nas-master

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:53 AM UTC
• Version: 1.0.0

Overview

This skill mostly fits a NAS inventory tool, but it asks for broad credentials and persistent indexing while claiming strict read-only safety.

Review before installing. Use only a dedicated low-privilege NAS account, pin SSH host keys, replace blank MySQL root access with a limited database user, define explicit scan roots and exclusions, and avoid generating a web-served dashboard unless you intentionally want the indexed NAS metadata exposed through that local web stack.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

other

Warning

• Location: nas_engine.py:35

Finding

Unrestricted Collection of Sensitive NAS File Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-25; nas_engine.py:35-46
Vulnerability Type: Excessive Sensitive Information Collection
Risk Level: Medium

The skill explicitly directs the scraper to recursively inspect every accessible directory, including hidden system and application directories:

markdown

## 2. Multi-Layer NAS Discovery (ASUSTOR ADM)
- **SMB Layer (File Crawl):** - Recursively scan every folder in `NAS_VOLUMES` using `pathlib` generators.
    - Capture: Name, Path, Size, Extension, and Windows ACLs.
    - Deep Search: Scrape hidden folders like `.@metadata`, `.@encdir`, and `.@plugins`.
- **SSH Layer (Deep System):** - Extract RAID levels via `cat /proc/mdstat`.
    - Extract Btrfs integrity/checksum status via `btrfs scrub status`.
    - Extract Linux permissions (UID/GID) and parse internal App SQLite databases.

The implementation performs the recursive traversal without an allowlist, exclusion rules, scope validation, or a confirmation step:

python

# 2. Crawl Filesystem (including hidden)
root = os.getenv("NAS_ROOT_PATH")
for dirpath, _, filenames in os.walk(root):
    for f in filenames:
        path = os.path.join(dirpath, f)
        try:
            stat = os.stat(path)
            # ACLs and UID/GID logic goes here...
            query = "INSERT IGNORE INTO file_metadata (filename, filepath, raid_context, btrfs_context) VALUES (%s, %s, %s, %s)"
            cursor.execute(query, (f, path, raid, btrfs))
            db.commit()
        except: continue
        time.sleep(0.1) # Throttle for i3 CPU

Technical Analysis

Recursive collection of all reachable file names and paths violates data-minimization and least-privilege principles. File metadata can disclose user identities, confidential project names, backup locations, application internals, encrypted-container locations, and the existence of credential or configuration files even when ...[truncated 1765 chars]

Remediation

View remediation

Remediation Suggestions

• Require an explicit allowlist of approved scan roots rather than accepting an unrestricted root path.
• Resolve and canonicalize each configured path, then verify that it remains under an approved volume before traversal.
• Exclude credential stores, backups, private user directories, application internals, and hidden system directories by default.
• Require an explicit opt-in before scanning hidden or system-managed directories.
• Run the scraper under a dedicated read-only NAS account that can access only the directories necessary for the stated task.
• Store only metadata required for the application and define a retention and deletion policy.
• Restrict access to the metadata database and encrypt sensitive metadata at rest where appropriate.
• Add audit logging that records scan initiators, approved roots, exclusions, start and end times, and record counts.
• Validate that NAS_ROOT_PATH is present and approved before calling os.walk.

T09 · Insecure Skill Coding Practices

Error

• Location: nas_engine.py:7

Finding

SSH Host-Key Verification Disabled

Content

View full analysis

Vulnerability Details

File Location: nas_engine.py:7-11
Vulnerability Type: Insecure SSH Trust Configuration
Risk Level: High

The SSH client automatically trusts an unknown host key:

python

def get_asustor_system_info():
    """Connects via SSH to pull RAID and Btrfs health."""
    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    try:
        ssh.connect(os.getenv("NAS_SSH_HOST"), username=os.getenv("NAS_SSH_USER"), password=os.getenv("NAS_SSH_PASS"))

Technical Analysis

SSH host-key verification authenticates the remote server and protects clients against machine-in-the-middle attacks. Paramiko's AutoAddPolicy accepts and stores previously unknown host keys instead of rejecting them. The code also does not call load_system_host_keys, load a dedicated known-hosts file, or compare the server key against a pinned fingerprint.

