Security audit

MoviePilot MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real MoviePilot media-automation integration, but it exposes broad administrative, credential, filesystem, browser, and persistent agent-behavior controls without enough scoping or safety gates.

Install only if you trust the MoviePilot instance, the token has appropriate privileges, and you are comfortable giving the skill broad administrative control. Prefer HTTPS, avoid putting tokens in command lines or chat logs, restrict config.json permissions, use the least-privileged MoviePilot token available, and manually confirm any deletion, file transfer, plugin, system setting, persona, slash-command, browser, or local-file-send operation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mp_call.py:55
Finding: API Token Exposure Through URL Query Strings and Plaintext HTTP
Content: View full analysis
:3001/api/v1/mcp/tools?apikey=" ``` ### Technical Analysis The MoviePilot API token is inserted directly into the request URL as the `apikey` query parameter. Query-string credentials can be recorded by HTTP access logs, reverse proxies, monitoring systems, shell tooling, process telemetry, browser history, or diagnostic output. The project also accepts and recommends `http://` server addresses. When HTTP is used, neither the token nor the administrative request body is protected in tran ...[truncated 1336 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.py:15
Finding: Plaintext API Token Stored Without Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.py:140
Finding: Command-Line Configuration Mode Exposes the API Token
Content: View full analysis
1: try: cfg = json.loads(sys.argv[1]) except json.JSONDecodeError: print("Error: Invalid JSON format", file=sys.stderr) print(' Example: python3 setup.py \'{"base_url":"http://IP:3001","apikey":"my-key"}\'', file=sys.stderr) sys.exit(1) base_url = cfg.get("base_url", "") apikey = cfg.get("apikey", "") ``` The documented invocation passes the secret directly in the argument vector: ```bash python3 scripts/setup.py '{"base_url":"http://IP:3001","apikey":"***"}' ``` ### Technical Analysis Command-line arguments are not an appropriate transport for long-lived secrets. Depending on the operating system and deployment environment, arguments may be visible through process-listing utilities, `/proc` interfaces, endpoint monitoring, audit systems, orchestration telemetry, crash diagnostics, and shell history. Masking the token only after parsing does not prevent this exposure because the complete token has already been provided to the shell and process argument vector. ### Attack Path 1. A user follows the documented one-command setup procedure and places the API token in the JSON argument. 2. The shell records the command in history, or the operating system exposes the process argument vector while setup is running. 3. Another local user, monitoring agent, log collector, or compromised process reads the command. 4. The attacker extracts the `apikey` value. 5. The attacker uses the token to authenticate to MoviePilot and invoke authorized MCP operations. ### Impact Assessment An attacker who recovers the command-line arg ...[truncated 418 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/mp_call.py:32
Finding: Unrestricted Dispatch of Privileged MCP Tools Without Client-Side Authorization Boundaries
Content: View full analysis
[json_args]", file=sys.stderr) print(f'Example: {sys.argv[0]} search_media \'{{"title":"Example","media_type":"tv"}}\'', file=sys.stderr) sys.exit(1) tool_name = sys.argv[1] args_str = sys.argv[2] if len(sys.argv) > 2 else "{}" try: arguments = json.loads(args_str) except json.JSONDecodeError as e: print(f"Error: Invalid JSON arguments: {e}", file=sys.stderr) sys.exit(1) base_url, apikey = load_config() body = json.dumps({ "jsonrpc": "2.0", "method": "tools/call", "params": {"name": tool_name, "arguments": arguments}, "id": 1 }, ensure_ascii=False) ``` The referenced tool catalog includes privileged operations such as: ```text install_plugin uninstall_plugin update_system_settings update_persona_definition run_slash_command send_local_file browse_webpage ``` The browser tool also supports arbitrary page-context JavaScript evaluation: ```text 'evaluate': Execute JavaScript code on the page and return the result ``` ### Technical Analysis The client accepts any `tool_name` and arbitrary JSON arguments and forwards them under one configured API token. It implements no allowlist, privilege tier, path policy, argument validation, destination restriction, or confirmation gate. The Skill's ordinary media-search and subscription use cases do not require every documented administrative capability. Nevertheless, the same dispatch channel can request plugin installation, persistent persona modification, system-setting changes, local-file transmission, slash-comman ...[truncated 2170 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description focuses on media-library automation, but the skill also collects API credentials, stores them locally in config.json, and performs setup/connectivity actions not disclosed in the top-level purpose. This mismatch can mislead users and reviewers about sensitive behavior, increasing the risk of credential exposure and unauthorized network interactions under the guise of normal media operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This tool can delete download tasks and optionally delete the underlying files, but the documentation lacks a prominent warning about irreversible data loss. In a media-management context this directly affects user content on disk, so accidental or manipulated invocations can destroy downloaded media.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 92% confidence
Finding: File transfer/organize can move, copy, hardlink, or symlink files and optionally target custom paths, yet the documentation does not prominently warn about filesystem modifications. Because it can relocate or overwrite media-library content, misuse could cause data loss, broken library state, or writes into unintended destinations.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The automatic login tool directly asks for username, password, and optionally 2FA material, but the documentation lacks an explicit credential-handling warning. This creates a high-risk secret collection surface where users may disclose reusable credentials to an agent/tooling path that may be logged or reused unexpectedly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: System-wide settings management grants the skill the ability to alter core configuration across downloaders, storages, media servers, notifications, AI agent config, and site auth parameters. This is much broader than normal media search/subscription tasks and could be abused to redirect storage, disable protections, change integrations, or exfiltrate through reconfiguration.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Broad system settings updates can alter critical configuration but the docs do not present the action as high-risk or potentially service-impacting. In this context, one mistaken update could disable integrations, corrupt routing to downloaders/storage, or change security-relevant settings globally.