Nas Movie Download

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:42 AM UTC
• Version: 3.2.2

Overview

This skill does what it claims for NAS movie downloads, but it ships real-looking credentials and includes unsafe privileged and destructive operations.

Only install after removing and rotating all bundled credentials, replacing config/smb.env with a redacted template, requiring user-provided secrets, using HTTPS or a trusted isolated network for Jackett and qBittorrent, disabling sudo mount workflows, and making torrent/file deletion exact, confirmed, and reversible where possible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/smb-auto-subtitle.py:19
• Finding: Hard-Coded SMB, qBittorrent, Jackett, and OpenSubtitles Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/smb-auto-subtitle.py:19-32` **Vulnerability Type**: Hard-coded credentials and API keys **Risk Level**: High ### Technical Analysis The package embeds operational SMB credentials and an OpenSubtitles API key directly in source code: ```python # SMB configuration SMB_CONFIG = { "username": "13917908083", "password": "Roger0808", "server_name": "Z4ProPlus-X6L8", "server_ip": "192.168.1.246", "share_name": "super8083", "remote_path": "qb/downloads" } # OpenSubtitles configuration OPENSUBTITLES_API_KEY = "CBfNpndpF56j2TsGJuaicd8AAwx0rS2R" OPENSUBTITLES_API = "https://api.opensubtitles.com/api/v1" ``` The same SMB password is replicated in `config/smb.env` and numerous scripts. Jackett and qBittorrent credentials are also embedded in `SKILL.md` and shell-script defaults, including: ```bash JACKETT_API_KEY="${JACKETT_API_KEY:-o5gp976vq8cm084cqkcv30av9v3e5jpy}" QB_USERNAME="${QB_USERNAME:-admin}" QB_PASSWORD="${QB_PASSWORD:-adminadmin}" SMB_PASSWORD="${SMB_PASSWORD:-Roger0808}" ``` Because the project is a distributable Skill package, anyone who can download the package, inspect build artifacts, access logs containing its source, or read a deployed installation receives reusable credentials. Environment-variable overrides do not mitigate the issue because working defaults remain embedded. The pre-scan-targeted OpenSubtitles behavior sends the embedded API key to `https://api.opensubtitles.com/api/v1` in the `Api-Key` header. That destination is consistent with subtitle retrieval, and no SMB password transmission to OpenSubtitles was identified. Nevertheless, embedding the API key makes it public and reusable by unrelated parties. ### Attack Path 1. An attacker obtains the Skill package or reads a deployed copy. 2. The attacker extracts the plaintext SMB password, qBittorrent password, Jackett key, and OpenSubtitles key. 3. If the NAS or services are reachable from the attac ...[truncated 871 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately rotate all exposed SMB, qBittorrent, Jackett, and OpenSubtitles credentials. 2. Remove every credential default from source code, documentation, generated scripts, and `config/smb.env`. 3. Require credentials through environment variables or a dedicated secret manager and fail closed when they are absent. 4. Provide only a redacted template such as `config/smb.env.example`. 5. Add the real environment file to version-control and packaging exclusion rules. 6. Use separate, narrowly scoped service accounts: - Restrict the SMB account to the required media directories. - Disable SMB deletion if the subtitle workflow only needs read and create permissions. - Restrict qBittorrent and Jackett to trusted management networks. 7. Add secret scanning to CI and release checks to prevent recurrence. 8. Avoid accepting passwords through command-line flags because process listings and shell history can expose them. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/qbittorrent-add.sh:9
• Finding: Credentials and API Keys Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/qbittorrent-add.sh:9-11, 73-77` **Vulnerability Type**: Cleartext authentication transport **Risk Level**: High ### Technical Analysis The qBittorrent integration defaults to unencrypted HTTP and submits the username and password in an HTTP request body: ```bash QB_URL="${QB_URL:-http://192.168.1.246:8888}" QB_USERNAME="${QB_USERNAME:-admin}" QB_PASSWORD="${QB_PASSWORD:-adminadmin}" ``` ```bash # 1. Log in and obtain a session echo "Logging in..." LOGIN_RESPONSE=$(curl -s -i --cookie-jar /tmp/qb-cookies.txt \ --data "username=$QB_USERNAME&password=$QB_PASSWORD" \ "$QB_URL/api/v2/auth/login") ``` Jackett similarly defaults to HTTP and places its API key in the URL query string: ```bash JACKETT_URL="${JACKETT_URL:-http://192.168.1.246:9117}" SEARCH_URL="$JACKETT_URL/api/v2.0/indexers/all/results?apikey=$JACKETT_API_KEY&Query=$(echo "$QUERY" | jq -sRr @uri)" RESPONSE=$(curl -s "$SEARCH_URL") ``` HTTP provides no confidentiality, server authentication, or integrity. Any party able to observe or manipulate local-network traffic can recover credentials and session cookies or alter responses. Placing the Jackett API key in the URL also increases exposure through proxy, access, shell-debug, and monitoring logs. ### Attack Path 1. The Skill connects to the default qBittorrent or Jackett HTTP endpoint. 2. An attacker on the same wireless network, switched network segment, compromised router, or proxy path captures or alters the traffic. 