Security audit

video

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it processes third-party web content with weak containment and URL validation that could expose the user's runtime to unsafe downloads or internal-network requests.

Install only if you are comfortable sending Reel URLs to sssinstagram.com and running browser automation against that site. Prefer running it in a restricted container or workspace with limited network access and disk quotas, and avoid using it in environments that can reach sensitive internal services or metadata endpoints.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_via_sss.mjs:27
Finding: Chromium Sandbox Disabled While Processing Untrusted Web Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_via_sss.mjs:84
Finding: Remote-Controlled Download URLs Permit Arbitrary Server-Side Requests and Unbounded Buffering
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior does not cleanly match the operational behavior: the skill references local cleanup/deletion and execution of auxiliary scripts, while the declared purpose focuses on downloading and sending a reel. Behavior mismatches are dangerous because reviewers and policy engines may approve the skill for one purpose while it also performs additional file-management actions, which can hide risky side effects or enable unintended data loss.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
- `node scripts/download_via_sss.mjs "<instagram-url>"`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes external code, uses environment variables, and requires network access, but it does not declare an explicit tool scope or permissions boundary. That creates a governance gap: an agent may grant broader-than-necessary capabilities to a skill that downloads remote content and writes files locally, increasing the risk of unintended network access, filesystem use, or misuse of sensitive environment configuration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script deletes matching media files using find ... -delete, which is a destructive operation. Although there is an internal comment describing intent, there is no user-facing prompt, log message, or other disclosure that files will be removed when the script runs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends a user-provided Instagram reel URL to sssinstagram.com, a third-party service, without any explicit disclosure or consent mechanism. Even if this is the intended functionality, it exposes user activity and potentially sensitive shared links to an external party, which creates a privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script retrieves remote content from links discovered on a third-party site and writes the result to disk, but there is no user-facing disclosure that files will be downloaded and stored locally. In this skill context, file creation is expected, but the lack of transparency and the reliance on untrusted third-party content increase privacy and storage-safety concerns.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/download_via_sss.mjs:16