ClawHub
Back to skill

Security audit

播客下载工具免费版

Security checks for vulnerabilities and agentic risk

Overview

This podcast downloader is mostly purpose-aligned, but it runs broad shell/network/file operations without enough URL and filename containment checks.

Review before installing. Use only with trusted Xiaoyuzhou episode URLs, set PODCAST_DIR to a dedicated folder, avoid running it with broad filesystem privileges, and confirm filenames/output paths before allowing shell execution or deletion. A safer version should validate allowed hosts, reject redirects to private/local addresses, sanitize metadata-derived filenames, and keep all writes under the chosen output directory.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:186
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 186-199
Vulnerability Type: Unrestricted URL fetching / SSRF
Risk Level: High

Vulnerable Code

bash
HTML=$(curl -s "$URL")
DATA=$(echo "$HTML" | grep -o '__NEXT_DATA__.*' | head -1)

AUDIO_URL=$(echo "$DATA" | jq -r '.props.pageProps.episodeInfo.audioUrl')
TITLE=$(echo "$DATA" | jq -r '.props.pageProps.episodeInfo.title')
SHOW_NAME=$(echo "$DATA" | jq -r '.props.pageProps.episodeInfo.podcast.title')

EPISODE_DIR="${OUTPUT_DIR}/${SHOW_NAME}-${TITLE}"
mkdir -p "$EPISODE_DIR"

curl -L -o "$EPISODE_DIR/${TITLE}.m4a" "$AUDIO_URL"

Technical Analysis

The workflow passes the user-supplied URL directly to curl without validating its scheme, destination hostname, resolved address, or port. It then extracts another URL from remotely supplied page data and passes that value to a second curl invocation.

The second request uses -L, allowing HTTP redirects, but the destination is not revalidated after each redirect. Consequently, an initially permitted address could redirect the request to localhost, a private network, a link-local service, or another unintended destination.

Shell quoting protects these values from direct shell command injection, but it does not address server-side request forgery. If the skill is used by an Agent with access to internal network resources, attacker-controlled input could induce requests to destinations that are inaccessible to the attacker directly. Retrieved audio content is also subsequently supplied to ffmpeg, increasing the attack surface if the downloaded file is maliciously constructed.

Attack Path

  1. An attacker supplies a URL using an unexpected scheme or pointing to an attacker-controlled HTTP server.
  2. The Agent executes curl -s "$URL" without confirming that the destination is an approved Xiaoyuzhou domain.
  3. The attacker-controlled response provides data containing an audioUrl f ...[truncated 1304 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require https and reject all other schemes, including file, ftp, and custom protocol handlers.
  2. Allowlist the exact Xiaoyuzhou and required media CDN hostnames rather than accepting arbitrary hosts.
  3. Resolve destination hostnames before connecting and reject:
    • Loopback addresses.
    • Private address ranges.
    • Link-local addresses.
    • Multicast and unspecified addresses.
    • IPv6 local and mapped-private addresses.
  4. Disable redirects unless they are required. If redirects are necessary, validate the scheme, hostname, port, and resolved address at every redirect hop.
  5. Reject URLs containing embedded credentials, nonstandard ports, malformed hostnames, or raw IP literals unless explicitly required.
  6. Apply connection, transfer, and total execution timeouts.
  7. Enforce a maximum response and audio-file size.
  8. Run network retrieval and media conversion in a sandbox with restricted network connectivity and minimal filesystem permissions.
  9. Verify the response content type and file signature before passing downloaded content to ffmpeg.
  10. Fail closed if URL validation, DNS resolution, metadata parsing, or domain verification is unsuccessful.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:190
Finding

Path Traversal Through Untrusted Podcast Metadata

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 190-212
Vulnerability Type: Path traversal and arbitrary file write
Risk Level: High

Vulnerable Code

bash
AUDIO_URL=$(echo "$DATA" | jq -r '.props.pageProps.episodeInfo.audioUrl')
TITLE=$(echo "$DATA" | jq -r '.props.pageProps.episodeInfo.title')
SHOW_NAME=$(echo "$DATA" | jq -r '.props.pageProps.episodeInfo.podcast.title')

EPISODE_DIR="${OUTPUT_DIR}/${SHOW_NAME}-${TITLE}"
mkdir -p "$EPISODE_DIR"

curl -L -o "$EPISODE_DIR/${TITLE}.m4a" "$AUDIO_URL"

ffmpeg -i "$EPISODE_DIR/${TITLE}.m4a" \
    -codec:a libmp3lame -qscale:a "$QUALITY" \
    "$EPISODE_DIR/${TITLE}.mp3"

if [ "$KEEP_M4A" != "true" ]; then
    rm "$EPISODE_DIR/${TITLE}.m4a"
fi

echo "$DATA" | jq -r '.props.pageProps.episodeInfo.shownotes' > "$EPISODE_DIR/${TITLE}.md"

Technical Analysis

TITLE and SHOW_NAME originate in remotely retrieved metadata and are incorporated directly into directory and file paths. The implementation performs no filename sanitization, path canonicalization, containment verification, length checking, or symlink protection.

