBI agent...') to discuss bypassing or working around another model's safety restrictions. Even though it is presented as commentary, this normalizes safety-evasion tactics and encourages users to seek models that will comply with torrent and magnet-link requests the safer model would reject.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README tells users to paste a live API key directly into an AI assistant for configuration. That normalizes disclosure of credentials to the model/runtime, which may persist in logs, chat history, telemetry, or downstream tool calls, creating avoidable secret-exposure risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Instructing users to reveal API keys directly to the AI assistant for setup is a direct secret-handling anti-pattern. Secrets disclosed in chat may be retained in transcripts, visible to plugins/tools, or exposed to other users/processes depending on the platform, making later misuse possible.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This repeats the same unsafe pattern for a second credential, encouraging users to disclose a TMDb API key to the assistant. Repetition increases the chance users will treat secret-sharing with the agent as standard practice, expanding accidental credential leakage risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This second instruction repeats the same disclosure pattern for another API key, reinforcing unsafe operational behavior. Even if the referenced API is low sensitivity, teaching users to hand secrets to the assistant increases broader credential-exposure risk across the environment.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README uses role-play framing about being an 'FBI agent' to illustrate bypassing another model's safety restrictions for torrent/magnet-link assistance. This is dangerous because it explicitly normalizes evasion of model safeguards and signals that the skill's intended use includes obtaining potentially infringing download resources.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are very broad and overlap with ordinary movie-chat intents like '最近有什么好看的' or 'trending', increasing the chance the skill activates when a user only wants benign recommendations. In this context, accidental invocation is more dangerous because the skill's default behavior reaches torrent, subtitle, and scraping services tied to piracy-oriented workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The instructions state that non-English titles must not be translated directly and instead require querying for the exact English title. This imposes an English-centric workflow without user opt-in or a clearly documented locale-specific justification, which can violate language/locale policy expectations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
增强版（有 TMDB_API_KEY 时）：
bash curl -s "https://api.themoviedb.org/3/search/movie?api_key=$TMDB_API_KEY&query=英文片名&year=年份&language=zh-CN"基础版：直接用 Step 1.5 的 WebSearch 结果，里面已包含电影信息。
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
增强版（有 TMDB_API_KEY 时）：
bash curl -s "https://api.themoviedb.org/3/search/movie?api_key=$TMDB_API_KEY&query=英文片名&year=年份&language=zh-CN"基础版：直接用 Step 1.5 的 WebSearch 结果，里面已包含电影信息。
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest frames the skill as a movie download-resource search and recommendation tool, but the workflow also performs subtitle searching and review scraping by default. Undisclosed auxiliary behaviors matter because they expand the data flow and external interaction surface beyond what users and operators may reasonably expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The evals validate broad behavior for finding magnet links, torrents, and downloadable copies across multiple sources with no trigger restrictions, policy exclusions, or consent checks. In context, this skill is specifically designed to locate download resources for movies, which increases the likelihood of facilitating copyright infringement, unsafe file acquisition, and expansion into abuse-prone search behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The evals expand the skill from movie torrent/magnet discovery into subtitle search, which is a capability increase beyond the stated purpose. Scope drift matters in agent skills because it can introduce unreviewed behaviors, additional external domains, and different legal/compliance risks without corresponding manifest disclosures or guardrails.
- Content
Bundled hooks can execute when matching lifecycle events occur.
Medium
- Category
- Bundled Execution Surface
- Confidence
- 95% confidence
- Finding
This skill registers a SessionStart hook that automatically executes a local Python script whenever a session begins. Auto-executing bundled code on lifecycle events expands the attack surface because users may trigger code execution without explicit intent, and in this skill's context the functionality is aimed at locating movie download resources, which makes hidden or background behavior less expected and harder to justify.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The empty matcher causes the SessionStart hook to activate unconditionally for every session, making the bundled command run far more broadly than needed. This increases the likelihood of unintended execution, reduces user control, and can be abused to run code in contexts unrelated to the skill's stated purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code contains hard-coded Chinese-language labels and descriptions in comments and user-facing strings, such as '轻量版', '发烧版', and '均衡版'. The file does not indicate any user opt-in, locale selection, or region-specific justification, which violates the language/locale policy criterion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This script sends user search terms to multiple external torrent indexers and an optional third-party API, but the CLI does not clearly warn the user that their query and metadata may be transmitted to several untrusted services. In this skill’s context, the searches concern torrent and magnet-link discovery, which increases privacy, legal, and operational risk because user interest data is exposed to piracy-oriented sites and aggregators.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The text states the skill is designed for Claude and strongly discourages other providers, culminating in language that Claude 'will' execute the instructions as intended. This is a natural-language policy concern because it forces a specific platform preference without presenting it as user choice or a neutral compatibility note.
- Content
Static analysis
No suspicious patterns detected.