alibabacloud-media-diagnostics

• Outcome: Pass
• Latest audit: Aug 27, 2026 · 9:04 AM UTC
• Version: 0.0.1

Overview

This skill is a read-only media diagnostic helper; it inspects user-provided files, URLs, and referenced HLS segments, but I found no hidden writes, credential use, persistence, or exfiltration.

Install only if you are comfortable with the agent reading the specific media file or playlist you provide and probing media URLs or HLS segment URLs referenced by that playlist. Treat the ffmpeg and RTMP commands as manual repair examples, not automatic actions, and confirm destinations before using any command that writes files or pushes a stream.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill claims to be read-only and to require no credentials, but its instructions clearly invoke shell commands, read local files, and make network requests to user-supplied URLs and referenced HLS segments. That capability mismatch is security-relevant because it can hide the real trust boundary from the permission model and enable SSRF, local file access, or command execution paths without explicit declaration and review.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The knowledge base explicitly includes repair and transcoding commands even though the skill is described as read-only diagnostics. That mismatch can cause an agent to move from analysis into action, leading users to run file-modifying commands or causing downstream orchestration to treat destructive guidance as in-scope.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: Stating that entries include 'repair guidance' conflicts with the declared read-only behavior. In agent settings, scope inconsistencies are a real safety issue because policy engines or users may rely on the manifest while the content nudges toward modification steps.

Scope Creep

Medium

• Confidence: 93% confidence
• Finding: The script reads arbitrary local files when the provided argument is a plain path or file:// URL, which contradicts the skill's stated read-only media-URL diagnostic scope and no-permissions posture. In an agent environment, this can be abused via prompt-driven path injection to inspect sensitive local files or make the agent follow file-based references to additional local content, creating unintended local file disclosure.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The repair examples create output files and may overwrite existing data depending on how users adapt the commands, but the documentation provides no warning about local file modification. While the commands are ordinary media tooling, omission of write-safety guidance can still cause unintended data loss or confusion in an ostensibly diagnostic skill.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The live-stream examples include `ffmpeg` commands that push media to RTMP destinations, which introduces outbound network transmission and potential disclosure of media content. In a skill advertised as read-only with no cloud/API actions, undocumented egress guidance materially increases privacy and operational risk.

Static analysis

No suspicious patterns detected.