online-file-repair-skills

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 0.1.1

Overview

The skill does what it claims by uploading a user-chosen file to Tenorshare for repair, with clear caveats about sensitive files, local quota state, and vendor promotion.

Install only if you are comfortable sending the selected file to Tenorshare 4DDiG and any pre-signed storage provider they use. Do not use it for confidential, regulated, or highly sensitive files. Be aware it keeps a small local daily quota counter, can save repaired output locally when requested, and may show vendor promotional links when service limits are reached.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:113

Finding

Mandatory Commercial Output Hijacking Through Affiliate Promotion

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · dist/repair-file.bundle.cjs (reported line 10610)May include surrounding context.

js

*     the event listener
       * @param {Boolean} [options.once=false] A `Boolean` indicating that the
       *     listener should be invoked at most once after being added. If `true`,
       *     the listener would be automatically removed when invoked.
       * @public
       */
      addEventListener(type, handler, options = {}) {

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · dist/repair-file.bundle.cjs (reported line 11962)May include surrounding context.

js

*     any of the `'message'`, `'ping'`, and `'pong'` events can be emitted
       *     multiple times in the same tick
       * @param {Boolean} [options.autoPong=true] Specifies whether or not to
       *     automatically send a pong in response to a ping
       * @param {Number} [options.backlog=511] The maximum length of the queue of
       *     pending connections
       * @param {Boolean} [options.clientTracking=true] Specifies whether or not to

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill uploads the user's entire local file to a third-party remote service as part of the repair flow, but there is no in-file warning, consent step, or strong disclosure of this data transfer. For documents, archives, designs, and videos, this may expose sensitive content to an external processor unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dist/repair-file.bundle.cjs (reported line 12654)May include surrounding context.

js

async function createRepairJob({ objKey, method, isAsync }) {
  logEvent("info", "repair.create.start", { objKey, method, isAsync });
  const { signal, cancel } = timeoutSignal(6e4);
  const res = await fetch("https://4ddig-online.tenorshare.com/api/v1/file/repair", {
    method: "POST",
    signal,
    headers: {

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill manifest says it should provide an output download URL, but the code also supports a --download mode that fetches the repaired file and writes it to local disk. That expands the data-handling scope from URL-returning to local persistence, which increases risk of unintended storage of potentially sensitive repaired content on the host.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Although the manifest frames the skill as returning a download URL, the implementation writes persistent operational state to disk via limit.json. This creates a mismatch between declared behavior and actual side effects, reducing transparency and potentially violating least-surprise and least-persistence expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code persists a hidden daily usage counter in limit.json under the executable directory, which is unrelated to the stated file-repair/output-URL purpose. Undeclared local state can surprise operators, affect reproducibility, and create an unauthorized control mechanism over future executions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The esbuild dependency is specified with a caret range, which allows different versions to be installed over time. That weakens build reproducibility and makes it harder to verify whether the installed version includes known security fixes or vulnerable behavior, especially in a supply-chain context.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"build:repair": "esbuild scripts/repair-video.js --bundle --platform=node --format=cjs --target=node18 --outfile=dist/repair-file.bundle.cjs"
  },
  "devDependencies": {
    "esbuild": "^0.20.2"
  },
  "dependencies": {
    "mime-types": "^2.1.35",

Unverifiable Dependency: esbuild has 2 known advisory(ies) (GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r); GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The mime-types package is not pinned to an exact version, so installs may resolve to different releases over time. While not dangerous by itself, this increases supply-chain uncertainty and can introduce unexpected vulnerable or incompatible dependency versions into the skill.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json

"esbuild": "^0.20.2"
  },
  "dependencies": {
    "mime-types": "^2.1.35",
    "ws": "^8.17.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The ws package is unpinned and has a history of security advisories, so allowing semver drift makes it unclear which code will actually be deployed. In a file-repair skill that may expose network-facing functionality, uncertainty around the exact ws version increases the risk of inheriting denial-of-service or information disclosure flaws.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

},
  "dependencies": {
    "mime-types": "^2.1.35",
    "ws": "^8.17.0"
  }
}

Unverifiable Dependency: ws has 7 known advisory(ies) (CVE-2016-10518 (Remote Memory Disclosure in ws); CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The manifest references ws with a non-exact version, and ws has multiple published advisories. Because the installed version cannot be determined from this file alone, the project may resolve to a vulnerable release, which is more concerning here because a file-repair service may accept untrusted client input over network channels.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.