Security audit

Social Downloader

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says broadly, but its transcription mode can automatically use an OpenAI API key and upload extracted audio without a clear separate consent step.

Review before installing. Use it only for videos you are allowed to download, and assume transcribe mode may upload the video's audio to OpenAI if OPENAI_API_KEY is set. For local-only use, run without that environment variable or modify the skill so cloud transcription requires an explicit flag and confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell scripts and Python that perform network access and file operations, but it declares no permissions or capability boundaries. This creates a governance gap: an agent or reviewer cannot easily assess or constrain what the skill may do, increasing the chance of unintended downloads, local file writes, or misuse of ambient environment access.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill description centers on downloading social videos, but the script silently expands scope by extracting audio, calling a transcription service, and writing a transcript. This capability mismatch is dangerous because operators may approve or invoke the skill expecting local download behavior while it performs additional processing and external data handling.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script reads OPENAI_API_KEY from the environment and transmits derived user content to an external AI service without that capability being justified by the downloader-focused skill description. In agent environments, undeclared credential use and outbound data transfer materially increase risk because users and platform operators may not expect either behavior.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The description is broad enough to trigger on common requests like downloading, saving, sending, or transcribing social videos, which can cause the agent to invoke a network-capable downloader in situations where user intent is ambiguous. Because the skill can fetch arbitrary remote content and write files, over-broad triggering increases the risk of unnecessary external requests, policy bypass around copyrighted/private content, or unsafe automation.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger guidance 'Use this for social video links' is underspecified and does not define supported domains, trust boundaries, or when user confirmation is required. In context, that vagueness is more dangerous because the skill launches shell/Python download workflows against user-supplied URLs, making accidental invocation and unsafe handling of edge cases more likely.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Audio extracted from downloaded media is sent to an external API with no in-code notice, prompt, or consent gate. This is risky because the media may contain sensitive speech or copyrighted/private content, and users may believe the tool only performs local downloading.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: Reading an API credential from the environment without any disclosure is not inherently malicious, but it is a transparency and trust problem in a skill advertised as a downloader. In agent settings, silent use of ambient credentials can surprise operators and mask external-service dependencies.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.