web-video-downloader网页视频下载器

• Outcome: Review
• Latest audit: May 28, 2026 · 10:03 AM UTC
• Version: 1.0.0

Overview

This video-downloader skill does what it claims, but it also captures browser request headers and auto-runs a downloaded ffmpeg binary in ways users should review carefully.

Install only if you understand the Review risks. Prefer installing ffmpeg yourself from a trusted package manager, run CDP capture only in an isolated browser profile logged into the minimum required sites, avoid capturing unrelated tabs, and delete /tmp/captured_video_urls.json after use because it may contain reusable session headers or signed media URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs execution of shell commands, Node scripts, curl, ffmpeg, and browser automation, yet no permissions are declared. That creates a transparency and trust problem: a user or platform may treat the skill as lower-risk than it really is, while it can perform local command execution and network access. In this context, undeclared shell/env capability is materially dangerous because the workflow includes downloading files, invoking external tools, and interacting with browser debugging interfaces.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documentation promises a simple generic video downloader but describes materially different behavior: manual CDP-based interception, site-specific handling, and undisclosed downloading/execution of external ffmpeg binaries. Description-behavior mismatch is a security issue because it prevents informed consent and can hide sensitive operations such as browser traffic capture and execution of third-party binaries. The mismatch makes the skill more dangerous in this context because users expect straightforward media downloading, not debugging-interface access and extra software execution.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly captures and reuses request headers including Cookies and Referer. Those headers can contain authentication tokens and session identifiers, so collecting and replaying them expands the skill from media downloading into credential-bearing request interception. In this context, that is especially risky because CDP monitoring can expose authenticated traffic from arbitrary sites, not just public video URLs.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script silently downloads a third-party ffmpeg archive into /tmp, marks it executable, and then runs it. Executing a remotely fetched binary without integrity verification, signature checking, or explicit user consent creates a software supply-chain risk: if the source, transport, or local /tmp path is compromised, arbitrary code can run with the user's privileges.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script downloads an ffmpeg binary from the internet into /tmp and then executes it without signature, checksum, or provenance verification. This creates a remote code execution supply-chain risk: if the host, transport, DNS, or download path is compromised, the agent will run attacker-controlled code under the user's privileges.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script fetches an ffmpeg binary from the internet into /tmp and immediately executes it without signature, checksum, or provenance verification. That creates a software supply-chain risk: a compromised download source, MITM, or swapped binary would lead to arbitrary code execution under the user's account, which is broader and more dangerous than the skill's stated video-merging purpose.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to attach to a browser via CDP, monitor network traffic, and save captured request URLs, but it does not warn that CDP access can expose cookies, authorization headers, session tokens, and unrelated browsing data from the attached browser context. In a video-downloader skill, this capability is contextually relevant, but the lack of scope limitation and privacy/security guidance makes accidental credential or sensitive-data capture plausible.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to capture browser network requests and headers such as Referer and Cookie without any warning about privacy, account, or session-token exposure. This omission is dangerous because users may unknowingly grant the skill access to authenticated traffic and reusable session data. Given the skill's use of CDP on a live browser, the risk is elevated beyond ordinary downloader functionality.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script captures all matching request URLs and full request headers from browser traffic, then writes them to disk in JSON. Request headers commonly contain sensitive data such as cookies, Authorization tokens, signed CDN query parameters, Referer values, and session identifiers, so persisting them can expose authenticated media URLs or broader account/session access if the output file is read by another user or process. In this skill's context—a video downloader that intentionally intercepts playback traffic—this behavior is more dangerous because it is core functionality rather than incidental logging.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This code performs hidden executable-fetch behavior by downloading ffmpeg from the internet and immediately using it, without a clear warning or opt-in. In a video-downloading skill, network access to media URLs is expected, but fetching and running a new executable is materially more dangerous because it expands trust to an external software supplier and can surprise users.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.