Security audit

媒体服务器控制

Security checks for vulnerabilities and agentic risk

Overview

This skill is for Jellyfin media playback, but it needs review because it can run commands and control TVs while its activation and limitation instructions are broad or contradictory.

Review this skill before installing. It appears aimed at legitimate Jellyfin and TV control, but only use it if you are comfortable giving an agent command execution plus Jellyfin/Home Assistant credentials, and tighten routing so it only activates for explicit media-control requests. Prefer limited-scope tokens and disable or avoid TV power control unless you want automatic device actions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 80% confidence
Finding: The free-edition manifest says the skill is limited to single-device control, but the documentation exposes broader TV power and backend/device-control behavior. This mismatch can cause users or agents to invoke more privileged physical-device actions than expected, weakening trust boundaries and informed consent around local device control.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The '已知限制' section says several functions are unsupported, yet adjacent instructions state those same areas accept input parameters and support create/query/export operations. Contradictory guidance can cause an agent to treat unsupported actions as valid and execute unintended workflows, including handling arbitrary structured input in ways the user did not expect.

Vague Triggers

High

Confidence: 88% confidence
Finding: The trigger conditions are overly broad and unrelated to the skill's actual scope, increasing the chance that an agent auto-selects this skill for inappropriate requests. Because the skill can invoke exec and control local devices, broad routing criteria materially raise the risk of unintended command execution and physical device actions.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: The natural-language invocation guidance is too vague, which can cause accidental or over-broad activation by an agent interpreting loosely related user requests. In a skill with exec access and device control, ambiguous invocation increases the chance of unintended playback, network calls, or power-control actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill requires sensitive credentials such as Jellyfin API keys and Home Assistant tokens, and it can control local devices, yet the description lacks prominent warnings about credential sensitivity and the consequences of device automation. Users may expose powerful tokens without understanding that the skill can issue authenticated network actions and control televisions on their network.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The one-click playback flow includes automatic TV wake, app launch, and playback without an upfront warning that the skill may power on and control physical devices. Lack of notice can lead to surprising real-world actions in the user's environment, especially when a request is ambiguous or auto-routed.

Static analysis

No suspicious patterns detected.