Security audit

媒体控制专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a Jellyfin media-control guide, but its broad trigger wording could cause it to be used for unrelated data-analysis tasks while it also asks for command execution and networked device control.

Review this skill before installing. It should only be used for Jellyfin/media-server automation, not general analytics or visualization requests. Keep API keys and tokens in environment variables or a secure secret store, avoid committing config files with credentials, and confirm any scheduled playback, library-modifying scan, ADB, Home Assistant, or local API-service action before allowing the agent to run commands.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest description blends Jellyfin media-control functionality with unrelated data-analysis, reporting, and visualization use cases. This can cause an agent to invoke the skill in contexts outside its actual domain, increasing the chance of unnecessary command execution or exposure of media/server credentials during unrelated tasks.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The category and trigger framing present the skill as a general knowledge/data-analysis tool instead of a device/media-control tool. In an agent ecosystem, misleading classification increases the likelihood of accidental invocation with inappropriate inputs, which is risky because this skill exposes exec capability and interacts with networked devices and APIs.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document advises against storing secrets in configuration, but its examples place API keys, tokens, and client credentials directly inside config structures or nearby examples. Users often copy these patterns verbatim, which can lead to credential leakage through source control, logs, backups, or agent-readable files.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger conditions are overly broad and mention generic data analysis, report generation, statistics, and visualization rather than narrowly scoped Jellyfin/media-control tasks. That broad scope can cause the agent to select a skill with exec and network control abilities for unrelated user requests, creating avoidable command-execution and data-access risk.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The manifest description does not define tight invocation scope and instead mixes domains without strong boundaries or negative examples. Ambiguous activation criteria are dangerous for agent skills because they increase unintended selection, especially when the skill has read, glob, grep, and exec capabilities.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: Forcing Chinese interaction without user opt-in can cause misunderstanding of prompts, outputs, and safety-relevant instructions. While not a direct exploit by itself, language coercion can increase the chance of operator error, mis-executed commands, or overlooked warnings in a skill that controls devices and may invoke shell commands.

Static analysis

No suspicious patterns detected.