T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/stremio_download.sh:24
- Finding
- Download command performs immediate side effects despite documented dry-run and interactive behavior<![CDATA[ ## Vulnerability Details **File Location**: `README.md:11`, `README.md:80-82`, `SKILL.md:103`, `scripts/stremio_download.sh:24-26`, `scripts/stremio_download.sh:230-263` **Vulnerability Type**: Unsafe default behavior and misleading security documentation **Risk Level**: Medium ### Vulnerable Code The documentation claims that downloads are previewed or interactive: ```markdown - **Dry-run by default** — always preview before downloading ``` ```markdown scripts/stremio_download.sh # download all unwatched scripts/stremio_download.sh --dry-run # preview only ``` The Skill documentation similarly describes the default command as interactive: ```markdown scripts/stremio_download.sh # All unwatched (interactive) ``` The implementation instead disables dry-run by default: ```bash QUALITY="any" CLIENT="" DRY_RUN=false MAGNETS_ONLY=false ``` It subsequently queues downloads without any confirmation: ```bash if $DRY_RUN; then if [[ -n "$best_hash" ]]; then echo " [dry-run] Would download: magnet:?xt=urn:btih:${best_hash}" >&2 else echo " [dry-run] Would download: ${best_url}" >&2 fi ((downloaded++)) || true continue fi if $MAGNETS_ONLY; then if [[ -n "$best_hash" ]]; then echo "magnet:?xt=urn:btih:${best_hash}&dn=$(echo "$label" | sed 's/ /%20/g')" else echo "$best_url" fi ((downloaded++)) || true continue fi # Download if [[ -n "$best_hash" ]]; then if $use_stremio; then download_via_stremio "$best_hash" "${file_idx:-0}" && ((downloaded++)) || ((failed++)) elif [[ -n "$torrent_client" ]]; then magnet="magnet:?xt=urn:btih:${best_hash}&dn=$(echo "$label" | sed 's/ /%20/g')" download_via_client "$torrent_client" "$magnet" && ((downloaded++)) || ((failed++)) fi elif [[ -n "$best_url" ]]; then echo " Direct URL: ${best_url}" >&2 echo " (Direct URL downloads not yet supported, use --magnets)" >&2 ((failed++)) || true fi ``` ### Tech ...[truncated 1842 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Initialize `DRY_RUN=true` and require an explicit side-effect option such as `--download` or `--execute`. 2. For interactive terminals, display the number of episodes, selected client, destination directory, and torrent identifiers before asking for confirmation. 3. For non-interactive execution, require an explicit `--yes` flag rather than assuming consent. 4. Apply a conservative default limit to prevent accidental bulk downloads. 5. Update `README.md` and `SKILL.md` so their descriptions exactly match enforced behavior. 6. Add automated tests confirming that the no-argument invocation cannot call any downloader. 7. Consider requiring explicit addon or stream selection instead of automatically accepting the first matching stream. ]]>