emby

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:47 PM UTC
• Version: 1.0.0

Overview

This appears to be a real Emby integration, but it gives an agent broad server-administration powers and weak credential handling without clear safeguards.

Install only if you intentionally want an agent to administer an Emby server, not merely browse media. Before use, replace the embedded example with a least-privileged key stored outside source code, restrict the configured server URL, and require explicit human confirmation for deletes, backup restore, auth-key creation, uploads, downloads, environment browsing, and configuration changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: emby.py:5
• Finding: Hard-Coded Emby API Credential in Source Code and Documentation<![CDATA[ ## Vulnerability Details **File Location**: `emby.py:5-6` **Vulnerability Type**: Hard-coded secret **Risk Level**: High ### Complete Code Snippet ```python BASE_URL = "https://emby.example.com/emby" API_KEY = "652436b1ffa84d9a85f579eeb34b87aa" ``` The same credential-shaped value is also shown in `SKILL.md:11-15`: ```python BASE_URL = "https://emby.example.com/emby" # Modify to your Emby server address API_KEY = "652436b1ffa84d9a85f579eeb34b87aa" # Modify to your API key ``` ### Technical Analysis The Emby API key is stored directly in application source and repeated in the documentation. If this is an active credential, anyone who can read the package, repository history, distribution archive, build output, or logs containing the source can recover it. Even if the current value is intended only as an example, this configuration pattern encourages users to replace it with a production credential in a tracked source file. Such replacement credentials can subsequently be committed or distributed accidentally. The key is used globally by an API client exposing a broad server-management surface. Depending on server-side permissions, it may authorize operations involving media, users, devices, server configuration, backups, and server environment information. ### Attack Path 1. A user commits, publishes, distributes, or otherwise exposes the Skill package containing a valid API key. 2. An attacker obtains the package or repository and extracts `API_KEY` from `emby.py`, documentation, or version history. 3. The attacker identifies the associated Emby endpoint from configuration, deployment records, or infrastructure discovery. 4. The attacker submits requests to Emby API endpoints using the extracted key. 5. Emby processes the requests with all privileges assigned to that key. ### Impact Assessment If the hard-coded value is valid and the corresponding Emby server is reachable, an attacker may obtain the privileges assigned to the key. Th ...[truncated 651 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the committed API key if it has ever been active. 2. Remove the key from the current source tree and repository history. 3. Load credentials from an environment variable or protected secret manager: ```python import os BASE_URL = os.environ["EMBY_BASE_URL"] API_KEY = os.environ["EMBY_API_KEY"] ``` 4. Fail closed when the key is missing rather than supplying a built-in default. 5. Replace documentation values with unmistakable placeholders such as `YOUR_EMBY_API_KEY`. 6. Add secret-scanning checks to pre-commit hooks and CI pipelines. 7. Use a dedicated Emby credential with only the permissions required by the deployment. 8. Separate read-only operations from administrative or destructive operations by using distinct credentials where Emby supports that model. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: emby.py:12
• Finding: Emby API Key Exposed Through URL Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `emby.py:12-28` **Vulnerability Type**: Sensitive credential transmitted in URL query strings **Risk Level**: High ### Complete Code Snippet ```python def _request(method: str, endpoint: str, params: Optional[Dict] = None, data: Optional[Dict] = None, stream: bool = False) -> Union[Dict, Response]: """Base request method""" url = f"{BASE_URL}{endpoint}" params = params or {} params["api_key"] = API_KEY if method.upper() == "GET": resp = requests.get(url, params=params, headers=HEADERS, stream=stream) elif method.upper() == "POST": resp = requests.post(url, params=params, json=data, headers=HEADERS, stream=stream) elif method.upper() == "PUT": resp = requests.put(url, params=params, json=data, headers=HEADERS, stream=stream) elif method.upper() == "DELETE": resp = requests.delete(url, params=params, headers=HEADERS, stream=stream) else: raise ValueError(f"Unsupported method: {method}") if stream: return resp return resp.json() ``` The same pattern is independently used for camera uploads, image retrieval, branding content, and media streams, including `emby.py:278-285`, `emby.py:430-465`, `emby.py:970-977`, `emby.py:1295-1319`, and `emby.py:1337-1358`. ### Technical Analysis The shared request function adds the API key to `params`, causing `requests` to serialize the secret into the URL as `api_key=<secret>`. Although the configured endpoint uses HTTPS, transport encryption does not prevent the URL from being recorded after TLS termination. Query strings can be retained by: - Emby access logs. - Reverse proxies, gateways, load balancers, and web application firewalls. - Monitoring, tracing, and application-performance systems. - Error reports and exception telemetry. - Debugging output or request-history tools. - Browser or intermediary history when generated stream URLs are reused. - Re ...[truncated 2000 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use an Emby-supported authentication header rather than a query-string credential. Apply it centrally through a configured `requests.Session`. 2. Remove all independently constructed `{"api_key": API_KEY}` parameter dictionaries from upload, image, branding, video, and audio functions. 3. Prevent credentials from being forwarded to a different origin during redirects. Prefer disabling redirects for authenticated requests or validating every redirect destination. 4. Configure Emby, reverse proxies, gateways, and monitoring systems to redact authentication query parameters from existing logs until migration is complete. 5. Rotate the current API key after changing the authentication mechanism because it may already exist in historical logs. 6. Add request timeouts and centralized error handling while refactoring the network layer. 7. Restrict the configured base URL to trusted HTTPS endpoints and validate its scheme and expected host. 8. Use a dedicated least-privileged key, with separate read-only and administrative credentials where supported. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (20)

