T09 · Insecure Skill Coding Practices
Error
- Location
emby.py:5- Finding
Hard-Coded Emby API Credential in Source Code and Documentation
- Content
View full analysis
- Remediation
View remediation
Security audit
emby
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Emby integration, but it gives an agent broad server-administration powers and weak credential handling without clear safeguards.
Install only if you intentionally want an agent to administer an Emby server, not merely browse media. Before use, replace the embedded example with a least-privileged key stored outside source code, restrict the configured server URL, and require explicit human confirmation for deletes, backup restore, auth-key creation, uploads, downloads, environment browsing, and configuration changes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
emby.py:12- Finding
Emby API Key Exposed Through URL Query Parameters
- Content
View full analysis
Union[Dict, Response]: """Base request method""" url = f"{BASE_URL}{endpoint}" params = params or {} params["api_key"] = API_KEY if method.upper() == "GET": resp = requests.get(url, params=params, headers=HEADERS, stream=stream) elif method.upper() == "POST": resp = requests.post(url, params=params, json=data, headers=HEADERS, stream=stream) elif method.upper() == "PUT": resp = requests.put(url, params=params, json=data, headers=HEADERS, stream=stream) elif method.upper() == "DELETE": resp = requests.delete(url, params=params, headers=HEADERS, stream=stream) else: raise ValueError(f"Unsupported method: {method}") if stream: return resp return resp.json() ``` The same pattern is independently used for camera uploads, image retrieval, branding content, and media streams, including `emby.py:278-285`, `emby.py:430-465`, `emby.py:970-977`, `emby.py:1295-1319`, and `emby.py:1337-1358`. ### Technical Analysis The shared request function adds the API key to `params`, causing `requests` to serialize the secret into the URL as `api_key=`. Although the configured endpoint uses HTTPS, transport encryption does not prevent the URL from being recorded after TLS termination. Query strings can be retained by: - Emby access logs. - Reverse proxies, gateways, load balancers, and web application firewalls. - Monitoring, tracing, and application-performance systems. - Error reports and exception telemetry. - Debugging output or request-history tools. - Browser or intermediary history when generated stream URLs are reused. - Re ...[truncated 2000 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (20)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 配置参数位于 `emby.py` 文件顶部:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 配置参数位于 `emby.py` 文件顶部:
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file is not a narrow media-read wrapper; it includes broad destructive and administrative operations such as deleting devices, users, items, virtual folders, restoring backups, changing encoding settings, and issuing UI commands. In a skill context, this is dangerous because an LLM-driven agent could invoke powerful state-changing actions far beyond typical user expectations, causing service disruption, configuration tampering, or data loss.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Deleting user accounts is a high-risk administrative action that can remove access, preferences, and associated state. In an unconstrained skill, exposing this as a simple wrapper method with no additional safeguards creates a serious risk of account disruption or denial of service.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Backup restore is a highly privileged operation that can overwrite service state, configuration, and data. Allowing an agent skill to upload restore material and initiate a restore without warnings or additional controls creates severe integrity and availability risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section exposes environment and filesystem enumeration capabilities such as path validation, directory listing, drive enumeration, network share discovery, and parent-path resolution. In an agent skill with no clearly constrained purpose, these capabilities materially expand the attack surface by enabling reconnaissance of the local or server-side filesystem and infrastructure, which can be chained with other operations for data discovery or targeting.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill switches into Chinese for configuration and usage instructions, which effectively forces a specific language for users reading the operational guidance. There is no indication that Chinese is optional, no bilingual alternative, and no justification that this skill is intended only for a Chinese-language environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documentation advertises potentially destructive or privacy-sensitive actions such as file downloads, uploads, and backup restore without any warning, confirmation guidance, or scope limitations. In an agent setting, this can normalize high-impact operations and increase the chance that a user or downstream agent triggers data modification, overwrite, exfiltration, or service disruption without understanding the consequences.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python if method.upper() == "GET": resp = requests.get(url, params=params, headers=HEADERS, stream=stream) elif method.upper() == "POST": resp = requests.post(url, params=params, json=data, headers=HEADERS, stream=stream) elif method.upper() == "PUT": resp = requests.put(url, params=params, json=data, headers=HEADERS, stream=stream) elif method.upper() == "DELETE":
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python elif method.upper() == "POST": resp = requests.post(url, params=params, json=data, headers=HEADERS, stream=stream) elif method.upper() == "PUT": resp = requests.put(url, params=params, json=data, headers=HEADERS, stream=stream) elif method.upper() == "DELETE": resp = requests.delete(url, params=params, headers=HEADERS, stream=stream) else:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This endpoint deletes devices without any built-in approval, role check, or warning mechanism in the skill wrapper. In an autonomous or semi-autonomous agent context, destructive device removal can disrupt service access and revoke trusted clients unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This function reads a local file path and uploads its contents to the remote Emby server. In an agent setting, accepting an arbitrary file path without a clear consent boundary can lead to unintended exfiltration of local files or sensitive media from the host environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Batch deletion magnifies the blast radius of destructive actions by allowing multiple devices to be removed in one call. In an agent skill, this increases the risk of accidental or induced large-scale service disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This function deletes library items in bulk with no confirmation or safety interlock at the skill layer. If invoked by an agent from ambiguous instructions, it can cause significant media loss or corruption of a user's library state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Single-item deletion is still a destructive operation that can remove user content or metadata without review. In a generic skill wrapper, the absence of confirmation or scoped intent checks makes accidental deletion plausible.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This batch delete endpoint can remove multiple items with a single call and does not impose any user-facing warning or confirmation. Combined with agent autonomy, that creates a substantial risk of large-scale accidental data removal.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This helper writes remotely fetched data to an arbitrary local path supplied by the caller. Without safeguards, an agent could overwrite files in unintended locations, facilitating local file tampering or unsafe persistence on the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Deleting virtual folders changes server configuration and can hide or remove access paths to media libraries. This is a configuration-destructive action that should not be trivially exposed in a generic agent skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This helper streams remote content and writes it to any caller-supplied local path. In an agent environment, arbitrary file writes can be abused to overwrite files, fill disk space, or create unauthorized local artifacts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Like the video download helper, this function writes remote data to an arbitrary local destination without guardrails. That creates a local integrity and misuse risk, especially if an agent can choose destinations autonomously.
- Content