Apple TV

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:33 AM UTC
• Version: 1.0.0

Overview

This Apple TV skill appears purpose-aligned, but it needs review because broad triggers and under-disclosed credential handling could cause unintended device control or expose pairing credentials locally.

Install only if you are comfortable giving the skill control over a paired Apple TV. Before use, narrow or remove broad triggers like "TV", consider requiring confirmation for power and app-launch commands, pin the pyatv version, and protect or rotate Apple TV pairing credentials if local process command lines may be logged or monitored.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned dependency and unsafe supply-chain resolution
Risk Level: Medium

Vulnerable Code

bash

pipx install pyatv --python python3.11

Technical Analysis

The documented installation command installs the latest version of pyatv and its transitive dependencies available from the configured package index. It does not specify an audited version, use a lock file, or validate package integrity with cryptographic hashes.

Consequently, the code installed by users can change after this Skill has been reviewed. A compromised package release or transitive dependency could introduce arbitrary build-time or runtime behavior. An incompatible future release could also alter command semantics or security behavior.

This finding does not establish that the current pyatv package is malicious. The weakness is that the installation procedure does not constrain users to a known, reviewed dependency set.

Attack Path

1. An attacker compromises the publishing account, distribution channel, or a transitive dependency used by pyatv.
2. The attacker publishes a modified release containing malicious installation or runtime code.
3. A user follows the Skill documentation and runs the unpinned pipx install pyatv command.
4. The package resolver downloads the compromised release because no exact version or integrity hash is required.
5. Package-controlled code executes during installation or when the Apple TV utility is subsequently invoked.

Impact Assessment

Exploitation could execute code with the privileges of the user running pipx. This may expose files accessible to that account, including the Apple TV configuration and pairing credentials, and may permit modification of user-owned data or installation of user-level persistence. It does not inherently grant administrative privileges unless installation is performed by a ...[truncated 72 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pyatv to an exact version that has been reviewed and tested, for example:

  bash

  pipx install 'pyatv==REVIEWED_VERSION' --python python3.11
  

• Maintain a lock file containing exact versions of all transitive dependencies.

• Where the installation workflow supports it, require cryptographic hashes for downloaded distributions.

• Document the expected package index and prevent fallback to untrusted or unexpected package sources.

• Establish a dependency-update process that includes vulnerability scanning, changelog review, and functional testing before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/appletv.py:68

Finding

Apple TV Pairing Credentials Exposed in Child Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/appletv.py, lines 68-74
Vulnerability Type: Sensitive credentials passed through command-line arguments
Risk Level: Medium

Vulnerable Code

python

cmd = [str(ATVREMOTE), "--id", config["id"]]

creds = config.get("credentials", {})
if creds.get("companion"):
    cmd.extend(["--companion-credentials", creds["companion"]])
if creds.get("airplay"):
    cmd.extend(["--airplay-credentials", creds["airplay"]])

The resulting command is executed at lines 78-79:

python

import subprocess
result = subprocess.run(cmd, capture_output=True, text=True)

Technical Analysis

The script reads Companion and AirPlay pairing credentials from configuration and places them directly in the argument vector of the atvremote child process. Although the script correctly uses an argument list rather than a shell command and therefore does not introduce shell injection at this location, command-line arguments are not an appropriate secret-transport mechanism.

Depending on operating-system process visibility, local access controls, diagnostic tooling, audit configuration, crash reporting, and endpoint telemetry, another local principal or monitoring service may be able to inspect or retain the child process command line. The credentials may remain in logs or telemetry after the process exits.

Exploitability depends on local process-inspection permissions and system configuration. The source nevertheless unnecessarily places long-lived device credentials in an observable process metadata channel.

Attack Path

1. A user configures valid Companion or AirPlay credentials in appletv.json.
2. The user invokes a command such as status, play, or app.
3. run_atvremote appends the plaintext credentials to the child process argument vector.
4. A local observer, process-monitoring service, audit collector, or diagnostic tool captures the `atvremote ...[truncated 931 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer using the pyatv Python API directly so credentials remain in process memory and are not copied into a child process argument vector.
• If supported by atvremote, provide credentials through a protected configuration file, operating-system credential store, inherited file descriptor, or other mechanism that does not expose them in argv.
• Create credential files with restrictive permissions such as 0600, verify ownership before reading them, and reject files writable by unrelated users.
• Avoid printing, logging, or including credentials in exceptions and diagnostic output.
• Document the local process-argument exposure if the underlying CLI offers no secure credential-input mechanism.
• Advise users to rotate or re-pair credentials if process-command telemetry may already have captured them.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands such as scripts/appletv.py and atvremote but does not declare any tool scope or allowed-tools boundary. That creates an authorization gap where an agent may execute shell-capable actions without explicit least-privilege constraints, increasing the chance of unintended command execution or abuse if the skill is triggered unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase TV is extremely broad and likely to match ordinary conversation unrelated to this skill. Because the skill performs real-world control actions such as power, playback, and app launching via shell-backed commands, accidental invocation could cause unintended device actions and expand opportunities for prompt/command routing mistakes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/appletv.py (reported line 91)May include surrounding context.

python

cmd.extend(args)
    
    import subprocess
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout, result.stderr, result.returncode

def cmd_status():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/appletv.py (reported line 202)May include surrounding context.

python

"""Scan for Apple TVs."""
    import subprocess
    print("🔍 Scanning for Apple TVs...\n")
    result = subprocess.run([str(ATVREMOTE), "scan"], capture_output=False)
    return result.returncode

def main():

Static analysis

No suspicious patterns detected.