Send2tv

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:44 PM UTC
• Version: 1.2.0

Overview

This TV-casting skill mostly does what it claims, but it uses broad local-network serving and automatic process termination in ways users should review before installing.

Review this skill before installing, especially on shared machines or networks. Avoid sending sensitive text, images, or audio, do not run it as root, and be aware it can kill whatever process is already using port 8082. TTS mode should only be used if you trust the separately installed edge-tts converter.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send2tv.py:106

Finding

Unauthenticated Media Exposure on All Network Interfaces

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send2tv.py:84

Finding

Predictable Shared Temporary Files Permit Symlink Attacks and Cross-Process Data Exposure

Content

View full analysis

max_size[0] or img.height > max_size[1]: img.thumbnail(max_size, Image.LANCZOS) img.save(output_path, "JPEG", quality=85) return output_path ``` ```python audio_path = "/tmp/dlna_push.mp3" with open(audio_path, 'rb') as f: data = f.read() ``` ```python with open("/tmp/dlna_push.jpg", 'rb') as f: data = f.read() ``` ```python def prepare_audio(audio_path, output_path="/tmp/dlna_push.mp3"): """Prepare audio file for DLNA push - convert to MP3 if needed.""" # If already the target path, nothing to do if os.path.abspath(audio_path) == os.path.abspath(output_path): return output_path # Check if file is already mp3 if audio_path.lower().endswith('.mp3'): shutil.copy(audio_path, output_path) return output_path # Convert to mp3 using ffmpeg if available if shutil.which('ffmpeg'): subprocess.run([ 'ffmpeg', '-y', '-i', audio_path, '-codec:a', 'libmp3lame', '-qscale:a', '2', output_path ], check=True, capture_output=True) return output_path # If no ffmpeg and not mp3, just copy and hope TV supports it shutil.copy(audio_path, output_path) return output_path ``` ```python def text_to_speech(text, voice='zh-CN-XiaoxiaoNeural', rate='default', output_path='/tmp/dlna_push.mp3'): ``` ```python if image_path: prepare_image(image_path) print( ...[truncated 2341 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/send2tv.py:157

Finding

Unconditional Termination of Unrelated Processes Using the HTTP Port

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/send2tv.py:261

Finding

Unpinned External TTS Skill Is Located in Mutable Directories and Executed

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (10)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

---

name: send2tv description: "Push text messages, images, or audio to Huawei Smart Screen via DLNA/UPnP. Use when user wants to display something on TV or play audio/TTS on TV. Triggers: send to TV, push to TV, display on TV, 电视上显示, 发到电视, 推送到电视, 电视播放, 语音播报."

send2tv

Push text, images, or audio to Huawei Smart Screen V75 (or other DLNA-compatible TVs) via UPnP AVTransport protocol.

Quick Usage

bash

# Text (Chinese supported)
python3 scripts/send2tv.py "快去写作业！"

# Text with custom font size
python3 scripts/send2tv.py "Warning!" --font-size

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation indicates it invokes local scripts, writes/serves files, and starts a local HTTP server, yet the manifest declares no explicit tool scope or permissions. In an agent environment, missing scope declarations can cause the agent to invoke shell and file-write capabilities without clear user-facing constraints or policy review, increasing the chance of unintended command execution or data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad and can match common user requests such as 'send to TV' or 'display on TV' without clarifying that content will be broadcast to a specific local-network device. In an agent-routing setting, this can cause accidental invocation and unintended disclosure of private text, images, or audio to a shared television.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description does not clearly warn that using it starts an HTTP server and transmits user-provided text, images, or audio over the local network to a TV at a fixed IP. Users may unknowingly expose sensitive content to other devices on the LAN or display private information on a shared screen, which is a meaningful privacy and safety risk in this skill's context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This finding is substantiated by the code path that kills any process using the chosen HTTP port before serving DLNA content. In the context of a skill whose purpose is only to host temporary media for a TV, that extra disruptive capability is unjustified and can cause denial of service to unrelated local applications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The local process-termination behavior expands the skill's authority beyond its stated function and creates avoidable system impact. Because it is automatic and silent, a user invoking a 'send to TV' action may unintentionally kill local services such as development servers, dashboards, or other apps bound to port 8082.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The script unconditionally runs fuser -k against the configured HTTP port before starting its server, which terminates whatever local process is bound there. This is a real unsafe capability because a TV-casting helper does not need blanket authority to kill unrelated local services, and if the port is occupied by another application the skill will disrupt it without validation or consent.

Content

Scanner excerpt · scripts/send2tv.py (reported line 159)May include surrounding context.

python

def start_server(port=HTTP_PORT):
    """Start HTTP server for DLNA push."""
    subprocess.run(["fuser", "-k", f"{port}/tcp"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    time.sleep(0.5)
    httpd = ReuseAddrTCPServer(("0.0.0.0", port), DLNAHandler)
    t = threading.Thread(target=httpd.serve_forever, daemon=False)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send2tv.py (reported line 236)May include surrounding context.

python

# Convert to mp3 using ffmpeg if available
    if shutil.which('ffmpeg'):
        subprocess.run([
            'ffmpeg', '-y', '-i', audio_path,
            '-codec:a', 'libmp3lame', '-qscale:a', '2',
            output_path

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language interface and code set the default voice to zh-CN-XiaoxiaoNeural, and the usage/help text presents Chinese voices as the default experience. This imposes a specific language/locale choice unless the user explicitly overrides it, which matches the policy concern for forced language/locale behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send2tv.py (reported line 281)May include surrounding context.

python

cmd.extend(['--rate', rate])
    
    print(f"Running TTS: {' '.join(cmd)}")
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"TTS stderr: {result.stderr}")