Grabgrab

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:02 AM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but its shell-based download workflow handles user URLs and API-provided filenames unsafely enough that users should review it before installing.

Install only if you are comfortable sending media URLs to GrabGrab and downloading untrusted media files locally. Avoid private, signed, or token-bearing URLs. A safer version should require confirmation before writing files, generate or sanitize filenames, keep downloads in a chosen directory, validate returned URLs, and build curl payloads without shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:47
• Finding: Shell Command Injection Through a User-Supplied Media URL## Vulnerability Details **File Location**: `SKILL.md`, lines 47-50 **Vulnerability Type**: Shell command injection caused by unsafe interpolation of user input **Risk Level**: High ### Vulnerable Code ```bash curl -s -X POST "https://www.grabgrab.fun/api/download" \ -H "Content-Type: application/json" \ -d '{"url": "<VIDEO_URL>", "videoQuality": "<QUALITY>"}' ``` ### Technical Analysis The Skill instructs the Agent to substitute a user-provided media URL directly into a Bash command. The URL is embedded inside a single-quoted shell argument without requiring shell-safe encoding. If the supplied URL contains a single quote, it can terminate the quoted JSON argument. The remaining input can then introduce shell operators and commands. JSON validity does not prevent this issue because Bash parses the command before `curl` or the remote API processes the JSON. The same pattern applies to the quality placeholder if it can be influenced by untrusted input. The Skill does not require an allowlist, strict parsing, or argument-safe process execution. ### Attack Path 1. An attacker supplies a purported media URL containing a single quote followed by shell syntax. 2. The Agent replaces `<VIDEO_URL>` in the documented command with the supplied value. 3. The injected quote terminates the original shell argument. 4. Bash interprets the remaining characters as shell operators or commands. 5. The injected command executes under the operating-system identity and permissions of the Agent process. ### Impact Assessment Successful exploitation can execute arbitrary shell commands with the Agent's current privileges. Depending on the runtime permissions, this may allow an attacker to read or alter accessible files, exfiltrate environment variables or credentials, download additional payloads, and modify project data. The issue does not independently grant elevated privileges, but it exposes the full authority ...[truncated 50 chars]
• Remediation: ## Remediation Suggestions - Do not create a shell command by textually substituting the user-provided URL. - Invoke `curl` through a structured process API that passes each argument separately and does not invoke a shell. - Generate the request body with a real JSON serializer rather than embedding input in a JSON shell literal. - If Bash is unavoidable, pass values through environment variables or positional parameters and generate JSON with a tool such as `jq`: ```bash payload="$(jq -n --arg url "$VIDEO_URL" --arg quality "$QUALITY" \ '{url: $url, videoQuality: $quality}')" curl --fail --silent --show-error \ -X POST "https://www.grabgrab.fun/api/download" \ -H "Content-Type: application/json" \ --data-binary "$payload" ``` - Validate the URL with a URL parser and permit only expected `https` URLs from explicitly supported media platforms. - Validate quality and mode values against the documented fixed allowlists rather than accepting arbitrary strings. - Use `--fail`, bounded timeouts, and explicit response-size limits for safer network handling.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:80
• Finding: Command Injection and Arbitrary File Write Through API-Controlled Download Fields## Vulnerability Details **File Location**: `SKILL.md`, lines 80-105 **Vulnerability Type**: Unsafe use of remote filenames and URLs in shell commands **Risk Level**: High ### Vulnerable Code ```bash curl -L -o <filename> "<url>" ``` ```bash curl -L -o "<filename>" "<download_url>" ``` ```bash curl -L -o "<filename>" "https://www.grabgrab.fun<proxyUrl>" ``` The values are obtained from the remote API response: ```json { "success": true, "type": "direct", "url": "https://...", "filename": "video.mp4", "proxyUrl": "/api/proxy?url=..." } ``` ### Technical Analysis The Skill treats the remote API's `filename`, `url`, and `proxyUrl` fields as trusted command components. It does not require validation, safe argument passing, URL restrictions, or output-path containment. Quoting with double quotes does not make arbitrary data safe when an Agent constructs a shell command by textual substitution. Shell command substitutions such as `$()` and backticks can still be evaluated inside double quotes. The line using `-o <filename>` is even less protected because the filename placeholder is unquoted, allowing whitespace, metacharacters, and option-like values to affect command parsing. Independently of command injection, an API-provided filename may contain an absolute path or traversal segments such as `../../target`. Passing that value to `curl -o` can write outside the intended download directory. Existing files writable by the Agent could consequently be overwritten. The download URL is also accepted without an explicit HTTPS host allowlist. A compromised or malicious API response could therefore direct the Agent to an unintended destination. ### Attack Path 1. An attacker compromises, controls, or manipulates the GrabGrab API response or another response-producing component. 2. The response supplies a crafted `filename`, `url`, or `proxyUrl`. 3. ...[truncated 845 chars]
• Remediation: ## Remediation Suggestions - Treat every API response field as untrusted data. - Pass the output path and URL as separate arguments through a process-execution API that does not invoke a shell. - Reduce remote filenames to a safe basename and reject absolute paths, `.` or `..` components, path separators, control characters, shell metacharacters, and leading hyphens. - Resolve the final output path and verify that it remains inside a dedicated download directory before opening or writing it. - Prefer locally generated filenames, such as a random identifier plus an extension selected from a strict allowlist. - Insert `--` before positional URL arguments where supported to prevent option injection. - Parse download URLs and require HTTPS. Restrict hosts to an explicit allowlist of expected GrabGrab proxy and approved media-delivery domains. - Validate `proxyUrl` as a relative path with the expected `/api/proxy` route; do not accept a scheme, authority, backslashes, or path traversal. - Avoid overwriting existing files by using exclusive file creation or a collision-resistant generated filename. - Apply download size limits, connection and transfer timeouts, and content-type checks before retaining downloaded content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The workflow sends the user-provided URL to a third-party service at grabgrab.fun, but the skill does not disclose this data transfer or obtain consent first. This is a genuine privacy and trust issue because URLs can contain sensitive tokens, private links, or identifying information that will be transmitted outside the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

Use `curl` via the Bash tool to call the API:

```bash
curl -s -X POST "https://www.grabgrab.fun/api/download" \
  -H "Content-Type: application/json" \
  -d '{"url": "<VIDEO_URL>", "videoQuality": "<QUALITY>"}'
```

• Confidence: 97% confidence
• Finding: This command explicitly transmits user-supplied input to an external network endpoint, which is acceptable only if clearly disclosed and consented to. In this skill's context, the transmission is core functionality, but it is still security-relevant because it exposes potentially sensitive URLs and creates dependency on an external service outside the user's control.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically download files to the current working directory and then report the local path, but it does not require an explicit confirmation that a local file write will occur. This creates a real safety issue because user-triggered URL handling leads directly to persistent filesystem changes, which can surprise users and increase the risk of unwanted or abusive downloads filling disk or placing untrusted media on the host.

Static analysis

No suspicious patterns detected.