Security audit

MoviePilot MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is for controlling a MoviePilot media server, but it asks users to store and pass powerful credentials while exposing broad admin, browser, file, plugin, and command capabilities with limited safety guidance.

Install only if you trust the publisher and intend to let the agent administer your MoviePilot server. Use a least-privilege or dedicated API token if MoviePilot supports it, restrict file permissions on config.json, avoid sharing tokens in chat or command lines, and manually confirm any delete, plugin, system-setting, site-credential, browser, slash-command, or local-file action before allowing the skill to run it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The guide explicitly instructs users to recover the API token from container environment variables, startup logs, and on-disk config files. While this is framed as setup/troubleshooting, it normalizes credential extraction from sensitive locations and expands exposure paths for a secret that grants authenticated access to the MoviePilot MCP endpoint. In the context of a media-library automation skill, documenting multiple secret-harvesting methods is broader than necessary and increases the chance of accidental disclosure or unsafe operator behavior.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documented `browse_webpage` tool provides general-purpose browser automation, including navigation, form filling, JavaScript execution, cookie injection, and arbitrary page interaction. That capability materially exceeds the stated media-library automation scope and could be abused to access unrelated websites, perform authenticated actions, scrape sensitive data, or pivot into broader account compromise if an agent is induced to use it.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The `run_slash_command` tool can execute any registered slash command, explicitly including system commands such as `/restart` and plugin-defined commands. This creates a generic command-execution surface beyond the skill's stated media-management purpose, enabling privilege expansion, service disruption, or execution of dangerous plugin/system actions through indirect prompt injection or misuse.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to collect the MoviePilot server address and API token in chat and write them to `config.json` without warning about persistence, file location, access controls, or rotation. This creates clear credential-handling risk: secrets may be exposed through chat logs, local files, backups, or other tools with filesystem access.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill exposes multiple destructive operations such as deleting subscriptions, downloads, transfer history, uninstalling plugins, updating system settings, and running workflows, but provides no warnings, confirmation guidance, or distinction between reversible and irreversible actions. In this context, the skill manages a live NAS/media automation system, so misuse could cause data loss, service disruption, or unwanted configuration changes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: File-transfer and local-file sending capabilities can move files into the media library or send local files out of the system, yet the skill does not warn users about filesystem exposure, path sensitivity, or possible disclosure/modification of local data. Because the skill operates against NAS storage and container-visible paths, mistakes or abuse could expose private files or alter library contents unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide tells users to fetch and validate API tokens using logs, environment variables, grep output, and curl query parameters, but provides no warning that these channels can expose credentials to shell history, process listings, shared terminals, logs, screenshots, or copied config files. Because the token is used directly for API authentication, unsafe handling can lead to unauthorized access to the MoviePilot server and its automation capabilities.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation exposes destructive operations such as deleting subscriptions/downloads and modifying download state without any explicit confirmation or warning requirements. In an agent setting, that omission increases the risk of accidental or prompt-induced destructive actions that can stop automation, remove tasks, or delete downloaded files.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The site-management section includes credential-sensitive operations like updating cookies, API keys, tokens, and logging in with username/password, but the documentation lacks any warning about sensitive data handling, storage, redaction, or minimization. This increases the chance that agents request, transmit, log, or mishandle secrets in unsafe ways.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The `update_system_settings` capability can alter broad, persistent system configuration across downloaders, media servers, notifications, storages, AI agent config, and other categories, yet the documentation provides no warning about the global blast radius. In practice, this could silently change core behavior, disrupt services, redirect data flows, or weaken security settings across the whole installation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow documents deletion of download tasks and notes that `delete_files=true` will also remove files, but it does not include a clear safety warning, confirmation requirement, or recovery guidance. In a media-automation skill that operates on real downloads and libraries, this can lead to accidental irreversible data loss if users or downstream agents invoke the command without understanding its destructive effect.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The workflow shows a command that passes site credentials on the command line for `update_site_cookie`, which can expose usernames and passwords through shell history, process listings, logs, or agent telemetry. Because this skill is designed for automation and PT site maintenance, operators may copy the example directly, increasing the chance of credential leakage in multi-user or monitored environments.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script embeds the API key in the request URL and then passes that URL to curl. Query-string secrets are commonly exposed through process listings, shell history, proxy logs, monitoring tools, and server access logs, which can leak a long-lived credential to local users or infrastructure operators.

Static analysis

No suspicious patterns detected.