Security audit

moviemovie

Security checks for vulnerabilities and agentic risk

Overview

This skill openly searches movie torrent and magnet-link sources, but it needs Review because it auto-runs network checks, has broad activation wording, and gives unsafe API-key guidance.

Review carefully before installing. Disable or remove the SessionStart hook if you do not want automatic startup network checks, configure API keys only through environment variables or a trusted secrets UI, and assume torrent/magnet results are legally sensitive and untrusted.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The eval adds subtitle-search behavior that is not described in the skill metadata, expanding the skill's effective scope without clear disclosure or guardrails. Hidden or drifting capabilities are risky because they can bypass user expectations, policy review, and downstream safety controls tied to the declared movie-download purpose.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The README explicitly tells users to paste API keys into the agent conversation for configuration, without warning that conversational channels may be logged, retained, exposed to tools, or visible in chat history. This creates a credible secret-handling risk: users may disclose long-lived credentials in an unsafe channel, leading to account compromise or API abuse if logs or transcripts are accessed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README tells users to paste API keys directly into Claude Code/OpenClaw so the agent can configure them, but gives no warning that secrets may be logged, retained in chat history, or exposed to plugins/tools. In an agent-based environment, encouraging users to disclose credentials in natural-language chat increases the chance of unintended secret leakage and misuse.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The README strongly pushes users toward Claude specifically because it will comply with torrent and magnet-link workflows that other models may restrict. This is coercive steering that encourages use of a less restrictive model for a piracy-adjacent task, reducing the likelihood that safety controls will intervene.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes very broad terms like 'download', 'magnet', 'trending', and '最近有什么好看的', which are likely to match ordinary conversation unrelated to torrent searching. Overbroad invocation can cause the skill to activate unexpectedly and begin external scraping/searching without the user clearly intending to use a torrent-discovery workflow.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill states that subtitle-site scraping is always performed in parallel as a standard step, even when the user did not ask for subtitles, and without a clear warning at execution time. This increases unnecessary data exposure to third-party sites and expands the external-request surface beyond the user's explicit intent.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The evals use broad prompts like general movie recommendations and download requests without tight trigger constraints, which can cause the skill to activate on ambiguous user input and overreach into unsolicited torrent or magnet-link retrieval. In this skill context, that is more dangerous because the declared functionality already centers on locating downloadable pirated media, so broad matching increases the chance of inappropriate or policy-violating execution.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The empty matcher causes this SessionStart hook to run for every session, regardless of user intent or whether the skill is actually needed. That broad automatic execution increases the attack surface by invoking local code on startup and can lead to unnecessary command execution, privacy leakage, or abuse if the referenced script is modified or behaves unexpectedly.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The function sends the user's movie query to several third-party torrent services in parallel, but the CLI does not warn the user that their search terms will be disclosed externally. In a torrent-search skill, queries can reveal sensitive interests or legally risky intent, so silent transmission creates a real privacy issue even if it is part of the tool's normal functionality.

Ssd 1

Medium

Confidence: 96% confidence
Finding: The law-enforcement hypothetical is an explicit example of trying to justify or bypass another model's safety restrictions for piracy-related assistance. Including this rhetoric normalizes evasion of safety controls and signals adversarial intent, which is especially concerning in a skill dedicated to locating downloadable movie torrents and magnet links.

Static analysis

No suspicious patterns detected.