Security audit

Download File

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent downloader, but it gives agents unsafe shell-command templates for user-supplied URLs and file paths without enough validation or containment.

Review before installing. Use it only with URLs and destination paths you trust, avoid attacker-supplied filenames or paths, do not overwrite existing files, and prefer a safer implementation that validates URLs and writes only inside a dedicated downloads directory.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:40
Finding: Shell Command Injection Through Unquoted URL and Destination Parameters
Content: View full analysis
", background=true, timeout=600 ) ``` Other affected command patterns include: ```bash curl -L -C - --progress-bar -o file.zip curl -L --retry 3 --connect-timeout 30 -o file.zip aria2c -x 16 -s 16 -k 1M --continue -o ~/Downloads/file.zip curl -I curl -v -o /dev/null wget --continue ``` ### Technical Analysis The skill directs the agent to interpolate user-controlled URL and destination values directly into shell command strings. Neither value is quoted, escaped, validated, nor passed through a shell-free argument API. Shell metacharacters such as `;`, `&&`, `|`, command substitutions, redirections, and newlines can consequently alter the intended command. URL syntax alone does not make a value safe for shell interpolation. The destination parameter presents the same problem and can also be abused to inject options or additional commands. Because these commands execute through the agent's `exec` facility, successful exploitation runs injected commands with all operating-system privileges available to the agent process. ### Attack Path 1. An attacker asks the agent to download a file and supplies a maliciously formed URL or destination. 2. For example, the URL contains a shell command separator followed by an attacker-selected command. 3. The agent substitutes the value into the documented `command="curl ... "` template. 4. The execution tool passes the resulting string to a shell. 5. The shell executes the legitimate downloader command and then the injected command. 6. The injected process can access files, credentials, network r ...[truncated 541 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:40
Finding: Unrestricted URL Handling Permits Internal-Network and Local-Resource Access
Content: View full analysis
", background=true, timeout=600 ) ``` The troubleshooting instructions expose the same unrestricted behavior: ```bash curl -I ``` ```bash curl -v -o /dev/null ``` ```bash wget --continue ``` ### Technical Analysis Although the skill describes itself as an HTTP/HTTPS downloader, the command templates do not enforce that restriction. There is no validation of URL schemes, hostnames, resolved IP addresses, ports, embedded credentials, or redirect targets. `curl` supports protocols beyond HTTP and HTTPS depending on its build. In addition, `curl -L` follows redirects without requiring the agent to validate each new destination. A seemingly public URL can therefore redirect to loopback, private, link-local, or cloud metadata addresses. This exposes network and local resources reachable from the agent environment but not necessarily reachable by the requesting attacker. ### Attack Path 1. An attacker provides a URL targeting an internal service, loopback interface, link-local metadata endpoint, or an attacker-controlled public endpoint. 2. If a public URL is used, the endpoint returns a redirect to the protected address. 3. The agent executes `curl -L` or one of the troubleshooting commands without validating the destination. 4. The downloader connects from the agent's trusted network context. 5. Response content is saved to a file, while verbose or header-oriented diagnostics may reveal service behavior. 6. The attacker can use the result to retrieve protected content or probe internal services. ### Impact Assessment Exploitation can expose services and resources available only from the agent ...[truncated 438 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:40
Finding: Unrestricted Output Paths and Resume Mode Can Corrupt Existing Files
Content: View full analysis
", background=true, timeout=600 ) ``` The document contains only a non-enforced warning: ```text Don't overwrite important files - Check if destination exists ``` ### Technical Analysis The standard process accepts a destination path without restricting it to a dedicated download directory. It does not require canonicalization, an existing-file check, a symbolic-link check, exclusive file creation, or explicit overwrite confirmation. The `-C -` option tells `curl` to infer the resume offset from the current output file. If the destination already exists, server-controlled data may be written relative to its current size. This can corrupt an unrelated file rather than safely producing a new download. A check performed separately from file creation would also be susceptible to time-of-check/time-of-use races unless the destination is opened atomically. Symbolic links further allow an apparently harmless path to resolve to another writable file. ### Attack Path 1. An attacker selects an existing writable file, or a path containing a symbolic link, as the requested destination. 2. The agent follows the standard process without enforcing the warning to check for an existing file. 3. `curl` opens the resolved destination and uses its current length as the resume position. 4. Downloaded bytes overwrite, append to, or otherwise corrupt the targeted file. 5. If the targeted file influences later execution or configuration, corruption may cause denial of service or enable additional compromise. ### Impact Assessment The direct impact is modification or destruction of files writable by the agent account. Potentially affected ...[truncated 348 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The skill repeatedly instructs the agent to interpolate untrusted placeholders such as , <destination_path>, and <file_path> directly into shell commands using curl, ls, file, md5sum, and related utilities. If an attacker can influence those values, this creates a command-injection and tool-parameter-abuse path that could lead to arbitrary command execution, file overwrite, or unsafe network access; the downloader context makes this more dangerous because handling attacker-controlled URLs and filenames is the skill's core purpose.
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
1. Download interrupted

bash
# Re-run same command, curl -C - will resume automatically curl -L -C - --progress-bar -o file.zip <URL>

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains broad, everyday phrases like 'download this file' and 'get this file', which can cause the skill to activate in situations where the user did not intend to invoke this specific capability. Because the skill executes shell-based download commands against user-supplied URLs and paths, accidental invocation increases the chance of unintended network access or risky file handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger list explicitly includes a Chinese-language activation phrase, but the file does not explain whether multilingual triggering is intended, optional, or limited to specific locales. This can be a language-policy concern because the skill embeds a locale-specific trigger without clarifying user opt-in or broader language handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.