Thunder

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:20 AM UTC
• Version: 1.1.0

Overview

This is a coherent local Thunder/Xunlei link converter with no network, credential, persistence, or file-mutation behavior, though users should treat decoded untrusted links as unsafe terminal output.

Installers should understand this is a small local link-conversion helper. Avoid decoding links from untrusted sources directly into an interactive terminal, or inspect output in a context that escapes control characters.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/thunderlink.py:14

Finding

Terminal Escape-Sequence Injection Through Decoded Link Output

Content

View full analysis

Vulnerability Details

File Location: scripts/thunderlink.py, lines 14–15 and 38
Vulnerability Type: Unsanitized terminal output
Risk Level: Medium

Vulnerable Code

python

def _b64decode(data: str) -> str:
    pad = -len(data) % 4
    return base64.b64decode(data + "=" * pad).decode("utf-8", "replace")

python

try:
    print(decode(value) if action == "decode" else encode(value))
except Exception as e:
    print(f"错误: {e}", file=sys.stderr)
    sys.exit(2)

Technical Analysis

The Base64 content of a thunder://, qqdl://, or flashget:// link is attacker-controlled. The decoder converts arbitrary decoded bytes into a string and prints that string directly to standard output without filtering terminal control characters or verifying that the result is a valid URL.

Consequently, a malicious payload can contain ANSI CSI sequences, OSC sequences, or other C0/C1 control characters. When the command runs in a compatible interactive terminal, the terminal may interpret those characters as commands rather than display them as inert text.

The Thunder wrapper check does not prevent exploitation because an attacker can place control sequences between the expected AA and ZZ markers. The QQDL decoder has no wrapper requirement, while the FlashGet decoder only removes occurrences of [FLASHGET].

Attack Path

1. An attacker constructs a string containing a terminal escape sequence, optionally embedded in text resembling a URL.
2. The attacker adds the format-specific wrapper where needed and Base64-encodes the string.
3. The attacker distributes the resulting thunder://, qqdl://, or flashget:// link.
4. A user or agent invokes python3 scripts/thunderlink.py decode '<crafted-link>', consistent with the documented workflow.
5. _b64decode() converts the hostile bytes into a Python string.
6. main() sends the decoded string directly to standard output with ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate decoded results against an explicit allowlist of supported URL schemes, such as http, https, ftp, or another deliberately supported set.
2. Reject decoded strings containing C0 or C1 control characters, including ESC, except for any characters explicitly required by the accepted format.
3. Reject carriage returns and line feeds if each invocation is expected to produce exactly one URL.
4. Preserve the format wrappers strictly:
   • Require AA...ZZ for Thunder links instead of returning unwrapped data.
   • Require exact [FLASHGET]... [FLASHGET] framing rather than globally replacing marker text.
5. If arbitrary decoded data must remain supported, render unsafe characters in an escaped form, such as \x1b, instead of printing them literally.
6. Add tests covering ANSI CSI sequences, OSC sequences, embedded newlines, null bytes, malformed wrappers, and non-URL decoded values.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The primary skill title and core instructional content are presented in Chinese, and the description labels it as a China-specific Thunder/Xunlei tool without offering a user language choice. This can violate language/locale policy when a skill effectively assumes a specific language for operation or documentation without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.