3. The attacker extracts the qBittorrent username/password, Jackett API key, or authenticated session cookie. 4. The attacker replays the credentials against the services. 5. The attacker can add malicious or unwanted torrents, inspect the download queue, delete torrents through other exposed API functions, or monitor search activity. 6. A man-in-the-middle attacker may also alter Jackett results and influence which torrent is selected. ### Impact Assessment ...[truncated 337 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for qBittorrent and Jackett endpoints; do not provide HTTP defaults. 2. Validate endpoint schemes and reject `http://` unless a user explicitly enables a documented development-only exception. 3. Configure trusted certificates and preserve certificate verification. Do not add `curl -k` or equivalent bypasses. 4. Place services behind a TLS-enabled reverse proxy if they do not natively support secure transport. 5. Restrict management interfaces to a trusted VLAN, VPN, or loopback interface. 6. Rotate the credentials after TLS is deployed because existing credentials must be treated as exposed. 7. Prefer an authorization header for API keys where supported; otherwise ensure URLs are redacted from logs. 8. Use `curl --fail-with-body --show-error` and verify expected response content to avoid processing spoofed or malformed responses. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/archive-movie.py:101
• Finding: Predictable Temporary File Enables Symlink Clobbering and Media Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/archive-movie.py:101-109` **Vulnerability Type**: Insecure temporary-file handling **Risk Level**: High ### Technical Analysis The archive operation copies every SMB object through a fixed, globally predictable path: ```python def _copy_file(self, ssd_conn, hdd_conn, src, dst): """Copy a single file""" # Read the file with open('/tmp/smb_temp_file', 'wb') as fp: ssd_conn.retrieveFile('super8083', src, fp) # Write the file with open('/tmp/smb_temp_file', 'rb') as fp: hdd_conn.storeFile('sata11-139XXXX8083', dst, fp) ``` Opening `/tmp/smb_temp_file` with `wb` follows symbolic links and truncates an existing target. A local attacker can create this path as a symbolic link before the archive runs. If the archive executes with greater privileges, the attacker may redirect the write to a file writable by that privileged process. The path is shared across all invocations, creating race conditions and cross-run corruption. The code also does not remove the temporary file after upload, leaving a local copy of the last archived media file. Its readability depends on the process umask and existing-file ownership and permissions. ### Attack Path 1. A local attacker predicts the path `/tmp/smb_temp_file`. 2. Before a privileged or more trusted user runs the archive, the attacker creates a symbolic link at that path to a selected file. 3. `open(..., 'wb')` follows the link and truncates or overwrites the target with SMB media data. 4. Alternatively, concurrent archive jobs use the same path, allowing one job to overwrite the other's data between retrieval and upload. 5. After completion, another local user may read the residual temporary file if its permissions allow it. ### Impact Assessment Potential effects include local file corruption, denial of service, corruption of archived media, cross-job data substitution, and disclosure of NAS-hosted video content. If the s ...[truncated 160 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the fixed path with `tempfile.NamedTemporaryFile` or `tempfile.TemporaryDirectory`. 2. Create temporary files with exclusive creation and permissions of `0600`. 3. Keep the temporary file handle open while transferring data to avoid pathname races. 4. Delete temporary content in a `finally` block, including when SMB operations fail. 5. Prefer streaming or an in-memory bounded buffer where file sizes and memory limits permit it. 6. If pathname-based reopening is unavoidable, use a private runtime directory owned by the service account and reject symbolic links. 7. Prevent concurrent jobs from sharing state; each operation must receive a unique temporary location. 8. Run archive jobs as an unprivileged account with access only to the required SMB shares. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/archive-movie.py:161
• Finding: Broad Torrent Name Matching Can Delete Unrelated Torrent Payloads<![CDATA[ ## Vulnerability Details **File Location**: `scripts/archive-movie.py:161-185` **Vulnerability Type**: Unsafe destructive operation and insufficient target validation **Risk Level**: High ### Technical Analysis After archiving, the script iterates over the entire qBittorrent queue and deletes every torrent whose name contains a user-supplied movie-name substring: ```python # Find matching torrents movie_lower = movie_name.lower() deleted = False for t in torrents: t_name = t.get('name', '').lower() if movie_lower in t_name or movie_name.lower().replace(' ', '.') in t_name: torrent_hash = t.get('hash') print(f" Found torrent: {t.get('name')}") # Delete torrent and files delete_data = urllib.parse.urlencode({ 'hashes': torrent_hash, 'deleteFiles': 'true' }).encode() delete_req = urllib.request.Request( f"{qb_url}/api/v2/torrents/delete", data=delete_data ) opener.open(delete_req) print(f" Deleted torrent") deleted = True ``` The comparison is not an exact identity check. Short, ambiguous, or overlapping movie names can match multiple unrelated torrents. Every match is deleted with `deleteFiles=true`, which removes both the qBittorrent entry and its downloaded payload. The archive workflow calls this deletion after `move_to_hdd()` reports success, but the reviewed code does not show cryptographic integrity verification of the copied content before deletion. A successful SMB API return therefore becomes the basis for destructive cleanup without proving that every destination file is complete and correct. ### Attack Path 1. A user or upstream automation supplies a broad movie name, such as a short word contained in several torrent names. 