Quoting the variables prevents word splitting and most shell metacharacter interpretation, but it does not neutralize filesystem path components. Values containing /, .., absolute-path-like content, control characters, or platform-specific separators can alter the resolved destination.

The unsafe paths are used by several filesystem operations:

  • mkdir -p creates attacker-influenced directory structures.
  • curl -o creates or overwrites the M4A destination.
  • ffmpeg writes an MP3 destination.
  • Shell redirection writes or truncates the Markdown destination.
  • rm deletes the calculated M4A path.

Existing symlinks in an attacker-accessible output directory can further redirect these operations to unexpected filesystem locations.

Attack Path

  1. An attacker causes the skill to process a ...[truncated 1908 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat all podcast titles, show names, and metadata as untrusted input.
  2. Convert metadata into safe filename components using an explicit allowlist, such as letters, digits, spaces, underscores, and hyphens.
  3. Remove or replace /, backslashes, null bytes, control characters, and platform-specific reserved characters.
  4. Reject . and .. path components and impose conservative filename and total-path length limits.
  5. Provide a safe fallback name, preferably based on a validated episode identifier, when sanitization produces an empty value.
  6. Canonicalize the output root and every calculated destination, then verify that each destination remains beneath the canonical output root.
  7. Refuse to operate if the output directory or destination contains symbolic links. Where possible, use no-follow and exclusive-creation filesystem semantics.
  8. Avoid overwriting existing files by default. Create new files atomically and require explicit authorization before replacement.
  9. Run the workflow under a dedicated, minimally privileged account with write access only to the intended podcast directory.
  10. Use a temporary directory inside the validated output root, validate downloaded content, and atomically move completed files to their final sanitized names.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The script builds filesystem paths from remote-derived metadata fields like title and show name, then performs write and delete operations on those paths. If those values contain path separators, traversal sequences, shell-special characters, or collide with unexpected paths, the skill could overwrite or delete unintended files when downloading or cleaning up media.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md
# ...
# 6. 删除 m4a(可选)
if [ "$KEEP_M4A" != "true" ]; then
    rm "$EPISODE_DIR/${TITLE}.m4a"
fi
# ...
# 7. 提取节目笔记

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger keywords are overly broad and overlap with ordinary terms like documentation, automation, conversion, and marketing. This can cause accidental invocation in unrelated conversations, leading the agent to perform downloads, file writes, or shell-backed actions outside the user's actual intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill does not prominently disclose that it will download remote content, create directories/files, convert media, and optionally delete originals. Missing explicit notice is dangerous because users may trigger it without understanding that it performs state-changing filesystem and network operations through exec-capable tooling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
76% confidence
Finding

The capability table says the free version does not support batch download, playlists, timed subscriptions, or multi-platform use. However, the only implemented logic shown is a generic shell workflow that takes any URL as input and performs curl/jq extraction with no visible validation that the URL is a single Xiaoyuzhou episode or that repeated invocation for batching is prevented, so the code-level behavior does not clearly enforce the stated product limits.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The scope description uses expansive scenario keywords without a clear activation boundary, which makes it easier for the skill to match unrelated user requests. In an agent environment with exec/write/network capability, ambiguous routing increases the chance of unintended side effects from the wrong skill being selected.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
brew install curl jq ffmpeg
# ...
# Ubuntu / Debian
sudo apt install curl jq ffmpeg
# ...
# Windows (scoop)
scoop install curl jq ffmpeg

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

文件整体以中文展示技能名称、示例输出目录和结果内容，但未说明是否支持其他语言或由用户选择语言。对于面向通用 Agent 平台的技能，这种默认固定语言的做法可能构成语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The skill claims narrowly scoped behavior using public HTTP requests, yet requests broad read/write/exec capabilities. That mismatch increases risk because an agent may grant far more filesystem and command execution authority than users expect, enabling actions unrelated to podcast downloading if the skill is invoked or repurposed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.