Security audit

mediaproc

Security checks across malware telemetry and agentic risk

Overview

This is a coherent media-processing skill, but it asks users to trust an unpinned root installer and exposes a broad SSH command interface with limited local guardrails.

Install only if you trust the docker-mediaproc project and the specific host you configure. Do not pipe the GitHub installer directly into `sudo bash`; download and inspect a pinned version first and verify integrity where possible. Use a dedicated SSH key, avoid exposing the mediaproc port broadly, keep important media backed up, and treat recursive removal and uninstall as destructive operations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill’s declared purpose is media processing, but the interface exposed in the documentation is effectively a generic remote-command channel over SSH: `scripts/mediaproc.sh <command> [args]`. Even if the backend is intended to be locked down, the skill documentation itself does not constrain allowed commands in code or interface, so an agent could be induced to invoke unintended remote operations or interact with an external host beyond the narrow media-processing purpose.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The documentation says there is 'no shell access' and 'no injection', but the examples clearly show user-controlled command strings being passed to a remote execution interface. That discrepancy can mislead reviewers and downstream agents into over-trusting the environment, increasing the chance that dangerous commands or unsafe assumptions are accepted without scrutiny.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The wrapper forwards all user-supplied arguments as a remote SSH command, so it exposes general-purpose command execution on the mediaproc host instead of enforcing only approved media-processing operations. In the context of a skill advertised as a locked-down media tool, this mismatch is dangerous because any weakness or over-privilege on the remote account/container can be reached through an unrestricted command interface.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Using ssh with "$*" creates a generic remote execution primitive: the remote side receives a single command string derived from all local arguments, enabling invocation of any command the remote account is permitted to run. That is unjustified for a media-processing skill and increases the chance of abuse for lateral movement, data access, or escaping intended operational boundaries if the remote environment is not perfectly constrained.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill advertises destructive operations such as `remove-file`, `remove-dir`, and `remove-dir-recursive` without warnings, confirmation guidance, or guardrails. In an agent setting, this raises the risk of accidental or prompt-induced data loss, especially because the same interface combines upload, processing, and deletion against a remote workspace.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The install command instructs users to fetch a remote script over the network and immediately execute it with sudo, giving the script full root privileges without prior inspection, pinning, or integrity verification. If the GitHub account, repository, branch, or delivery path is compromised, users could execute arbitrary privileged code on their machine.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation tells users to append an SSH public key into a persistent authorized_keys file without warning about the trust boundary, persistence, or access implications. While adding a public key is normal for SSH, doing so for a local service that exposes a port can unintentionally create long-lived access to the media-processing container and may broaden attack surface if users misunderstand what is being authorized.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Presenting an uninstall command that 'stop[s] and remove[s] everything' without a warning increases the risk of accidental destructive action and irreversible data loss in the mediaproc directory or related configuration. This is primarily a safety and operational risk rather than a code-execution issue, but it can still harm users if invoked casually.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.