2. The archive finds one corresponding source folder and performs the copy operation. 3. `delete_torrent()` retrieves the complete qBittorrent queue. 4. The substring conditio ...[truncated 648 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Track the exact torrent hash selected when the download is initiated and delete only that hash. 2. Never identify a destructive target using substring matching. 3. Make payload deletion opt-in through a separate explicit flag; default to removing neither the torrent nor its files. 4. Display the exact torrent name, hash, content path, and files before deletion and require confirmation for interactive runs. 5. Verify destination integrity before cleanup: - Compare file counts and sizes. - Prefer cryptographic checksums for every copied file. - Ensure all SMB writes have completed successfully. 6. Stop after one exact target and reject ambiguous matches. 7. Use a qBittorrent account with only the minimum API permissions necessary. 8. Add an audit log recording the selected hash, source path, destination path, verification result, and deletion response. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/download-subtitle-smb.sh:32
• Finding: Subtitle Workflow Uses Sudo CIFS Mount and Exposes the SMB Password in Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download-subtitle-smb.sh:32-39` **Vulnerability Type**: Excessive privilege use and credential exposure **Risk Level**: Medium ### Technical Analysis The subtitle script creates and mounts an SMB share using `sudo`, while placing the NAS password directly in the mount command's argument list: ```bash sudo mkdir -p "$MOUNT_POINT" if [ -n "$NAS_PASS" ]; then sudo mount -t cifs "//$NAS_HOST/$NAS_SHARE" "$MOUNT_POINT" -o username="$USER",password="$NAS_PASS",uid=$(id -u) else sudo mount -t cifs "//$NAS_HOST/$NAS_SHARE" "$MOUNT_POINT" -o guest,uid=$(id -u) fi cleanup() { sudo umount "$MOUNT_POINT" 2>/dev/null; } ``` Mounting and unmounting filesystems crosses a system-wide privilege boundary and is not necessary where the project already uses `pysmb` for user-space SMB access. Depending on operating-system process visibility, the password may be exposed in process listings, monitoring tools, audit logs, shell tracing, or diagnostic output. A mount point also changes global filesystem state. If mount-point selection or surrounding variables are not tightly controlled by the caller, a privileged mount may obscure existing content or expose the remote share at an unintended location. ### Attack Path 1. A user invokes the subtitle workflow and authorizes its `sudo` operations. 2. The SMB password is included in the `mount` process argument vector. 3. A local observer or monitoring system captures the argument while the command is running. 4. The observer reuses the credential against the NAS. 5. Separately, misuse or manipulation of the mount location can cause a privileged filesystem mount at an unintended path. ### Impact Assessment The principal impact is disclosure of an SMB credential and unnecessary use of root-level mount capability. A compromised SMB credential may permit access to the configured media share. The privileged mount operation also increases the potential effect of path- ...[truncated 60 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the privileged mount workflow and use the existing user-space `pysmb` implementation. 2. If a CIFS mount is unavoidable, use a root-owned credential file with mode `0600` and the `credentials=/path/to/file` mount option. 3. Do not place passwords in command-line arguments, logs, help output, or shell history. 4. Use a fixed, root-controlled mount point and verify with `realpath` that it is not a symbolic link. 5. Apply restrictive mount options such as `nosuid`, `nodev`, and `noexec` where compatible. 6. Limit `sudoers` permissions to a narrowly validated wrapper rather than granting general `mount` or `umount` access. 7. Ensure cleanup is registered with `trap` for normal exit and signals. 8. Use a dedicated SMB account limited to the target directory and required read/write operations. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (211)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The markdown recommends direct SMB access, Python package installation, and even system-level mounting behavior, all of which are sensitive operations not captured by any permission metadata. In agent environments, undocumented system/network capabilities can lead to excessive privilege use, remote share exposure, and unsafe host modification.

Static analysis

No suspicious patterns detected.