other
Warning
- Location
scripts/stremio_cast.py:10- Finding
Hard-Coded Undisclosed External Streaming Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Stremio Casting
Security checks for vulnerabilities and agentic risk
Overview
The skill is for casting Stremio to Chromecast, but it under-discloses a hard-coded external streaming endpoint and weakens browser security controls.
Review this skill before installing. Only use it in a contained environment, replace the hard-coded streamingServer with a user-approved local endpoint, remove the Chromium security-disabling flags, and avoid logging full stream URLs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/stremio_cast.py:15- Finding
Chromium Sandbox and TLS Certificate Validation Disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stremio_cast.py:21- Finding
Complete Stream URLs Written to Process Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (7)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: stremio-cast description: Busca conteúdo no Stremio Web e transmite para dispositivos Chromecast usando CATT e Playwright. Use para reproduzir filmes e séries diretamente do Stremio em TVs. --- # Stremio Cast Esta skill permite que o Manus automatize a interface web do Stremio para encontrar links de streaming locais e transmiti-los para um dispositivo Chromecast. ## Pré-requisitos Para que esta skill funcione corretamente, o ambiente deve ter: 1. **Stremio Service** rodando localmente na porta `11470`. 2. **Playwright** instalado para automação do navegador. 3. **CATT (Cast All The Things)** inst
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises behavior that requires shell execution via Python and CATT, but the manifest does not declare any tool scope or allowed-tools boundary. This is dangerous because an agent may invoke shell capabilities implicitly, expanding execution privileges without explicit review or least-privilege controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language description, usage instructions, and trigger phrases are all written in Portuguese, including the explicit invocation examples in L28. There is no indication that the skill is intentionally region-specific or that users may interact in another language, which creates a language/locale policy concern under the stated rule.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script passively intercepts browser requests and prints discovered stream URLs, which may expose sensitive playback endpoints, tokens, or session-bound media URLs in logs. Because these URLs are captured from network traffic rather than obtained through an explicit user-facing workflow, the skill collects and discloses data the user may not expect.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"[Moltbot] Transmitindo para {device}...") try: # Nota: Assume que 'catt' está instalado no ambiente subprocess.Popen(['catt', '-d', device, 'cast', stream_url]) print(f"Sucesso: Reproduzindo '{query}' em {device}.") # Mantemos o script rodando por um tempo para garantir que o stream inicie # No ambiente real, o processo pai deve gerenciar o ciclo de vida do navegador
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes searching Stremio Web and transmitting to Chromecast, but the implementation achieves casting by spawning a local command-line tool via
subprocess.Popen. Launching arbitrary local executables is a stronger capability than the stated user-facing purpose and is not explicitly disclosed in the manifest text.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script's printed status, error, and usage messages are written in Portuguese only. That imposes a specific language on all users without opt-in or justification, which matches the locale-policy concern described in this rule.
- Content
Static analysis
No suspicious patterns detected.