Consequently, a client making its first connection—or a client without an existing trusted key—cannot distinguish the intended NAS from an attacker-controlled SSH server. Because password authentication is used, the credentials are supplied during the connection to whichever endpoint is accepted as the server.

Attack Path

1. An attacker obtains a position from which NAS traffic can be intercepted or redirected, such as control of a local gateway, poisoned DNS, ARP spoofing capability, or a compromised network segment.
2. The attacker redirects the connection intended for NAS_SSH_HOST to an attacker-controlled SSH server.
3. The malicious server presents an arbitrary host key.
4. AutoAddPolicy accepts the untrusted host key without operator verification.
5. The client initiates password authentication against the attacker-controlled endpoint.
6. The attacker can capture or misuse the supplied NAS SSH credentials and return fabricated RAID or Btrfs output.

Impact Assessment

Successful exploitation may e ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

• Replace paramiko.AutoAddPolicy() with paramiko.RejectPolicy().
• Load a controlled known-hosts file using load_host_keys, or use load_system_host_keys when system trust configuration is appropriate.
• Provision and pin the NAS host key or fingerprint through a trusted out-of-band process before the first connection.
• Fail closed and display the observed fingerprint when the key is missing or has changed; never silently replace a trusted key.
• Prefer SSH public-key authentication with a dedicated, read-only NAS account instead of an administrative password.
• Protect the private key with appropriate filesystem permissions and, where operationally possible, a passphrase or secure key agent.
• Segment NAS management traffic onto a trusted management network.

T09 · Insecure Skill Coding Practices

Error

• Location: nas_engine.py:26

Finding

Blank-Password MySQL Root Account Hardcoded in Runtime Connection

Content

View full analysis

Vulnerability Details

File Location: nas_engine.py:26-28; .env:26-30
Vulnerability Type: Insecure Database Credentials and Excessive Privileges
Risk Level: High

The application connects directly as MySQL root with an empty password:

python

def run_pro_scraper():
    db = mysql.connector.connect(host="localhost", user="root", password="", database="asustor_pro")
    cursor = db.cursor()

The environment configuration repeats the insecure defaults:

dotenv

DB_HOST="localhost"
DB_USER="root"
DB_PASS=""
DB_NAME="asustor_pro"

Technical Analysis

The database connection violates least privilege by using the MySQL administrative account for routine inserts. It also embeds a blank password in executable code. Although .env defines database settings, the program ignores them and always uses the hardcoded connection parameters.

The localhost host limits the configured connection to the local database endpoint, but it does not make blank administrative credentials safe. Other local users, compromised web applications, or services running on the same host may be able to attempt authentication with the same credentials. In addition, compromise of the scraper process immediately provides a database connection with the privileges granted to MySQL root rather than only the privileges needed for file_metadata.

The repository contains no evidence establishing the MySQL authentication plugin, bind configuration, or whether other connections to root are accepted. Exploitability by an unrelated local process therefore depends on the deployed MySQL configuration. The scraper itself, however, is confirmed to request a blank-password root session.

Attack Path

1. MySQL is deployed with the blank-password root credentials expected by the scraper.
2. An attacker gains code execution in another local application, access to a local account, or control of the scraper process.
3. The attack ...[truncated 1074 chars]

