letterboxd-companion

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:36 PM UTC
• Version: 1.0.0

Overview

This is a read-only Letterboxd lookup skill; the main caution is its unpinned third-party Python dependency.

Before installing, use a virtual environment and consider pinning or reviewing `letterboxdpy`. Expect the skill to fetch public Letterboxd data for supplied usernames and movie slugs; it does not manage private account data or record watched items itself.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1, SKILL.md:11-14, README.md:17-21
Vulnerability Type: Unpinned dependency from a mutable package repository
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

letterboxdpy

SKILL.md:11-14:

markdown

## Setup

```bash
pip install letterboxdpy

text

`README.md:17-21`:

```markdown
## Installation

1. Ensure you have Python installed.
2. Install the required dependency:
   ```bash
   pip install letterboxdpy
   ```

Technical Analysis

The project installs letterboxdpy without an exact version constraint or cryptographic integrity hash. Consequently, installation resolves whichever package release is current on the configured Python package index. The reviewed project therefore does not provide a reproducible or integrity-verified dependency set.

If the package publisher account, package repository, distribution artifact, or package-resolution configuration is compromised, a malicious release could be selected without any change to this repository. Python packages can execute attacker-controlled behavior during installation or when imported by lb_tool.py, so the dependency represents a code-execution boundary.

No evidence establishes that the current letterboxdpy package is malicious. The finding is the project's unsafe and mutable dependency-resolution practice.

Attack Path

1. An attacker compromises the legitimate package publisher or repository, causes a malicious release to be published, or manipulates the package source used by the victim.
2. A user follows the documented pip install letterboxdpy instruction or installs from requirements.txt.
3. Because no exact reviewed version and hash are enforced, pip accepts the attacker-controlled distribution.
4. Malicious package code executes during installation or when lb_tool.py imports letterboxdpy.
5. The pay ...[truncated 620 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin letterboxdpy to an exact, reviewed release in requirements.txt, for example:

   text

   letterboxdpy==REVIEWED_VERSION
   

2. Generate and enforce cryptographic hashes for the package and all transitive dependencies:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Use a lockfile or a fully resolved requirements file so transitive dependencies are also version-pinned and reproducible.

4. Update SKILL.md and README.md to instruct users to install from the reviewed requirements file rather than installing an unconstrained package directly.

5. Configure an explicitly trusted package index or an internally controlled artifact mirror.

6. Review dependency source code, release provenance, and changes before upgrading. Run automated vulnerability and dependency-integrity scanning in CI.

7. Install and run the Skill in a least-privileged virtual environment or container without unnecessary credentials or filesystem access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code is broadly movie/Letterboxd-related, so the domain matches the description, but the behavior is narrower and partially different from the declared purpose. It does not let a user 'track what you watch' in the sense of recording or managing watched items; it only retrieves existing data from Letterboxd. It can check watchlists and fetch movie info, which aligns with part of the description. However, it also reads profile stats, favorites, and diary data for arbitrary usernames, which is more specific access than the description states and is notable given that no permissions are declared. Therefore this is a partial but material mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage section says to use the skill whenever the user asks about several broad movie-related topics, but it does not clearly distinguish Letterboxd-specific requests from general movie questions. Because one listed trigger is simply 'Specific movie details,' the activation scope may overlap with ordinary movie-chat requests and cause unintended invocation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified without a version pin, so installs may pull different releases over time, including breaking changes or a compromised upstream version. In a skill that relies on a third-party API client, this increases supply-chain risk and reduces reproducibility, though the file itself does not suggest deliberate malicious behavior.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

letterboxdpy

Static analysis

No suspicious patterns detected.