web-video-downloader网页视频下载器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.0

Overview

This video-downloader matches its stated purpose, but it needs Review because it can capture browser cookies/headers and auto-download and run an unverified FFmpeg binary.

Review before installing. Prefer using a trusted, already-installed FFmpeg so the scripts do not fetch a binary from the internet. Avoid running CDP capture while logged into sensitive accounts, treat /tmp/captured_video_urls.json as secret, delete it after use, and choose output paths carefully because scripts may overwrite files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/download_segmented.sh:33

Finding

Unverified Remote FFmpeg Binary Download and Execution in Segmented Downloader

Content

View full analysis

/dev/null ``` ### Technical Analysis When a local FFmpeg installation is unavailable, the script downloads a mutable ZIP archive from a third-party server, extracts it into `/tmp`, marks the resulting file executable, and runs it. It does not: - Pin a specific FFmpeg version. - Verify a cryptographic checksum. - Validate a release signature. - Verify the identity or expected contents of the archive. - Use a private temporary directory. - Obtain explicit confirmation before executing the downloaded component. Consequently, the effective executable payload can change after the Skill has been audited. HTTPS protects data in transit under normal conditions but does not protect against compromise of the distribution server, malicious release replacement, or compromise of the relevant certificate and network trust chain. The static pre-scan warning referred to a `curl | bash`-style risk. No literal `curl | bash` pipeline exists in this file. However, downloading, extracting, and executing an unverified binary creates an equivalent mutable remote-code execution channel. ### Attack Path 1. FFmpeg is absent from the system PATH and `/tmp/ffmpeg` does not already exist. 2. An attacker compromises the remote distribution endpoint or otherwise causes it to serve a malicious ZIP archive. 3. The user invokes `scripts/download_segmented.sh`. 4. The script downloads th ...[truncated 995 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/download_from_urls.sh:24

Finding

Unverified Remote FFmpeg Binary Download and Execution in URL Downloader

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/merge.sh:25

Finding

Unverified Remote FFmpeg Binary Download and Execution in Merge Utility

Content

View full analysis

/dev/null; then ``` ### Technical Analysis The merge utility trusts the current contents served by a third-party “latest release” endpoint. It immediately extracts and executes the retrieved native binary without integrity verification. This means review of the Skill repository cannot establish what code will execute on a future invocation. The use of fixed files in `/tmp` also weakens isolation and allows different invocations or processes to interact with the same downloaded artifact. ### Attack Path 1. FFmpeg is unavailable locally. 2. An attacker causes the configured endpoint to return a malicious archive. 3. The user starts `scripts/merge.sh`. 4. The script downloads and extracts the archive into `/tmp`. 5. The extracted `/tmp/ffmpeg` receives executable permission. 6. Segment conversion or merging invokes the malicious program. 7. Arbitrary attacker code executes as the current user. ### Impact Assessment The attacker obtains the same filesystem, network, and process privileges as the merge utility. This can lead to confidentiality, integrity, and availability compromise for resources accessible to the current account. The impact becomes system-wide if the script is unnecessarily executed as an administrator. Automatic dependency execution is not necessary for merging: requiring a preinstalled and trusted FFmpeg binary provides the declared functionality with ...[truncated 29 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cdp_capture.js:72

Finding

Excessive Capture and Plaintext Storage of Browser Request Credentials

Content

View full analysis

100 ? url.substring(0, 100) + '...' : url; console.log(`[捕获 #${captured.length}] ${shortUrl}`); } ``` It then writes the complete captured objects to a predictable plaintext output file: ```javascript const result = { capturedAt: new Date().toISOString(), totalRequests: captured.length, uniqueUrls: unique.length, urls: unique }; fs.writeFileSync(OUTPUT_FILE, JSON.stringify(result, null, 2)); console.log(`\n[结果] 捕获 ${captured.length} 个请求，${unique.length} 个唯一URL`); console.log(`[结果] 保存到: ${OUTPUT_FILE}`); ``` The default destination is: ```javascript const OUTPUT_FILE = process.argv[3] || '/tmp/captured_video_urls.json'; ``` ### Technical Analysis Chrome DevTools Protocol network events may expose sensitive request metadata, including: - Session cookies. - `Authorization` headers. - Signed CDN or playback tokens. - Origin-specific authentication data. - Other browser-generated credentials. The script copies `req.headers` in its entirety and writes those values to disk. This collection exceeds the minimum data required by the accompanying downloader. `scripts/download_from_urls.sh` only extracts and uses the `Referer` value from captured headers. The destination defaults to a predictable file in `/tmp`, and `fs.writeFileSync` does not explicitly enforce a restrictive file mode. Sensitive data can therefore persist after capture and may be exposed acco ...[truncated 1562 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

As described, the skill performs undeclared network activity to obtain ffmpeg, which is a meaningful security concern independent of the marketing mismatch. Hidden dependency fetching can expose users to malicious or tampered binaries and bypass expected review of executable code paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

As described, the skill performs undeclared network activity to obtain ffmpeg, which is a meaningful security concern independent of the marketing mismatch. Hidden dependency fetching can expose users to malicious or tampered binaries and bypass expected review of executable code paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

As described, the skill performs undeclared network activity to obtain ffmpeg, which is a meaningful security concern independent of the marketing mismatch. Hidden dependency fetching can expose users to malicious or tampered binaries and bypass expected review of executable code paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

