WebTorrent — Streaming Torrent Client

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.0.0

Overview

This skill is coherent documentation for using WebTorrent, but users should treat torrent networking, seeding, and dependency installation as explicit opt-in actions.

Use this skill only when torrent/P2P behavior is intentional. Pin and review npm dependencies, avoid global installs and unversioned CDN imports where possible, set explicit download paths and file-selection rules, apply upload/download limits, and require clear user consent before seeding because it shares selected content and may expose network identifiers to peers or trackers.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24, SKILL.md:29, SKILL.md:178, and SKILL.md:273
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

The Skill recommends installing or importing third-party npm packages without specifying reviewed versions.

bash

npm install webtorrent

bash

npm install webtorrent-cli -g

bash

npm install webtorrent-hybrid

js

import MemoryChunkStore from 'memory-chunk-store'

Technical Analysis

The installation commands do not pin exact package versions or require a reviewed lockfile. Consequently, the code installed when the instructions are followed may differ from the code available when the Skill was audited. npm installation can also execute package lifecycle scripts, giving a compromised package an immediate code-execution path.

The global installation of webtorrent-cli increases exposure because it installs package-provided executables into the user's environment. The memory-chunk-store example likewise identifies an unpinned dependency, although its installation command is not shown.

No evidence was found that the named packages are currently malicious. The vulnerability is the absence of controls that would prevent a compromised or unexpectedly changed upstream release from being installed.

Attack Path

1. An attacker compromises an upstream package publisher, npm account, package release, or transitive dependency.
2. The attacker publishes a malicious version that satisfies npm's default resolution behavior.
3. A user or Agent follows the Skill instructions without an existing reviewed lockfile.
4. npm resolves and downloads the attacker-controlled release.
5. Malicious package code or lifecycle scripts execute during installation or when the dependency is imported.
6. For the global CLI installation, attacker-controlled executables may also become available through the ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each dependency to an exact, reviewed version rather than relying on the latest compatible release.
• Provide and verify a committed lockfile, and recommend npm ci instead of unconstrained installation.
• Review direct and transitive dependencies with npm provenance information, integrity hashes, and a software composition analysis tool.
• Avoid global package installation where possible. Prefer a project-local dependency invoked through a pinned package script.
• Run installation in a least-privileged, isolated environment without unnecessary secrets.
• Consider disabling lifecycle scripts during initial inspection with npm ci --ignore-scripts, then explicitly permit only reviewed build steps.
• Document the exact required version of memory-chunk-store and every optional related package.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:68

Finding

Mutable Third-Party CDN Module Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:68-70
Vulnerability Type: Remote payload retrieval from an unversioned CDN URL
Risk Level: Medium

The browser example imports executable JavaScript directly from an unversioned third-party CDN endpoint:

html

<script type="module">
  import WebTorrent from 'https://esm.sh/webtorrent'
  // Or local: import WebTorrent from 'webtorrent.min.js'

Technical Analysis

The URL does not identify an exact reviewed package version and does not provide an integrity constraint. Its effective response can therefore change after the Skill has been reviewed. A browser following this example retrieves JavaScript from esm.sh and executes it as an ES module in the importing page's JavaScript context.

This creates a remote code-execution channel controlled by the selected CDN response and its upstream package resolution. HTTPS protects the connection in transit but does not prevent a compromised CDN, upstream package publication, or mutable package resolution from returning altered code.

No evidence was found that the current CDN response is malicious. The risk arises from trusting mutable remote executable content without version or integrity controls.

Attack Path

1. An attacker compromises the CDN, its build pipeline, an upstream package publication, or another component used to resolve the unversioned module.
2. The unversioned URL begins serving attacker-controlled JavaScript.
3. A developer copies the documented browser example into an application.
4. A visitor loads the affected page, causing the browser to fetch the remote module.
5. The attacker-controlled module executes in the page's JavaScript context.
6. The payload can interact with data and capabilities available to scripts in that application context and can initiate network requests allowed by browser security controls.

Impact Assessment

Successful exploitation can execute arbitrary ...[truncated 426 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned CDN URL with a locally hosted bundle built from an exact, reviewed dependency version.
• If remote hosting is necessary, use an immutable, explicitly versioned resource rather than a package-name-only URL.
• Apply integrity verification where the selected module-loading mechanism and hosting arrangement support it.
• Enforce a restrictive Content Security Policy that allows scripts only from required, reviewed sources.
• Vendor and review the browser bundle as part of the application's release process.
• Monitor dependency and CDN security advisories and require review before updating the pinned asset.
• Make the local, reviewed bundle the primary recommendation rather than presenting the mutable CDN import as the default example.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages torrent downloading and seeding but omits basic warnings about privacy exposure, bandwidth consumption, and the risk of accidentally sharing local files. In this context, that omission is meaningful because WebTorrent directly enables peer-to-peer distribution and browser/Node seeding, so users may unknowingly expose IP addresses, consume network capacity, or publish sensitive data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger words include broad terms like 'torrent', 'streaming download', and 'file sharing', which can cause the agent to invoke this skill for loosely related or high-risk requests outside a narrowly scoped WebTorrent context. In a P2P/torrent skill, overbroad activation increases the chance of unintended assistance with downloading, seeding, or exposing local files and network resources.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation states that trackers, DHT, web seeds, LSD, and μTP are enabled and describes adding torrents, but it does not clearly warn that merely adding a torrent may initiate connections to external systems and disclose the user's IP address and interest in specific content. In this skill context, that omission is more dangerous because an agent or developer may treat 'add' as a passive local action when it can trigger immediate network activity and privacy-sensitive peer discovery.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The API reference documents seeding and upload behavior, including automatic peer-to-peer distribution, but does not prominently warn that using these APIs causes outbound data transfer and can expose the user's IP address and shared content to peers and trackers. In an agent skill context, omission of these warnings can lead developers to integrate seeding features without informed consent, creating privacy, bandwidth, and legal exposure for end users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.