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The slash-command executor can invoke any registered system or plugin command, including commands outside the documented media-management purpose. Because commands are executed asynchronously and may include administrative actions, this becomes a broad capability-escalation surface whose real effect depends on what commands are installed at runtime.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill exposes a fully generic browser automation primitive (navigate, click, fill, run JavaScript, set cookies/user-agent) that materially exceeds a media-library automation scope. In an agent setting, this can be repurposed for arbitrary web interaction, credential submission, CSRF-like actions, data extraction from intranet/admin panels, or policy bypass through a real browser context.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow documents deletion of download tasks and notes that delete_files=true can also remove underlying files, but it does not prominently warn about the risk of permanent data loss. In an automation or agent context, this increases the chance that a user or downstream agent issues a destructive command without understanding that media files may be erased.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises user-invocable behavior but does not declare any tool scope or allowed-tools, despite clearly requiring shell execution and file writes for setup and operation. This weakens least-privilege controls and can allow broader-than-expected execution capabilities if the host agent exposes general shell/file access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the AI to collect a server address and API token in conversation and write them to config.json, but it does not prominently warn users that sensitive credentials will be stored locally. Users may disclose secrets without understanding retention, storage location, or access implications, which raises the chance of accidental credential leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill exposes destructive and high-impact capabilities such as deleting downloads/history, updating sites, changing system settings, installing or uninstalling plugins, running workflows, and sending files, but it provides no safety warnings or confirmation requirements. In this context, an agent could cause data loss, service disruption, or unwanted system changes through ordinary-looking requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document instructs users how to obtain and handle an API token but provides no warning that the token is a sensitive credential granting API access. This omission can lead users to copy, store, or share the token insecurely, increasing the chance of accidental disclosure and unauthorized use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guide explicitly teaches multiple ways to recover the MoviePilot API token from environment variables, startup logs, and in-container files. While this may be intended for operator setup and recovery, it normalizes credential extraction techniques and broadens the skill from media automation into secret discovery, which increases misuse risk if the document is exposed to someone without legitimate admin access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example uses the API key directly in the URL query string, which can leak through shell history, process listings, reverse proxies, browser history, and server access logs. Even for a local service, this is a poor secret-handling pattern because it encourages users to expose long-lived credentials during routine testing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Deleting subscriptions is a destructive state-changing action, and the documentation does not prominently require confirmation or warn that automatic downloads will stop. In an agent workflow, an ambiguous or maliciously phrased request could cause silent loss of automation state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: Metadata scraping writes files and can overwrite existing metadata, but the tool description does not foreground that filesystem contents may be modified. This can lead to accidental clobbering of curated NFO/poster assets or unintended writes to remote storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Site configuration updates accept sensitive fields including cookie, API key, token, and User-Agent, but there is no explicit warning about credential sensitivity or safe handling. In an agent environment, this increases the chance of secrets being supplied, logged, or modified without the operator appreciating the security implications.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Persona switching and persona definition updates are unrelated to MoviePilot's stated media automation purpose and can persistently alter future agent behavior. In an agentic environment, that creates an instruction-layer tampering surface that could weaken safeguards, change response policies, or socially engineer future interactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Persona definition updates are persistent and affect future agent behavior, but the documentation does not clearly warn about that lasting impact. This can lead to unintentional policy drift or deliberate weakening of future safety behavior through seemingly harmless style changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The custom identifier update replaces the entire global rule set and affects future media recognition, yet the warning is buried in descriptive text rather than enforced as a strong safety constraint. A mistaken or hostile update could silently break recognition across all torrents/files or introduce overbroad matching rules with widespread operational impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file documents delete_subscribe as a delete operation but provides no warning about its impact, reversibility, or the need to confirm the target subscription before running it. For markdown files, destructive actions affecting user-managed data should include a clear warning about potential consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown shows update_site_cookie with username and password parameters, which involves handling sensitive credentials, but it does not warn users about credential exposure risks or safe input practices. For markdown files, descriptions should disclose privacy-sensitive behaviors when credentials are involved.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The install/uninstall examples include uninstall_plugin but do not warn that removing a plugin may disable automation or remove related configuration/data depending on plugin behavior. Markdown instructions for operations affecting system functionality should mention possible impact so users can make informed decisions.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/mp_call.py (reported line 57)May include surrounding context.
python
# Use curl subprocess for Unicode-safe URL handling url = f"{base_url}/api/v1/mcp?apikey={apikey}" proc = subprocess.run( ["curl", "-s", "--connect-timeout", "10", "--max-time", "45", "-X", "POST", url, "-H", "Content-Type: application/json",