Trust Assessment
aria2-json-rpc received a trust score of 23/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 8 findings: 0 critical, 3 high, 5 medium, and 0 low severity. Key findings include Unsafe deserialization / dynamic eval, Suspicious import: urllib.request, Dangerous call: __import__().
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings8
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsafe deserialization / dynamic eval Python builtins/import manipulation Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/azzgo/aria2-json-rpc/scripts/dependency_check.py:42 | |
| HIGH | Dangerous call: __import__() Call to '__import__()' detected in function 'check_builtin_modules'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/azzgo/aria2-json-rpc/scripts/dependency_check.py:42 | |
| HIGH | Plain-text RPC Secret Transmission The `rpc_client.py` and `websocket_client.py` scripts transmit the `secret` token over the network. If the `secure` configuration option is set to `false` (as shown in the `SKILL.md` example configuration), this secret will be sent in plain text over unencrypted HTTP or WebSocket connections. An attacker monitoring network traffic could easily intercept and compromise the aria2 RPC secret, gaining unauthorized control over the aria2 daemon. Agents should be explicitly instructed to always set `secure: true` in the configuration when a `secret` token is used, especially if connecting to a remote aria2 instance. The `SKILL.md` example configuration should be updated to reflect `"secure": true` when a secret is present. Additionally, consider adding a warning or error in `config_loader.py` if a secret is configured but `secure` is false. | LLM | scripts/rpc_client.py:105 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/azzgo/aria2-json-rpc/scripts/dependency_check.py:6 | |
| MEDIUM | Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/azzgo/aria2-json-rpc/scripts/websocket_client.py:5 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/azzgo/aria2-json-rpc/scripts/config_loader.py:23 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/azzgo/aria2-json-rpc/scripts/rpc_client.py:13 | |
| MEDIUM | Potential Arbitrary File Read via Torrent/Metalink Addition The `rpc_client.py`'s `add_torrent` and `add_metalink` methods are designed to read local files (e.g., `.torrent`, `.metalink`) and base64 encode their content for transmission to aria2. If an AI agent passes an untrusted, user-provided file path to these methods without proper validation, the skill could be coerced into reading arbitrary files from the local filesystem (e.g., `/etc/passwd`, `/root/.ssh/id_rsa`). The content of these files would then be base64 encoded and sent to the aria2 RPC endpoint, potentially exfiltrating sensitive data. While the `add-torrent.py` example checks `os.path.isfile`, the core `rpc_client.py` does not perform content validation, and the `SKILL.md` does not explicitly warn the agent about validating user-provided file paths for these operations. Instruct the AI agent to strictly validate any user-provided file paths for torrents or metalinks, ensuring they point to expected file types and locations, and do not contain path traversal sequences (e.g., `../`). Consider adding explicit path validation within the `add_torrent` and `add_metalink` methods in `rpc_client.py` to restrict file access to a designated 'downloads' or 'torrents' directory, or to only allow files with specific extensions. | LLM | scripts/rpc_client.py:300 |
Scan History
Embed Code
[](https://skillshield.io/report/0847bce54cd22aa6)
Powered by SkillShield