media-cluster

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:42 AM UTC
• Version: 1.0.1

Overview

The skill matches its stated crawler-and-summary purpose, but it automatically downloads and runs unpinned third-party code and dependencies before crawling authenticated social platforms.

Review before installing. Use this only in an isolated environment or container, and prefer pinning MediaCrawler to a reviewed commit plus locked dependency versions before running setup. Be aware that QR login may create platform session state, crawler output may include personal or copyrighted social-media content, and enabling voice sends the generated summary text to SenseAudio. Provide the SenseAudio key through an environment variable rather than --api-key, and disable or avoid TTS for sensitive crawls.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/ensure_mediacrawler.sh:9
• Finding: Mutable Remote Repository Is Retrieved Without Version or Integrity Verification## Vulnerability Details **File Location**: `scripts/ensure_mediacrawler.sh`, lines 9-17 **Vulnerability Type**: Remote mutable code retrieval and supply-chain risk **Risk Level**: High ### Vulnerable Code ```bash REPO_URL="https://github.com/NanmiCoder/MediaCrawler.git" git clone "$REPO_URL" "$MEDIACRAWLER_DIR" ``` ### Technical Analysis The script clones the default branch of an external GitHub repository without pinning it to a reviewed commit or release tag. It also performs no commit-signature, checksum, or content-integrity verification. Consequently, the effective contents installed by the Skill can change after the Skill itself has been audited. The retrieved repository is subsequently treated as trusted application code by the documented workflow and environment setup process. Retrieval over HTTPS protects the transport channel but does not protect against compromise of the upstream repository, maintainer account, or mutable default branch. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of changing its default branch. 2. The attacker modifies MediaCrawler code or its dependency manifest. 3. A user invokes the Skill on a system where the `MediaCrawler` directory does not yet exist. 4. `ensure_mediacrawler.sh` clones the attacker-controlled default branch. 5. The setup workflow installs its dependencies, and the documented crawl workflow later executes its `main.py`. 6. Attacker-controlled code runs with the privileges of the user operating the Skill. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user's account. The resulting scope could include access to files readable by that user, crawler data, cached platform login state, environment variables, API credentials, and network resources available to the process. The script does not request administrative privileges or inde ...[truncated 145 chars]
• Remediation: ## Remediation Suggestions - Pin MediaCrawler to a specific, reviewed commit hash rather than cloning a mutable default branch. - Fetch only the pinned commit and verify that the checked-out commit exactly matches the expected identifier. - Where available, verify a trusted signed commit or signed release tag. - Maintain a locally reviewed allowlist of acceptable upstream versions. - Require explicit user confirmation before first-time remote retrieval and installation. - Re-audit the pinned upstream version before updating it. - Avoid automatically trusting an existing directory solely because it has the expected path; verify its repository origin and checked-out commit.

