Security audit

Nas Movie Download

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims for NAS movie downloads, but it ships real-looking credentials and includes unsafe privileged and destructive operations.

Only install after removing and rotating all bundled credentials, replacing config/smb.env with a redacted template, requiring user-provided secrets, using HTTPS or a trusted isolated network for Jackett and qBittorrent, disabling sudo mount workflows, and making torrent/file deletion exact, confirmed, and reversible where possible.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/smb-auto-subtitle.py:19
Finding: Hard-Coded SMB, qBittorrent, Jackett, and OpenSubtitles Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/qbittorrent-add.sh:9
Finding: Credentials and API Keys Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/archive-movie.py:101
Finding: Predictable Temporary File Enables Symlink Clobbering and Media Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/archive-movie.py:161
Finding: Broad Torrent Name Matching Can Delete Unrelated Torrent Payloads
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/download-subtitle-smb.sh:32
Finding: Subtitle Workflow Uses Sudo CIFS Mount and Exposes the SMB Password in Process Arguments
Content: View full analysis
/dev/null; } ``` Mounting and unmounting filesystems crosses a system-wide privilege boundary and is not necessary where the project already uses `pysmb` for user-space SMB access. Depending on operating-system process visibility, the password may be exposed in process listings, monitoring tools, audit logs, shell tracing, or diagnostic output. A mount point also changes global filesystem state. If mount-point selection or surrounding variables are not tightly controlled by the caller, a privileged mount may obscure existing content or expose the remote share at an unintended location. ### Attack Path 1. A user invokes the subtitle workflow and authorizes its `sudo` operations. 2. The SMB password is included in the `mount` process argument vector. 3. A local observer or monitoring system captures the argument while the command is running. 4. The observer reuses the credential against the NAS. 5. Separately, misuse or manipulation of the mount location can cause a privileged filesystem mount at an unintended path. ### Impact Assessment The principal impact is disclosure of an SMB credential and unnecessary use of root-level mount capability. A compromised SMB credential may permit access to the configured media share. The privileged mount operation also increases the potential effect of path- ...[truncated 60 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (211)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.