Apple Media

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:50 AM UTC
• Version: 0.1.1

Overview

This skill is a straightforward Apple media discovery and control wrapper, with expected local-network scanning and third-party tool installation risks that users should understand.

Before installing, confirm you trust the pyatv and Airfoil dependencies, consider pinning pyatv to a reviewed version, and run scans only on local networks and Apple/AirPlay devices you are authorized to discover or control. Avoid committing scan output because it can include device names and IP addresses.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-22 and README.md:28-30
Vulnerability Type: Unpinned and mutable third-party dependency
Risk Level: Medium

Complete Code Snippet:

bash

pipx install pyatv || pipx upgrade pyatv
pipx reinstall pyatv --python python3.12

Technical Analysis

The installation instructions resolve pyatv and its transitive dependencies without an exact package version or integrity verification. The pipx upgrade pyatv command explicitly replaces the installed package with the latest available release. Consequently, the code installed by users can differ from the code that existed when this Skill was reviewed.

The project scripts subsequently invoke the package-provided atvremote executable. Python packages can execute package-controlled code during installation and whenever their installed entry points are run. If the package publisher, publishing credentials, package repository, or a transitive dependency were compromised, following these instructions could introduce attacker-controlled code.

This is a supply-chain exposure rather than evidence that the current pyatv package is malicious.

Attack Path

1. An attacker compromises the publishing account or release pipeline for pyatv or one of its transitive dependencies.
2. The attacker publishes a malicious version that satisfies the unrestricted installation request.
3. A user follows the documented setup instructions and runs pipx install pyatv, pipx upgrade pyatv, or pipx reinstall pyatv.
4. pipx downloads and installs the mutable package release without checking it against a project-maintained version lock or expected artifact hash.
5. Malicious package code executes during installation or when the Skill invokes atvremote.
6. The payload operates with the privileges of the user who performed the installation or invoked the command.

Impact Assessment

Successful exploitation coul ...[truncated 420 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unrestricted dependency commands with installation of an explicitly audited version, for example:

   bash

   pipx install "pyatv==<audited-version>"
   

2. Remove or discourage unconditional pipx upgrade pyatv; require review and testing before changing the pinned version.
3. Maintain a lock file or equivalent reproducible dependency record covering transitive dependencies.
4. Verify downloaded artifacts against trusted hashes where the selected installation workflow supports hash verification.
5. Document the trusted package index and avoid accepting packages from untrusted or additional indexes.
6. Add an update process that reviews release provenance, dependency changes, and security advisories before advancing the pin.
7. Run the dependency and its atvremote entry point with the least-privileged user account required for device discovery and control.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to run network discovery commands against the local network without clearly warning that these actions actively probe for Apple/AirPlay devices. While the commands are consistent with the skill’s stated purpose, lack of disclosure can lead to unintended scanning of a user's environment, which may violate local policy or surprise users in managed networks.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/scan-json.js:10