Ae1

High

• Category: analysis-evasion

Content

配置参数位于 `emby.py` 文件顶部:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

配置参数位于 `emby.py` 文件顶部:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file is not a narrow media-read wrapper; it includes broad destructive and administrative operations such as deleting devices, users, items, virtual folders, restoring backups, changing encoding settings, and issuing UI commands. In a skill context, this is dangerous because an LLM-driven agent could invoke powerful state-changing actions far beyond typical user expectations, causing service disruption, configuration tampering, or data loss.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Deleting user accounts is a high-risk administrative action that can remove access, preferences, and associated state. In an unconstrained skill, exposing this as a simple wrapper method with no additional safeguards creates a serious risk of account disruption or denial of service.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Backup restore is a highly privileged operation that can overwrite service state, configuration, and data. Allowing an agent skill to upload restore material and initiate a restore without warnings or additional controls creates severe integrity and availability risk.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This section exposes environment and filesystem enumeration capabilities such as path validation, directory listing, drive enumeration, network share discovery, and parent-path resolution. In an agent skill with no clearly constrained purpose, these capabilities materially expand the attack surface by enabling reconnaissance of the local or server-side filesystem and infrastructure, which can be chained with other operations for data discovery or targeting.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The skill switches into Chinese for configuration and usage instructions, which effectively forces a specific language for users reading the operational guidance. There is no indication that Chinese is optional, no bilingual alternative, and no justification that this skill is intended only for a Chinese-language environment.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documentation advertises potentially destructive or privacy-sensitive actions such as file downloads, uploads, and backup restore without any warning, confirmation guidance, or scope limitations. In an agent setting, this can normalize high-impact operations and increase the chance that a user or downstream agent triggers data modification, overwrite, exfiltration, or service disruption without understanding the consequences.

External Transmission

Medium

• Category: Data Exfiltration

Content

if method.upper() == "GET":
        resp = requests.get(url, params=params, headers=HEADERS, stream=stream)
    elif method.upper() == "POST":
        resp = requests.post(url, params=params, json=data, headers=HEADERS, stream=stream)
    elif method.upper() == "PUT":
        resp = requests.put(url, params=params, json=data, headers=HEADERS, stream=stream)
    elif method.upper() == "DELETE":

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

elif method.upper() == "POST":
        resp = requests.post(url, params=params, json=data, headers=HEADERS, stream=stream)
    elif method.upper() == "PUT":
        resp = requests.put(url, params=params, json=data, headers=HEADERS, stream=stream)
    elif method.upper() == "DELETE":
        resp = requests.delete(url, params=params, headers=HEADERS, stream=stream)
    else:

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This endpoint deletes devices without any built-in approval, role check, or warning mechanism in the skill wrapper. In an autonomous or semi-autonomous agent context, destructive device removal can disrupt service access and revoke trusted clients unexpectedly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This function reads a local file path and uploads its contents to the remote Emby server. In an agent setting, accepting an arbitrary file path without a clear consent boundary can lead to unintended exfiltration of local files or sensitive media from the host environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Batch deletion magnifies the blast radius of destructive actions by allowing multiple devices to be removed in one call. In an agent skill, this increases the risk of accidental or induced large-scale service disruption.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This function deletes library items in bulk with no confirmation or safety interlock at the skill layer. If invoked by an agent from ambiguous instructions, it can cause significant media loss or corruption of a user's library state.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Single-item deletion is still a destructive operation that can remove user content or metadata without review. In a generic skill wrapper, the absence of confirmation or scoped intent checks makes accidental deletion plausible.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This batch delete endpoint can remove multiple items with a single call and does not impose any user-facing warning or confirmation. Combined with agent autonomy, that creates a substantial risk of large-scale accidental data removal.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This helper writes remotely fetched data to an arbitrary local path supplied by the caller. Without safeguards, an agent could overwrite files in unintended locations, facilitating local file tampering or unsafe persistence on the host.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Deleting virtual folders changes server configuration and can hide or remove access paths to media libraries. This is a configuration-destructive action that should not be trivially exposed in a generic agent skill.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This helper streams remote content and writes it to any caller-supplied local path. In an agent environment, arbitrary file writes can be abused to overwrite files, fill disk space, or create unauthorized local artifacts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Like the video download helper, this function writes remote data to an arbitrary local destination without guardrails. That creates a local integrity and misuse risk, especially if an agent can choose destinations autonomously.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: emby.py:6

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:14