As described, the skill performs undeclared network activity to obtain ffmpeg, which is a meaningful security concern independent of the marketing mismatch. Hidden dependency fetching can expose users to malicious or tampered binaries and bypass expected review of executable code paths.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

bash scripts/download_segmented.sh <api_url_or_vid> <output_path>

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly captures browser network requests and associated headers, including Referer and Cookie values, then stores them to JSON. These artifacts may contain session tokens, authentication cookies, account identifiers, or other sensitive data, creating a significant privacy and credential-exposure risk if mishandled, logged, or reused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script silently downloads an ffmpeg binary from the network into /tmp and then executes it without signature, checksum, or provenance verification. This creates a supply-chain and arbitrary code execution risk: if the download source, transport, DNS, or local /tmp contents are compromised, the user may execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script fetches and runs a network-downloaded ffmpeg binary without warning or trust validation, exposing users to unreviewed executable code. In the context of a video-downloading skill, this is more dangerous because users reasonably expect media processing, not silent installation and execution of third-party binaries.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This line performs external executable fetching, unpacking, permission changes, and later execution from /tmp, which is a classic unsafe pattern. The skill context does not justify remote code retrieval as necessary functionality; users asked to download videos, not to run unverifiable binaries obtained at runtime.

Content

Scanner excerpt · scripts/download_segmented.sh (reported line 39)May include surrounding context.

sh

FFMPEG="/tmp/ffmpeg"
  else
    echo "[ffmpeg] 下载静态版本..."
    curl -sL 'https://evermeet.cx/ffmpeg/getrelease/ffmpeg/zip' -o /tmp/ffmpeg.zip
    cd /tmp && unzip -o ffmpeg.zip && chmod +x /tmp/ffmpeg
    FFMPEG="/tmp/ffmpeg"
  fi

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README content is written in Chinese throughout, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to use shell and environment-backed capabilities extensively, but it does not declare an explicit tool scope or permissions boundary. In practice, this creates a least-privilege failure: a downloader that can invoke arbitrary shell commands, browser automation, curl, ffmpeg, and local scripts is materially more dangerous when its allowed tools are not clearly constrained and reviewable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Overly broad trigger phrases increase the chance that the skill activates on ordinary video-related requests where the user did not intend browser automation, network interception, or downloading. In this skill's context, accidental invocation is more dangerous because the workflow includes shell commands, external downloads, and potential capture of sensitive browsing metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script captures full request URLs and headers from browser network traffic and writes them to disk. In this skill context, those headers can include cookies, Authorization headers, signed CDN tokens, and other session-bound secrets that would let someone replay protected media requests or abuse authenticated sessions if the output file is exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The save routine persists captured network data to a predictable filesystem location as JSON, which can retain sensitive media URLs and request headers after execution. Because this skill is specifically designed to intercept video traffic from authenticated sites like B站/优酷/搜狐, the stored data is more likely than usual to contain reusable session artifacts or time-limited access tokens.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script automatically downloads an ffmpeg binary from the internet into /tmp and then executes it without any integrity verification, signature check, or pinning to a trusted hash. That creates a supply-chain risk: if the download source, network path, or retrieved artifact is compromised, arbitrary code could run with the user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code fetches a fresh executable and immediately runs it, while only emitting a generic status message that it is downloading a static version. Users are not meaningfully warned that new executable code is being introduced and executed, which increases the likelihood of silent compromise if the binary source is malicious or tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script writes to the user-supplied output path and passes -y to ffmpeg, which forces overwrite of existing files. While the script prints the output path, it does not clearly warn that an existing file may be replaced without prompting, making this a missing disclosure for a file-destructive operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script defaults to writing a merged video to an output path and later invokes ffmpeg with -y, which will overwrite an existing file at that path without prompting. Although cleanup of temporary files is confirmed later, there is no user-facing warning or confirmation about the potentially destructive overwrite behavior before the write occurs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes support for arbitrary video pages plus multiple source types and sites such as B站、优酷等, but this file's executable path only handles SITE=sohu and exits for all other sites. The banner also labels it as a '通用网页视频下载器', which overstates what this script actually does.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script fetches an ffmpeg binary from the internet into /tmp and then executes it without any authenticity verification, checksum/signature validation, or user consent. In a video-downloader skill, this expands the trust boundary from local file merging to remote code execution, so a compromised download source, MITM, or replaced binary could execute arbitrary code on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script silently downloads and then runs a network-fetched executable with only a generic status message, giving the user no meaningful warning that code from the internet will be executed. Because this skill is supposed to merge video segments, that behavior is unexpectedly dangerous and materially increases the risk of arbitrary code execution if the fetched binary is malicious or tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file describes taking an arbitrary video webpage URL, detecting sources, and downloading a complete MP4 file, which implies network access and creation of local output files. The README provides usage steps but does not include any warning or disclosure about these data-transfer and filesystem effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description is written entirely in Chinese and does not indicate that the skill is intentionally region-specific or offer an alternative language option. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Comments and user-facing console messages are presented exclusively in Chinese, which imposes a locale/language choice on all users. The policy allows language constraints only when users are given a choice or the restriction is clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's user-facing comments, usage guidance, and status messages are written in Chinese only, which imposes a language choice without opt-in. Under the policy, locale or language constraints should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.