link-resolver-engine

• Outcome: Review
• Latest audit: Jul 3, 2026 · 2:27 PM UTC
• Version: 1.0.8

Overview

This video downloader is mostly purpose-aligned, but it automatically installs and changes local software components in ways users may not expect.

Install only if you are comfortable with the skill downloading media, writing files to chosen directories, running subprocesses, installing Python packages and Chromium, and downloading FFmpeg on first use. Prefer running it in an isolated environment and avoid giving it sensitive output paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

ensure_package.pip("tf-playwright-stealth")
ensure_package.pip("yt-dlp")
# 安装 chromium 浏览器
subprocess.check_call([sys.executable, "-m", "playwright", "install", "chromium"])
import requests
import yt_dlp
from yt_dlp.utils import DownloadError  # 专门捕获 yt_dlp 下载错误

• Confidence: 96% confidence
• Finding: The module executes `playwright install chromium` at import time, which causes immediate subprocess execution and downloads software onto the host before any explicit user consent or safety gating. This expands the skill's capability and attack surface beyond simple link parsing, and import-time side effects are especially dangerous in agent environments because merely loading the skill triggers system modification and network activity.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

final_file
            ]

            result = subprocess.run(
                cmd, 
                capture_output=True, 
                text=True,

• Confidence: 85% confidence
• Finding: The code invokes external `ffmpeg` through `subprocess.run`, which is a genuine capability escalation because it executes a host binary on attacker-influenced inputs such as downloaded media and file paths. Although it avoids shell invocation and therefore reduces classic command injection risk, it still creates risk from unsafe binary execution, malicious media parsing, and unintended file writes in a local agent context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

ensure_package.pip("tf-playwright-stealth")
ensure_package.pip("yt-dlp")
# 安装 chromium 浏览器
subprocess.check_call([sys.executable, "-m", "playwright", "install", "chromium"])
import requests
from playwright.sync_api import sync_playwright
from playwright_stealth import stealth_sync  # tf-playwright-stealth 版本

• Confidence: 91% confidence
• Finding: The code invokes a subprocess at import/runtime to install Chromium via Playwright, which modifies the host environment and executes external tooling without explicit user approval. Even though the command arguments are not user-controlled, this still expands the skill’s privilege and attack surface beyond simple link resolution, and could be abused in restricted environments or trigger unintended software installation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 91% confidence
• Finding: This subprocess call performs a pip install of a pinned package during module initialization, which mutates the Python environment without explicit user action. Even though the command arguments are constant here, automatic package installation expands the attack surface, can break the runtime, and may execute untrusted build/install hooks from the package supply chain.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 93% confidence
• Finding: This code force-reinstalls setuptools and wheel at import time, rewriting core packaging components for the current environment. Modifying foundational tooling automatically is dangerous because it can destabilize other code, enable supply-chain compromise through package retrieval, and occur before any caller consents to the change.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 98% confidence
• Finding: This subprocess executes pip install on a spec that may represent arbitrary PyPI packages, git URLs, or archive sources. In the context of a skill that claims to only resolve B站/抖音 video links, this is especially dangerous because it provides an execution-capable path for installing untrusted code and introduces clear supply-chain risk unrelated to the stated purpose.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 96% confidence
• Finding: This function installs a package string assembled at runtime, allowing environment mutation and potential execution of package build/install code from an external index. Although intended as a convenience installer, it creates unnecessary remote code and supply-chain exposure for a skill whose advertised purpose is just downloading video links.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 97% confidence
• Finding: This fallback path installs a local archive if a git-based install fails, still executing package installation from a potentially untrusted source. Accepting local zip archives as code sources broadens the attack surface and makes it easier to smuggle malicious packages into the runtime under the guise of dependency recovery.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 🔥 关键：自动输入 Y（默认 yes），彻底无交互
        logger.info("   自动确认下载中...")
        subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
        