Remediation

View remediation

Remediation Suggestions

• Create a dedicated MySQL service account for the scraper.
• Grant only the minimum required permissions, such as SELECT and INSERT on the required asustor_pro tables. Add UPDATE only if move-tracking is implemented.
• Set a strong, unique, non-empty password and remove blank-password database accounts.
• Read DB_HOST, DB_USER, DB_PASS, and DB_NAME from protected configuration rather than hardcoding credentials.
• Fail closed if any required credential is absent or if DB_PASS is empty.
• Do not commit operational .env files. Provide a sanitized .env.example containing placeholders instead.
• Store production credentials in an operating-system credential store or secrets manager and restrict access to the scraper's service identity.
• Restrict MySQL network exposure, enforce account host constraints, and use TLS if the database is moved off-host.
• Review MySQL grants and authentication plugins to ensure administrative accounts cannot authenticate with blank passwords.
• Rotate any credentials that may already have been deployed with this configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The manifest advertises a strict read-only NAS metadata scraping skill, but the instructions include database writes and generation of PHP files on disk. This mismatch can mislead users and supervising systems into granting trust or access under false assumptions, enabling unintended writes and broader local resource usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill omits a clear user warning that it will access broad NAS content, hidden directories, SSH-derived system details, and database credentials. Without informed consent and disclosure, users may unknowingly expose sensitive metadata, permission structures, and infrastructure details beyond what a simple scraper implies.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions direct broad collection of sensitive information, including hidden folders, Linux permission data, RAID/Btrfs system state, and internal app databases, far beyond a minimal metadata scrape. This creates unnecessary exposure of confidential file structures, security-relevant permission mappings, and potentially application data if the output is stored or surfaced elsewhere.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Claiming strict read-only safety while instructing the agent to persist data into a database is a direct contradiction. Users may authorize the skill believing it cannot modify state, when in fact it performs durable writes that could alter systems, consume storage, or create privacy and compliance issues.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The safety section promises strict read-only behavior, yet the skill elsewhere directs database writes and dashboard file creation. This internal contradiction undermines safety guarantees and can cause operators or users to approve a skill that modifies local or remote state unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to generate a PHP/AJAX dashboard under a XAMPP webroot contradicts the claimed read-only model and introduces local file writes in a web-served directory. That can expose scraped NAS metadata through a web application and creates an avenue for accidental publication, insecure PHP code generation, or persistence on the host.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes the skill as maintaining strict read-only safety for NAS metadata scraping. While the NAS/file access is read-oriented, the implementation opens a database connection and performs INSERT operations with commits, which is write behavior outside a strict read-only interpretation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares access to sensitive environment variables and implies filesystem/credential use, but does not define any explicit tool scope or permission boundaries. This increases the risk that an agent may invoke broader capabilities than the user expects when handling NAS paths, SSH credentials, and database secrets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Because the skill is user-invocable but lacks clear trigger phrases or activation boundaries, it may activate in broader contexts than intended. For a skill handling NAS paths, SSH credentials, and database operations, ambiguous invocation increases the chance of accidental execution and over-broad data access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description centers on ASUSTOR NAS metadata scraping, albeit with hybrid SMB/SSH access. L18-L20 direct the skill to act as a versatile coder, business analyst, and project manager, which materially exceeds the described scraping-focused purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Instructing the skill to continuously search for free online tools, APIs, and resources expands it beyond local NAS scraping into open-ended external discovery. This can lead to unnecessary network access, unvetted third-party interactions, and possible leakage of project context or metadata during external lookups.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A NAS scraping suite may reasonably crawl shares and collect system metadata, but providing business analysis and strategic planning is not an obvious implementation requirement of that purpose. These capabilities appear to be unrelated role expansion rather than support for the stated functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill pulls SSH credentials from environment variables and uses them to establish a remote shell session, giving the code command-execution capability on the NAS. In a metadata-scraping context, this expands the trust boundary significantly; if the target host or environment is manipulated, the code can be repurposed to run arbitrary commands with the supplied account's privileges.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code disables SSH host key verification via AutoAddPolicy(), which makes the connection vulnerable to man-in-the-middle attacks and server impersonation. Because credentials are then sent to the remote endpoint and shell commands are executed, an attacker on the network could intercept access or return falsified system-health data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The function connects to a NAS over SSH, collects RAID and Btrfs health information, and returns that data for later storage, but the file provides no confirmation prompt or explicit user-facing warning about accessing remote system metadata. Although there is a docstring, it describes the behavior only at the function level and does not disclose to a user that remote NAS data will be collected and persisted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code reads NAS_SSH_USER and NAS_SSH_PASS from environment variables to authenticate to a remote system, but there is no explicit warning or disclosure that credentials will be accessed and used. Accessing sensitive credentials is safety-relevant and should be clearly communicated unless documented elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The scraper walks the configured root path, inspects files, and writes file paths and related metadata into a database, but there is no confirmation prompt, warning comment, or docstring explaining this data collection and persistence behavior to the user. This affects potentially sensitive filesystem metadata and performs persistent writes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.