T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:93- Finding
Unverified Remote Script Download and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Video Analyzer
Security checks for vulnerabilities and agentic risk
Overview
This video-analysis skill is purpose-aligned, but it downloads and runs unreviewed GitHub scripts without version pinning or integrity checks.
Review before installing. The artifact does not show malicious intent, but users should be comfortable with unreviewed scripts being downloaded and executed from GitHub and with private video frames being analyzed. Prefer a version that bundles reviewed scripts or pins and verifies downloads before execution.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Linux:
bash # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # CentOS/RHEL/Fedora sudo yum install ffmpeg
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Linux:
bash # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # CentOS/RHEL/Fedora sudo yum install ffmpeg
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill behavior includes automatic retrieval and execution of scripts from a remote GitHub repository, but the description does not prominently warn the user about this supply-chain and code-execution risk. Because the downloaded content is external and mutable, users may unknowingly authorize execution of unreviewed code on their system.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # CentOS/RHEL/Fedora sudo yum install ffmpeg
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # CentOS/RHEL/Fedora sudo yum install ffmpeg
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # CentOS/RHEL/Fedora sudo yum install ffmpeg
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux:
bash # Ubuntu/Debian sudo apt update && sudo apt install ffmpeg # CentOS/RHEL/Fedora sudo yum install ffmpeg
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README states that the skill will automatically download platform-specific scripts from GitHub on first use, but it does not clearly warn users that remote code will be fetched and then executed locally. In the context of an agent skill, this is dangerous because it creates a supply-chain and remote-code-execution path that may occur implicitly during normal use, especially if the repository, release asset, or network path is compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger section defines invocation patterns only in Chinese and presents them as the conditions for automatic activation, which effectively forces a specific language for use. The file does not offer multilingual alternatives, user opt-in, or a documented reason for restricting activation to Chinese.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match ordinary conversation about videos, which can cause the skill to run unexpectedly on local files or user-described paths. In this skill, accidental activation is more dangerous because execution can lead to downloading and running platform-specific scripts from GitHub without a strong explicit consent boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow states that local video files are processed and frames are extracted for AI visual analysis, but it does not clearly warn users about the privacy implications of exposing local media content and derived images. This is especially sensitive because videos may contain private scenes, faces, documents, screens, or location data embedded in frames.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description and all example invocations are presented only in Chinese, and the text instructs users to invoke the skill with Chinese phrases. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.
- Content
Static analysis
No suspicious patterns detected.