        # 下载完后刷新模块
        importlib.reload(ffdl)

• Confidence: 92% confidence
• Finding: The code invokes an external installer command via subprocess and automatically supplies confirmation input, causing software download and installation without explicit user approval. While the argument list avoids shell injection, this still creates a supply-chain and unexpected code execution risk because a CLI binary named 'ffdl' from the runtime PATH is trusted and executed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions even though its documented behavior clearly involves network access, local file writes, environment/path modification, and shell execution. This is dangerous because users and the host platform cannot make an informed trust decision or apply least-privilege controls before the skill downloads content, installs components, or writes files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is narrower than the described runtime behavior: the skill appears to auto-install packages, install a browser runtime, download FFmpeg, modify PATH, recreate itself in a virtual environment, and handle TikTok-related domains despite claiming only B站/抖音 support. This mismatch is dangerous because hidden installation and execution steps materially expand the attack surface and can lead to unexpected code execution, supply-chain exposure, and policy bypass.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The README explicitly advertises support for arbitrary user-specified download directories, which conflicts with the stated constraint that files are saved to a fixed downloads folder. In an agent skill context, this expands file-write scope and can lead to unexpected writes to sensitive or unintended local paths if the agent forwards user input directly.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill installs packages and a Chromium browser dynamically at runtime, which exceeds the narrow manifest expectation of link resolution and downloading. Runtime dependency installation is dangerous because it introduces unreviewed code into the environment, modifies the host without warning, and can be triggered simply by importing or activating the skill.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Using external `ffmpeg` for media merging gives the skill host-level execution capability beyond mere URL resolution. In an agent setting, this is more sensitive because the skill automatically downloads remote content and then passes it to a local parser/executable, increasing exposure to parser bugs, filesystem writes, and resource abuse.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill dynamically installs Python packages and a browser at runtime, which is an environment-modifying capability not strictly necessary for a downloader to perform its immediate task. This is dangerous because it allows network retrieval and execution of new code/components during use, increasing supply-chain risk and making the skill’s behavior less predictable and harder to audit.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Using subprocess execution to run Playwright installation gives the skill the ability to spawn external processes and alter the system state, which is elevated relative to basic URL parsing/downloading. In the context of an agent skill, this matters because such capabilities can bypass expectations about a narrowly scoped media utility and create opportunities for unsafe side effects in the host environment.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file behavior materially differs from the manifest: it is a generic package installer, not a limited B站/抖音 link resolver. Such capability mismatch is a strong red flag because it hides code-execution and environment-modification functionality behind an innocuous media-download description.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This module can install arbitrary packages from PyPI, VCS URLs, and local archives, which is effectively a code acquisition and execution mechanism. In a skill supposedly limited to processing B站/抖音 links, that capability is unjustified and dramatically more dangerous because it enables supply-chain compromise and arbitrary environment changes far outside user expectations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The module performs package installation immediately on import, including forced repair/reinstallation of packaging components before any explicit caller action. Import-time side effects that rewrite the environment are dangerous because they are hard to audit, bypass user intent, and can trigger external package retrieval and code execution automatically.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file’s purpose materially diverges from the skill’s declared B站/抖音 link-resolution scope by acting as a bootstrapper that manages Python versions, virtual environments, hardware detection, and dependency deployment. In a narrowly scoped downloader skill, this mismatch increases supply-chain and execution risk because users would not reasonably expect environment mutation and process control from the advertised functionality.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code creates a virtual environment, upgrades pip, and prepares to install packages, which are powerful host-modifying actions unrelated to simply resolving and downloading B站/抖音 video links. In the context of an end-user skill, such undisclosed environment manipulation creates unnecessary attack surface and can be abused for persistence, dependency tampering, or unexpected code execution.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The module documentation advertises GPU detection, PyTorch selection, and audio-processing dependency deployment, which does not fit the manifest’s restricted downloader role. Even though documentation alone is not executable, it signals design intent for capabilities beyond the declared scope, making the surrounding code more suspicious and less trustworthy in this skill context.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The platform detection logic treats TikTok domains as '抖音' even though the skill metadata states only Bilibili and Douyin are supported. This mismatch weakens policy boundaries and can cause the skill to process out-of-scope URLs, increasing legal/compliance and unexpected-network-behavior risk rather than creating a direct memory/code execution flaw.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README emphasizes downloading functionality and custom file management but does not clearly warn users that the skill performs local file writes, potentially to user-controlled directories. In an agent environment, insufficient disclosure can cause users to trigger filesystem modifications they did not fully understand or intend.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill performs extensive outbound requests, browser automation, and scraping of supplied URLs, yet the description lacks a privacy and network-use disclosure. Users may not realize their provided links will be fetched through headless browsing and multiple third-party requests, which increases privacy, compliance, and trust risks.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.