T08 · Insecure Dependencies

Error

• Location: scripts/setup_env.sh:28
• Finding: Unpinned Dependencies and Browser Artifacts Are Installed Automatically## Vulnerability Details **File Location**: `scripts/setup_env.sh`, lines 28-32 **Vulnerability Type**: Unverified third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash cd "$MEDIACRAWLER_DIR" pip install -r requirements.txt pip install requests playwright install ``` ### Technical Analysis The setup script installs dependencies from a remotely retrieved `requirements.txt`, installs `requests` without a fixed version or hash, and downloads Playwright browser artifacts without explicit artifact verification in the Skill. Python package installation may execute package build hooks or installation-time code. Because the MediaCrawler repository and its dependency manifest are not pinned by the Skill, a compromised upstream manifest can introduce arbitrary packages or unsafe versions. Installing `requests` without a version constraint also makes the result dependent on mutable package-index state. This behavior is necessary to provision the crawler environment, but it exceeds a secure minimum because dependency versions and integrity are not constrained. ### Attack Path 1. An attacker compromises the upstream MediaCrawler dependency manifest, a referenced package, a package-maintainer account, or the relevant package-distribution channel. 2. The attacker publishes or references a dependency containing malicious installation or runtime code. 3. The user runs `setup_env.sh`. 4. `pip install` downloads the malicious or compromised package. 5. Package build or installation hooks execute with the invoking user's privileges, or malicious code executes when the crawler later imports the package. 6. The attacker gains access to resources available to the environment and user account. ### Impact Assessment Exploitation could result in arbitrary code execution under the current user's privileges. Accessible resources may include project files, crawler output, platform session data, environme ...[truncated 284 chars]
• Remediation: ## Remediation Suggestions - Use a reviewed lock file containing exact dependency versions and cryptographic hashes. - Install Python dependencies with hash enforcement, such as `pip install --require-hashes`. - Pin `requests` to a reviewed version and include its transitive dependencies in the lock file. - Pin the MediaCrawler repository before trusting its `requirements.txt`. - Pin the Playwright package and browser revision, and verify downloaded artifacts where supported. - Separate dependency retrieval from installation and require user confirmation before executing installation hooks. - Run installation and crawling in a restricted container or sandbox with minimal filesystem, credential, and network access. - Add automated dependency scanning and controlled update procedures.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/summarize_and_voice.py:247
• Finding: SenseAudio API Key Can Be Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/summarize_and_voice.py`, lines 247-248 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument("--api-key", type=str, default=os.environ.get("SENSEAUDIO_API_KEY", ""), help="SenseAudio API key (default: from SENSEAUDIO_API_KEY env var)") ``` ### Technical Analysis The script permits the SenseAudio API key to be supplied directly through the `--api-key` command-line option. Command-line arguments may be retained in shell history, process-monitoring records, terminal transcripts, automation logs, crash diagnostics, or operating-system process listings. The environment-variable default is safer than a command-line argument but does not eliminate the unsafe CLI path. The key is not hardcoded or deliberately logged by the script, and the later network request uses it as the expected Bearer credential for the documented TTS provider. ### Attack Path 1. A user invokes the script with a command such as `--api-key SECRET`. 2. The shell records the command in its history, or process-monitoring and automation systems capture the argument list. 3. Another local user, administrator, log reader, or compromised monitoring component accesses that record. 4. The party extracts the API key. 5. The exposed key is used to make unauthorized SenseAudio API requests until it is revoked or expires. ### Impact Assessment Exposure could allow unauthorized use of the associated SenseAudio account, potentially causing quota consumption, financial charges, service disruption, or access to account-level capabilities granted to the key. This issue does not directly disclose crawler login credentials or grant operating-system privilege escalation. Its scope is principally limited to the permissions and quota associated with the exposed API key.
• Remediation: ## Remediation Suggestions - Remove the `--api-key` command-line option. - Obtain the key from a protected environment variable, operating-system keychain, secret manager, or permission-restricted configuration file. - For interactive use, support hidden input through a secure prompt that does not echo or enter shell history. - Ensure application, process, and automation logs redact authorization credentials. - Document secure secret provisioning and key-rotation procedures. - Advise users who previously supplied the key on the command line to clear affected histories and logs and rotate the credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger description is broad enough to match common user requests about searching or summarizing Chinese social-platform content, which increases the chance of unintended activation. Because the skill then performs cloning, environment setup, crawling, and optional external API use automatically, an accidental invocation could launch high-impact actions without a deliberate user opt-in.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The instruction that the agent should 'automatically complete the full workflow' after a single natural-language request is ambiguous about boundaries and safety checks. In practice, this can cause the agent to perform code download, package installation, browser automation, authenticated crawling, and data processing when the user may have intended only a discussion or lightweight lookup.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill sends generated voice-summary text to the external SenseAudio API but does not clearly warn the user that crawled content or its summary may leave the local environment. This creates a data-handling and privacy risk, especially if the crawled material contains personal data, sensitive topics, or copyrighted content from social platforms.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs network and system-modifying actions automatically: it may clone a repository from GitHub, create a new conda environment, install Python packages, and download Playwright browsers. Even though these actions are common for setup scripts, doing them without an explicit warning, confirmation, or pinning/trust controls increases supply-chain and user-consent risk because remote content is fetched and executed in the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

"Content-Type": "application/json",
    }
    try:
        r = requests.post(SENSEAUDIO_TTS_URL, json=payload, headers=headers, timeout=60)
        r.raise_for_status()
        out = r.json()
    except requests.RequestException as e:

• Confidence: 88% confidence
• Finding: When --voice is enabled, the script sends the generated voice script text to a third-party SenseAudio service, which constitutes external transmission of potentially sensitive crawled-content summaries. In this skill context, the tool processes media-crawler output and user-supplied keywords, so summaries may contain private, regulated, or proprietary information that is exfiltrated off-host without any content classification, redaction, or explicit consent gate beyond the CLI flag.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

p = str(path.resolve())
    if sys.platform == "darwin":
        try:
            subprocess.run(["afplay", p], check=True)
            return True
        except (subprocess.CalledProcessError, FileNotFoundError):
            pass

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        for cmd in (["paplay", p], ["aplay", p], ["ffplay", "-nodisp", "-autoexit", p]):
            try:
                subprocess.run(cmd, check=True, capture_output=True)
                return True
            except (FileNotFoundError, subprocess.CalledProcessError):
                continue

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script's natural-language comments and some echoed status text are written in Chinese, with no indication that another language is available or that Chinese is a documented requirement. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Static analysis

No suspicious patterns detected.